last executing test programs: 6m4.041267329s ago: executing program 2 (id=42): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sysvipc/shm\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000019c0)={0x2020}, 0x2020) 6m3.962591921s ago: executing program 2 (id=43): mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0xf) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) add_key(0x0, 0x0, &(0x7f0000000100)="305c0605", 0x4, 0xfffffffffffffffe) r0 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d25a98", 0x3, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xffffffffffffff02, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000480)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 6m2.928751787s ago: executing program 2 (id=44): r0 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, 0x0) socket$kcm(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x4, 0x2}}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, 0x0, &(0x7f0000000280)) 6m1.865987812s ago: executing program 2 (id=46): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, 0x0) setpgid(0x0, r0) mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x10000, 0x0) mount$afs(0x0, &(0x7f0000000200)='./file1\x00', 0x0, 0x88, 0x0) 6m1.620332647s ago: executing program 2 (id=48): socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$kcm(0xa, 0x922000000003, 0x11) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000180)=ANY=[], 0x0}, 0x94) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) lseek(0xffffffffffffffff, 0x1800000, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r5, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r7 = accept(r5, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xd0}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)=ANY=[@ANYRES8=r2], 0x6c}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) connect$unix(r7, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r3, 0x40505331, &(0x7f0000000100)={{}, {0xe}, 0xbf00, 0xbf}) syz_io_uring_submit(0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080), 0x0) socket$nl_route(0x10, 0x3, 0x0) 6m1.198685243s ago: executing program 2 (id=50): pipe2$9p(&(0x7f0000001900), 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x4, 0x400, 0x0, 0x32}, 0x9c) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) semget$private(0x0, 0x6, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x41) openat$kvm(0xffffffffffffff9c, 0x0, 0x80, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x351}, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi0\x00', 0x8080, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000080)={'rti802\x00', [0xee, 0x80008000, 0x9, 0xa, 0x0, 0x0, 0x4, 0xf, 0x1000, 0xffffffff, 0x8, 0x5, 0x6, 0x4, 0xffff, 0xc, 0xffffffa7, 0x9, 0xfffffffc, 0x65c, 0x7fffffff, 0x10000, 0x800, 0xe2df, 0x9, 0x1, 0x3, 0x3, 0x3, 0x400005, 0x5]}) r3 = socket(0xb, 0x3, 0x0) sendto$inet6(r3, &(0x7f0000000000)="7800000018002507b9409b14ffff00000204be04020506050e0204094300080004000000040011000d0068d0bf46d32345653600648d0a0012000200000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f25232500000", 0x78, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) shutdown(0xffffffffffffffff, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00', 0x0}) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000000)=0xf3e, 0x4) sendto$packet(r4, &(0x7f0000000240)='V', 0x1, 0x0, &(0x7f0000000080)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @dev}, 0x14) 6m0.423733234s ago: executing program 32 (id=50): pipe2$9p(&(0x7f0000001900), 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x4, 0x400, 0x0, 0x32}, 0x9c) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) semget$private(0x0, 0x6, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x41) openat$kvm(0xffffffffffffff9c, 0x0, 0x80, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x351}, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi0\x00', 0x8080, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000080)={'rti802\x00', [0xee, 0x80008000, 0x9, 0xa, 0x0, 0x0, 0x4, 0xf, 0x1000, 0xffffffff, 0x8, 0x5, 0x6, 0x4, 0xffff, 0xc, 0xffffffa7, 0x9, 0xfffffffc, 0x65c, 0x7fffffff, 0x10000, 0x800, 0xe2df, 0x9, 0x1, 0x3, 0x3, 0x3, 0x400005, 0x5]}) r3 = socket(0xb, 0x3, 0x0) sendto$inet6(r3, &(0x7f0000000000)="7800000018002507b9409b14ffff00000204be04020506050e0204094300080004000000040011000d0068d0bf46d32345653600648d0a0012000200000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f25232500000", 0x78, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) shutdown(0xffffffffffffffff, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00', 0x0}) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000000)=0xf3e, 0x4) sendto$packet(r4, &(0x7f0000000240)='V', 0x1, 0x0, &(0x7f0000000080)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @dev}, 0x14) 3m26.104431999s ago: executing program 0 (id=346): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000000)=0x7) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000200000095"], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r2}, 0x10) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$KVM_GET_NESTED_STATE(0xffffffffffffffff, 0xc080aebe, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(0xffffffffffffffff, 0x90004) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) 3m23.843832723s ago: executing program 0 (id=353): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000006c0)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x45, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000200)={0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0)=@abs, 0x6e, &(0x7f0000000040)=[{0x0}], 0x1, &(0x7f0000000380)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}, 0x40) rmdir(&(0x7f00000001c0)='./cgroup/../file0\x00') getsockopt(0xffffffffffffffff, 0x200000000114, 0x271c, 0x0, &(0x7f0000000040)) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$packet(r0, &(0x7f0000000040)={0x10, 0x6}, 0x14) r4 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty, 0xc7ec}, 0x1c) 3m22.68437396s ago: executing program 0 (id=354): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) r2 = syz_open_dev$dri(0x0, 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f0000000040)={0x0}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x4c, &(0x7f0000000680)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r6, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000340)={r7, 0x0, 0x0, 0x0, 0x1, [0x0], [0x0, 0x7], [0x0, 0x80000002, 0x2], [0x0, 0x0, 0x1, 0x1]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0x806}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000080)={r8, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r9}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newlink={0x34, 0x10, 0x401, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x103, 0x28820}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x44801}, 0x48000) 3m22.510969053s ago: executing program 0 (id=357): syz_open_dev$video(&(0x7f0000000040), 0x9, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001b00)=""/102392, 0x18ff8) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/stat\x00', 0x0, 0x0) pread64(r2, &(0x7f0000002780)=""/59, 0x3b, 0xf27b) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000080)={0xf0f041}) 3m20.946245376s ago: executing program 0 (id=359): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sysvipc/shm\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f00000019c0)={0x2020}, 0x2020) 3m13.866069754s ago: executing program 0 (id=375): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x400, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x10) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100)="89e7ee2c78dad9b4b473fec988cafbe863cac50580", 0x15}], 0x1) 2m58.482566486s ago: executing program 33 (id=375): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x400, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x10) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100)="89e7ee2c78dad9b4b473fec988cafbe863cac50580", 0x15}], 0x1) 13.518680331s ago: executing program 4 (id=691): recvmmsg(0xffffffffffffffff, &(0x7f0000006e40), 0x0, 0x2, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$FIOCLEX(r1, 0x5451) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, 0x0) unshare(0x22020600) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(0xffffffffffffffff, 0x0, 0x4) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={0xffffffffffffffff, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) socket$kcm(0x10, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x105042, 0x189) r3 = socket(0x1, 0x803, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x1c, 0x15, 0x301, 0x0, 0x0, {0xc}, [@typed={0x8, 0x1, 0x0, 0x0, @fd=r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) r5 = openat$cgroup_ro(r2, &(0x7f00000000c0)='cgroup.controllers\x00', 0x5000000, 0x0) readv(r5, &(0x7f00000012c0)=[{&(0x7f0000000100)=""/4096, 0x1000}], 0x1) r6 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000001440), 0x0, 0x0) ioctl$IMDELTIMER(r6, 0x80044941, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x40, @empty}}, 0xfffffffd, 0x0, 0x3f4, 0xfffffffe, 0x0, 0x0, 0x40}, 0x9c) 13.505851522s ago: executing program 3 (id=692): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000000)=0x7) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000200000095"], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r2, 0x90004) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) 12.298851687s ago: executing program 4 (id=694): openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149e82, 0x244) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, 0x0, &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r1}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fcntl$notify(0xffffffffffffffff, 0x402, 0x6) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) sendmsg$NFT_BATCH(r0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) 11.387691944s ago: executing program 3 (id=696): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x48000) 10.670310335s ago: executing program 4 (id=698): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x8000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147c40, 0x0) keyctl$clear(0x5, 0xffffffffffffffff) r1 = getpid() syz_pidfd_open(r1, 0x0) syz_usb_connect(0x6, 0x75, &(0x7f0000000780)=ANY=[@ANYBLOB="1201010240d85bc7b1131100345c010203010902630002040800070904880400c192fa280724060000d2cf0524001c620d240f0100000000020005f29011cc03080353ee97050a2401f90a00020102092403060703020208"], &(0x7f0000000280)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x9, 0x2, 0xf4, 0x20, 0x93}, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) prlimit64(r2, 0x7, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff000060005400000000008000640"], 0x6c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="28000000030601020000000200fdffffffffff0205000100070000000900020073797a32"], 0x28}, 0x1, 0x0, 0x0, 0x4c814}, 0x40814) sched_setaffinity(0x0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x1f) ioctl$KDFONTOP_SET_DEF(r0, 0x4b72, &(0x7f0000000040)={0x2, 0x1, 0x18, 0x7, 0x73, 0x0}) 10.618681547s ago: executing program 3 (id=699): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000), 0x14) syz_emit_ethernet(0x11dc0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x17) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4008804) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r2 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r2, 0x800442d3, &(0x7f0000000080)={0x1, 0x401, 0x8, @link_local, 'team_slave_1\x00'}) mount(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000140)='f2fs\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) socket$can_raw(0x1d, 0x3, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x30, 0x1, 0x1, 0x201, 0x0, 0x0, {0xa}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0xb38}]}, @CTA_TUPLE_ORIG={0x10, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000850}, 0x0) 8.937032706s ago: executing program 3 (id=702): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x2c, r3, 0x1, 0x80, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x87}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 8.096312251s ago: executing program 1 (id=703): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f000000a6c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f000000a800)={0x0, 0x0, &(0x7f000000a7c0)={&(0x7f000000a700)={0x2c, r1, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) 7.964921435s ago: executing program 1 (id=705): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_dev$dri(0x0, 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f0000000040)={0x0}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f4080000", 0x45}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r6, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000340)={r7, 0x0, 0x0, 0x0, 0x1, [0x0], [0x0, 0x7], [0x0, 0x80000002, 0x2], [0x0, 0x0, 0x1, 0x1]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0x806}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000080)={r8, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r9}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newlink={0x34, 0x10, 0x401, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x103, 0x28820}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x44801}, 0x48000) 7.381805302s ago: executing program 4 (id=706): mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) socket$nl_generic(0x10, 0x3, 0x10) r1 = getpid() r2 = io_uring_setup(0x30a7, &(0x7f0000000000)={0x0, 0x9dd9, 0x2000, 0x2, 0x373}) io_uring_register$IORING_REGISTER_MEM_REGION(r2, 0x22, &(0x7f0000000280)={&(0x7f0000000240)={&(0x7f0000000080)="8d981ea1d21e9c323ca7d532cdec0937b316013f0f25553ba24b280ed978b136d7c5e1f61ecbc67ba0bbd43817d8692de4a30854a3bbdd34b11ba9ec35055e155a51332b733d192394554b300de4e21ab2e3c465ae38eef4271e4da11ac5f0d3f9", 0x61, 0x1, 0xe28, 0xfffffffffffffff2}}, 0x1) r3 = syz_pidfd_open(r1, 0x0) open_by_handle_at(r3, &(0x7f0000000180)=ANY=[@ANYBLOB="15000000fe00000005"], 0x1) 7.380686632s ago: executing program 3 (id=707): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000000)=0x7) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000200000095"], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r2, 0x90004) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) 6.296562504s ago: executing program 5 (id=708): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x48000) 6.136854059s ago: executing program 1 (id=709): pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$MSR(&(0x7f0000000040), 0x2dceb79d, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r4, @ANYBLOB="010028057000fcdbdf", @ANYRES32=r6, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 5.994905513s ago: executing program 5 (id=710): socket$alg(0x26, 0x5, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000300)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @remote}, 0x14) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') socket$packet(0x11, 0x3, 0x300) preadv(r2, &(0x7f00000002c0)=[{&(0x7f0000000340)=""/4096, 0x1000}], 0x1, 0x35, 0x88) 5.847914367s ago: executing program 5 (id=711): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$dir(0xffffffffffffff9c, &(0x7f0000002a00)='./file0\x00', 0x40, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) r2 = syz_io_uring_setup(0x660b, &(0x7f0000000280)={0x0, 0x4ccb, 0x2, 0x88003, 0x191}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) io_uring_enter(r2, 0x6e2, 0x600, 0x1, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) read$FUSE(r1, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x0, 0x80d804}}, 0x50) syz_fuse_handle_req(r1, &(0x7f00000083c0)="125353421ae911490a535387bf81807a9b59c5726009a7c20cf92d7626acb5e810ee928f04b94f79e402462cdd88475d82b9b361c61f8ffb870101d5f5e74c93e6cc4df2ce3647aa3e23c0085c0c1f9a5a33d10407d3f907867ba9ffd89711a50a39045d42ba58631a2e31fd138a4609b8b060adaf480c395aae518ec0812b49def6f9bd14d97a95e841085c4b7608062d8df8a8e4aa4eab705512c6ddb9d1c6231986ed6773ab652ad9f18eecf01d6f853d2beaee3416bb07de92f6ffd1169eaaea82294095cffa42a308ee44e7d0a10d0397985f171dcf2ff79313d241c1b8343615f5dd3c9ebf2c5952fdfb965760f0109dd4716adc7325353c0a62520657bba5af69d59edc0339ab4529ef4fb924e42c1569049c2246a454e2aece2303d5e9c9a7262da4bc19cb6cee4692c0a34c7260df1d392ba689fde453d412a94f7d96c5ad5c9f17bd919c84e187cf965fd0b020374fbbcf3192c8ad8a892a4ed8c1663f4274dea918b1d66ac4706f8194eda40236966c6736ecb5359660eeb6ccf1ab2310b59ac1801d77cc07e3e7c073ba558ca807c4c5e2000e42282a825193e351d875923a359087d61fc61b146e362ceb5232d9fd846e75c71724cf500a4cbbb042b00636388e0a15c766e144b7a1345757b8c8ff31d55419af0719936386db53c6381b3bd28af103c08bd77985d902979e2f0527b5739068fd35d6d3abde4ee070fdee6a97788e6b2734c92a53025218efcdf3087825fe552f954b13a19e8c363b669cd34688b26ad44e26952f025b90946b4bbc56b02c7203cc518d9877265b1d9259ee9ae9f9763517890aaca2099d88a888c1133927a416a8f432c825722304625239cd193be61b354a0baac9731a2bb2a27e866c24aa03e1eb1d256aa4dc37923b4fbbe11beefc6274e835144faa5f85d7d42abc071f79a1fccb34535986a27f773d0c702123ce4a8537a2ebee1722dc7d65333d17027f1e9eb225134065f0b0759356e888a4f815385a9714046b10f0604f4372e9b86656276270017f2a5014cca179c7bd95210b538f9c69b3694b6e1dc68a7efb47168668904b4bfc1c1e8c9779d31a9e6a5a8b21c7f01b638b0c5bec2381527f6dfe1d349a40f1ac3c9b180e88d77268a25d1ed933e443ab90ced4c6b4f116b7a9fee7216756e83691a58a49875b15dd85c501c8e7e4f86836f8f204c4ca0e0e2eb3407adc10035eaf4cf27d279e1673d3ea409844eced099e396e67ee5c13bd8fc8ca046d0e80b23dc152df473b9f3891994a73abc072dd05bb55cb67f544deff42d1741e37b3ab1458bc24ee92bb598c000171922b05047abef23a466e9f38ceae5874d41063522d5997bb267ee41381c7f08e204713b8439c861cddca429dbe3b5803ee2788bf287cc68a21d060eab5bf4a3ee7d52a560cd357d9928479d500be4c8ea52380bb8bdedea9525611551b0d329bd6c677374f4ff78a1ce749e2b68f29dc2b14abcba53b139225b18b6747d3df61ec3b754903f563183f5d2b8b17a976b23db9c09672c8e90f993ee31a7734d561a641597fd5c1abb1fffbeb7ddabb9cd474c532d9d834e65c9b3c597a35637c6acdde621c4d7d3ffaf64c9c6ba36836533ae278234505d542ae760e7e92deee5f336f6a1047a90d0e35f767113c5eead70c22e7cdfa9815446650efbb1417cbdb20c1415033bce17d3727ba607035f43439b89d2809dc102b0760a9855404f8631e9d837e7ddffc164193a28f1762b20db38aebeff0d5d7d6d7bee5319a20af40380276321fad539bb4ded87f6356bb15723a2fb1f98b4b95e602a59da44a438430911197de685b44dc906d14d539abe5c1ea06dc28ffc48ae00470eddacbc78473401917dc969b62d5979b43ce9dfa41d2edbb9f9918c20591071bc1ad23fd064ea76d29e2e1e5b099173a2a30fe9d65acf23d759e625824841a9955d766dc63c49028bee6342009deeebbc678529817abbe8a9fb8668bc7d168b53ec9c14269387d8e08f11acc8933c42eb87d7aff56b61ca6fbb6d1f294694bd5edd73d27d1bb048b1ec6ed9cd90f745e1d6e5491a7ec241ff09d253a081b4e9b8d4ab0cd392027c13c627744ff881b1d394e1f0866729e4fc13fd0bf4351e0cb342861d55ece2567f0ab45a13fcc1c9de5746b95cd78ecad8b8bdbd2412d7037647f65c74e40773fa96febc69203853b744cfcbf189494e33ff1762382c2c1a3eedbc5c8cb2cd4a34978af1ba15423a22e2933ceb6abfbff4194a221bc323581500319dce117fc44c873f1f1558a0bdc1b7ffab1a229ce62f907c18a3806ab6d55376399742b232a8cc495ec740ccdfc50e501420877705bcef9fac646bb6956029957b4855320078d951b7ecb25fdf4cde840737f22f81400d1db2965c816dfa6ec52dba597109c7cbd6283f29055c9afa874119b97eede6452ad4a371568ef9381ebbf5e854f406c6ddd203055b8b93ef68104071b994a074238b9f376979ab0183d7f3cd6dcaf976a4ddef43bb9f207921238e181b5f36289c08a088fbbd8b1fc4047b68fb93de1486c580a69e7d0a89a74990106dea048868017cdf2ad0b8f784560ddb51812611fee8d64166550bb518ed37c5618c4931f5085f3603a553c4fd87407b9212e1feee73ed69a0bb5e5a7bf2e4e1c47ad3d53be86d8572fa98165c37ee2333b664161630567c874c0428fe3485a5e32ff528c8820cd797cbbd71bac85b64891883765955d9bdd56ad24a0949986730ec0a1a558210fd241bea2f0e546c2268f22f6e1b68bc37d03410fa48ab88798d5853ade1586080c2aaba01684d8d52bc0acc59873b72826d12e67e61a026b1d0feef8d3f8a5f1990af782ff38ea3c85a9a13c210ec2edb8a44f172a179436597dd766695de2484010a6ca45b9e4f4e60cd3ba50259a997deed946068ee833dbaea9da078275745804751b5867adba28c81a03c0cb7f9fe910e75aae81acd27c05d95231de31de45e299791d27eca1a1bd096fd9c08f5210fd1fcaa7e4a6ecf367adb9fac0286b46d26f344b6e0d6fc65cf01d281950895e92a4f57d24db1277167a57b885e6c8286c639c0757af742f027b7801a72a75f01baae40aea6231b148d21cda86528fd15fa7b03d7c75b083b7d6349297adab1baf5c3e9ca2886f9089882ab86bef926fea5879723efee3aac26249cfca8a93d6087a90a2598d5046878fa6bf5eb973927cd4c8bf9b9f558c249d841451c4cbef8dd7dfc273b80c3599aa72174b748b04974a3c6906bd2c46f5f995c8ec50729e09c04e3e56557be2c57026679a5db0016c825a32c6ec6d821b1b17b827b3ca2c12436c9d5d6fc95373cf5d3b79bef53683c0ff972dbe82ae2c9c44a010d36d9837e92b8c56086e57951f923063c81f0de8af1c0aef9b35a63048f52653cb9253177b09a9e570144e66a4779d40e7433769221d3bdd02912a8a77994545eafc2d7928b42adad4058cf4959ac9879b8baf4657fabd7ff11b53df67c103185cec9b86454e706ccb91f730f42af3197004dbc430c2021a85bbabf6caea8dbdd3b8062f2ce85cbb995d16aa15eed2f097030f92df963c280fd5e1cebff43b1cfa97c93fa1755c582212644cc643dc3661960cae2fc8c50935de9c57908b29a30ff28e45a7efc6228d5501cb2fd7aa4ff55c9d49aad6d3162c813b8e8a08991fc383812fd368743431097d7114ee105d194cd4239442a58799f573f5b0f16cfe677699869beb162c641700869205a28259137e3e012fe5704aef7a2b4f70b7cbfc450de62fb6aaf22276e4500b50789bc72397c933d371579f99dc696964421cdfd0531ec4d09ee7b07f9604dda97777242fdec6f345db177c75c395636e5b59d9ab88cf10ffde646be582009962822c84a3bf0abb90bd7edc91ede84d1d4444a3ce977fb9ade7de2dfcd2254e83707386fc246acc34400b2fc85f92221796fc65881eba76ea809f59c01db3ea9a7a8eacccf670efdff2d108a6c93b8159da89e17c4568eccb6a4d79c667258148f719367fdde7be1a2dc50538186415ffa235e2cb6418da4c3060667208ca354a67539255ff56f89204148abd2e1bf5283fd42808d9ac0357b65d94cf8e1d68c83de1896b0de4c205f1d458aa0df91b5af1f2f4f71c3f8d3f853aeb2cb5eb51b70a147bfdb28f41617c9760a592ff67c3772c65f335da35d030e121f30dacc6a5de00111654141e5cfe5d6a5eab32487db94ae5bc67c8f27f9be485d40be32794d12478e69338eb1bee7a991116cbf6c0b64dbfd7ba3a1464752d922af8925feb5d2b87da38b99cf48be96f58864abe94c95a70b3764c1ef60f1411bcbcf52dec9e318715cf76b4346972bbaca08574eeb3d67b47523cbf604cbd6300d7be6574724b8ebd40762aefe6ef0924bd320f0f06cbd13daf0acf1bd5c6221ce22e53e7ef3a38f25d44ae17743f354740c8be706662ea5c94a1cb54eb2726ef0af55ed15fa16a35b60974c861eb3c30261fa9926b4cd317b1b4d488277f295a763cd1c6a9e74f9241c6166056b1bc27bb3ff4ebd7ce98fc2d85f8b596aea0de16a6ed782191783a17ca1cda57cad694e8bd9d33a34577ab9cefff348863746ae53d38ebff125e64fb68f7d8efe5d400ff5b53df5fcd6a85cdc3ef950d11f17d62221b6e5c7d7056a0ee0e86bc15c76e9361f7a1073dfcdbf9fc8a3bdc3b69065c63f3360ced8a4f7a6992fa0e8c8ad4522063884578dc10e4e0759398d5583dac3ae8f61b37793a520dcc7cde284f51e924dbaab81519253dfa2312ce14ecdc490bb680838dc7f6a77b3e0f26058f82ae0445e9e455c257acd42e2fb6ceff53fb2b6239fe132ee1cd8480be25f4cdf02a8b4e395a411db09da3d5df16dab2a356a868a0aba2cbb1fe70cf014d2db742be8b3c74fb8cb2b3aa1b1346c0bc24c5f1f08a5b3e6a2498532518fdca216bcff90bcf2d4c4a9a52e71a22d338ec9965b25185da142cb185905ef5f108e00d816301982adef40a7aa388a87d12db1289ec51135ef4dbcb1c140e256b2d6eb6837dc9e6939ac271a530d6be3f67dd08d41a5a06d5a2195351ef17588999469a1439a5e1ac81f1a9f1176de92ddf946095b77ab534acbd5f7049cffb640e32e76f09a2fa9e43da0f3475677242aa705347e4480f39d640f051dfd9efaffc3d6c732608a07fdaf3413d43c6714e2438c14c77dbf1e41b6c6a92ce600898a1727aa0d96f1a15107a5b801d8ce5cc7b89f4a4ae9000c084e9fe5e26c893bbcf20fe6fd665b76f6c7ddf7abbce8ba4c87049997012732cae347e10f859338785f604658db061f1be29c6b9391e790424f01076c458dc2eceb77f515b5be383be741cc0845be3f027e843623a64e71c70323b83be35c742112d864b41b9e8fe2fcf02cec9e03dea2c8dd8f8a20dc4bb1acd4dcc2a6a41072513fc89704db116093d71f191b88da91b19c4ef41ef4ce0ec0db080517191e0bfdf55a4590f45d813b39560f10a59150216422c3338650975ffb049912511561cb430b02283ed2f5772dfe7a9dbea1776d21be94e6915cbeb6544c8d6193fac6c6443bca7d5c180daae0c136dda63365cf77d4f7243f4a16dfab027dac166354d8ab4ad8eea09c3f4cbdbddc98a3ab9d69e0e3b584ada61cfbbfc487b8ce53bfc337487f6fadeb2a958f2f79eb5fb5781718c2ae42788ea56854aff90f0ea6004ec0b943db9dc9ff8f2e03a021291376fec671df5303bfa5e70187268edfc8f93f39942d2096534492875fa0efba9c3cec4e1306754ffa9bb5394f4bf533c7c5551252b1eba0a8edc869d46d7f9988e51bf65e3a39220e902a3a324421693a1d6cc9f554e36e155c1f98f1381e99b6fd4c95af92d028c58b4263c81b204694ef0ce32573b59a492772c832d1277b8ac188e5a6186e1c3550c5f46fa41b0b18d30c9240b00a6f3ae1185797d6eb8c6c19e16555a299003a0143b44c48e230f10f3bb68c71f6da802d35469b9cad460aa105cbe2a15012db3344813bf26d9c310f9c6efed1548f9d79f3b2e22511b0cc02f3e71b74d674902ea6ba569d28f9917c4ec035a8bedbf2a5cd125236faa05fada606d292023865829ed978fcb02d316206e4b8ee588ec0b1a5ce0eed8205d680c726e55115dad2ea592c1e50c812758f84cd4d9899adb849fbfb821a52144faa51b0a5f4998bf2f7eecfc629fb4286745d111c13f8616df5d1f64287f2507bb8a1a2ed9b935535287fc7d4e49492bad9c5a149bb21500bc27b7f50662efef95dbc8c7d564ff14be60c4f8ad98547edebf1517caae37f8cd937e50d8b2ce5acca7f5b965fb4c87dfbcc105cbefff9885a0f4bbaf6a6f691754a99c35cfe739122736e89cff85761e01839dfadedc2b7c5e410ce1ad02308425142fbd9b10f13ae315af3e572b13e53ce304053c91c8792572fa198d0ee823b0f77f134436c5f60e413b759e7f8e2c240cf800e5d5e052848f0efb1329e67a2404cb611906bba9b42fa9a4d8c0e9bcc617a55b7bbe5c5a9c81f96450ef105787978a609b08d9a9c98577b9001285320aeabf49118f8249e6b0af48192637b7215f27fe7531ec9854adee06f27a80744f7592cc157cb59aae245d01e21f6a9c7afcf78c49f20cfa717d8b7cefb1bebc10bbabb4599f6b44e700f3e5906e8ef144fe0bd0a730e2d09d25f8ba5dce21fb7036a293ef46703098464a089cdda149d94cd587b58b6e6d4efbede8b1f6c71e3d912b4e3a383529e05a8d23f5a418ee4a84b0b0719788430ab8a292c371583de46c0e706e4c9e21040721afe54bd9256ab56173bd0252678f7acd23aa91affc5ff4bb0d365446b9b277085ae3478161808dc6c3d44580f0af43b923fd40dd1bc338c4f13bdd16b56fa41dbfecd29788f8f53af777877f8b980d3847cc99f1fac22c015cef351f9d95cddf02a6bf3ce1032f0d2ff4178a5caa53d9d06b9f7f61a4b9eff30148470d079f3bd48ede859bd130646aed72e5c20d1d796e5e8f4d0f2f3be2030e714b054645561517cb365e7cc8dd51d59e991160f15f3d7d4f9d0dde4161aa85d09828a2afe6384173ad7e1ad45e22b9f701fa4bc71f033def2f2946579b1fd0e1380ac76396a0feb2b3efd532978e3e29ce10f2a82ff2230a6278b343314904f0754758218350cabc3eebbb3544c13fc8194516bd6d1dfc6c2a96e7708150725688f35c4b29379314a803a6fb298bf56f676eef9a1308e05a6583e51d88a49f00c1de31bb2567262dc5032ff2f55f022c17faca1fe275ea00b7d36cfcfb76894000a4fe9227c656b4bda1f2413f4692b52b2edfd1437e8235ec60eefc2ff304d46a0fecb84fedfa521aa3666f1a09f9bcf2fb3cb0441495789a4cb2778bdf294acc81430781ca5d6fe7d5a7b99c7d0ce71a148abdfe57279cfd40483b12efe158e880c20f397964b506bf6c063fd6db7168ecd590b5d8b3c1e8fdf3aca1739f6e92af1ea8c80122a88ca9263de3e412dddba98753e08652bd6ec3ab81e7f12daa6eb511e58dbf60b1fba777bf13d979e7c1136c51dce11febb7ae215ec83307aff9b28b60c509fa9eb604e2bdf736dbe0c3d6ee4a34db2e5a32e594d24a64c32a9947c87cbe08acf848af0796cdfa3c2843cc97d34ee9d87e6ba96f3e6263aca04d1c02eccfc7c0c3262289cd6fb979dba7901ecbb6d15705b11c96ad4f769bd96edda5e82c26c503966ceeb4bf043885c41952a6db4c2ed76ddddb2a6155e61071629f597030e72c019242ec6f0367a8d5658f7c4e4e634e69a901a9168bb22b85b0e26ac0a517637e0070566a06066bb592d49ce0a418e317ab785bf9411f237e6f8c116544b7395db92e58178fe684309fcd9816279170b8bbe50841f1565de222efde69f751881bea8c88d2bd8fc7bccea671230b0efebed9e8d86a99a9111063c253891d54cd6ad2837f81812a09aa4479aa6403f829c7fc5c7edcc71713eb8b3a85ea328de14a07182b60888d923b8bf0f86fe2120f71fcf339dfd2ebb16f9cee1b2419a5166927deb4ffa12cc5e564d96f09cb34eb5a0d930a1ee21001ce04db480249e500085718c03944e602485d78b8f00c812a877c8a76595f04fa64f6d5780d017af3da9dcfd1896382fe0a3c8182ce5a319f006e8f3e63f843684cd3f7b642a40221f05beb41f0a940de59648125e842da03c46cfda0496fdb717aa14a2489daf632877d1a9365f2fd121fbb20d025fabd51850f30b93741d9b30673a64f6274967845607581854dd970726cdfed3690944fc964269e78b31578487edee0ea87c115be2bdf28af460a11fee5f4782b3ddf3dcb5e7e24f320efbdb9c9ed42ab87ac84d3ed3a3f63eea4f3bd73df1b0b3ceffba4f588ff1c8d33fb474d717db7d0930eb7e8bb061359baacc5dceecafc44045dc58b85a7e80751267770c59f780469eaef3dcb8b41f9c2d3d8bd4e102330a417e59d296224fc6e7f4a10da37c19d04c9da8f125870958748c7fcca2361e67fe69d4adb32343603d01a0c2950498f1e57c28a3bfff8dcd3ebf96b9fad889aaab33d86093ab78b83afbcff4cae4cad467170b220bca482f59f8acd472671b8b1640f63a77be94b026f74bf1591010d27bee4c8fc9fbd9fe9af1896eff59dc6c30022470a8c0d38795e2054d6a0934df4125039ba90a57e1fca0b1d1abe84026bd8c03787d869ce6989818af65abce3763cf6f9b696b4daa5205c8662036a3df86440b9f67b30b94c8715ac5148125cc50be5307e5bbdac55efcaeebe9589c6ce52e8a0c1259fbc6bca10882f78e851116f2f480b07291311fc6bf11a29a3702d31e74bbba752590dae5f12423942b112ee1ffec98aebb28eaa0b3a094919d4ad75c6cdc9f22a5b47f7e4b517ee3c07fde90d7cffdbd461fbe934f47b331c7d7a786555955ae108dda2efd5b4a1f66d9ab30b5547427e9e8dcb0c35b83dbacdd8cdedfa297a1ca97c59965f455527ecab8c01df3431df6b4a0cacf641e4eb32ac272c74075f98000836830f4d329a9fe7b35c0d88fa364e16d2c3a27abfe26d51b87e4dd9040080ef9a6b5641a4987b35f256dbcaeccb67e18845a25a1c547a35fc4c27b3eed78d8eac9303d5c57801b53ec4b63b7cc80929bef3f59a88d8a6ab8e6f0bcff60fd2259d6ea8cea91c4bdb8d7dc7c9706caace69b005005bb5c88eddcdae6dff2819d0cac55833c6b14ff5011f218b1e96f74ccb213e2d4d7631acb7e4a8fee6171eaed6f77cb7c119ade2645e81d4dc4be5080cd3d28014334164c2759223e7e226877359fa94f437866869b630e0d653a4dcb5603ee5d8d29b85805034b86b3fed1ed8dce76c79dbbf97b35c00529a0fa3f143556083a73ba7d249d7dc116967e33b6519d5468a730a8a6eb26873ff3b6beb01a222bdd5cd4453253a65484086b9fdd3d21050c66c29dfc16b9f0a7e86f5207a67b37cb35c4adf4455fe56b438cdd755475b335b297b3819c448c7708dc13da64383f9728b3b01d885ce4248b441684a13ca952dd5ccb9fbc82a9c75752f9c30ba886652ab88249cc404a0323fd5344ff4a65fbd3f2b0485d6834521d9ce392d50275c9e03a9b335ba159cbcd7e37f6177738640aa3c3c92e86303bb936d0e78c4b5124187e8ffca041fa77498b7af1994034b686645b1940b80994dfaf322f2647424376564b84fb571d8333061523bc7a2772789e589a47e19bea31dce972912e530864e88345d8025f27df6569ad6f96d4fc0ae3891dfc5d6b8e5ca63cc705a95086308ed83f0c347c25408180edbd656c3b44367f75e7b81a8c6df14850a088a4d0a9345f6cdbb941a2627034eb6daad08a49f08d7e1238a2f361f82da834b893f1f8ed6a3658ecca85f7195f8c0b690b6931273ee5de50ec97996cb142bec8d89789b26853849a12e9df565c90886fc2dffcee07b7a778ef06b9a205e7af24ec3b437742751ad8a711caf677acc3026ecd49fb9e778ecf59265c601a1735612fb5fe756caac9eb759138db80a7c20925e2f8c63757c92cd90131f6620601e955f0030f5227e42787fc266cbbee74a983bd5875a66d771418f6f2b7c2d7379f5f0ee59359c6e4c7d00d6c2cba48fa6caa64a3330ed92df55013e62fe636ea97982820213fb0672e9be9b0b51d7266aee893fe971573920a41e16f8e4cd6e19bc2f964fc8e8489333ede8b4fdec61f1740429c92bf853cd0e2e29ca1947a4165e54444b7251afbe35f397195be8f4599213b329194555ce01cbe3cb5d979be2736583d8659929c32d4e4f32949ee63b3c53f6a17ae8f0d75320b59215e030bc03af8a4aae25d178ce4328397176a6d526aaed2f708eec9a74faffdeec0ebd502998780fa0916c472f3e47a72e4bb43deb3fd12ba05292d63a2ccf422ae9c40587e50ab7b0ff39803300d0e953b614077e529e2b357bf901879a59909ff80f0fa7373f7e3a9020ed0dfd6752aadda5e700369a2a96c884d150389344d1446944b80b2e3332fbf2b286c99af51218f872f4e1e8c7b3a706860c36b88e2e443c9b8e26efa4a1c00daaf8d74e784a1f951191e3b87bd96c676252d70ab64c26fe4722fa52b1fe887979c08b248065ef4011651f037ddd521685761abefbe5cc428962f51ca0ac09089d9155d3fcd9386ef2a628a8ebcfc414ab6cf42d63b89fa6718947e73c9848a384f17947b9e1ccbbdec5a74e92218f495ba80462ab13f4c22f144539c3d2d61cb842d46c95d7adc44e06bdabecfefe777b10a8d512bc5a3742c764dbf8b1d89b3405d722350b3370c03387b3eb322b76c8719f9bf047cea863ca3289125386288373a44ac10a6b2835fc7bd6f966b37c167f73c369f41d34b7e25f1df1f542663c2b63c64c4e4e65fca3e79891a8ae8dc0439ae8001672378dd1f412dde932ea7f06ce9c844d158ed4d664ad490a79314e3a6802cba5be998b017f3dee1747b9e4622999d65bdbcdc8ed6c2e839e9167ce7bfeee23e3d398ba93e8211678e3c4004311260fd20b363113a1df8ef8e529adbba84eb7ca48522a213c7771d31857489854a92b4f19901b75b2101234ec15b2b31b43600086e3193209f3c1e4d04d7e4f3f1dbe93074e5443c76f520928a41d84269fc92c728f38b38995118527c2a5ca60db69b1a3967495be0556e0a1b0ee54ba6a38153cef7370bdd1611103a4450b99d80c67eda3cf0eb862faa040219d7d728337cfc8bb52ce758b778ad3faab55c61bf1b4a85b1ff7b48abe438819a169fba5f1351353ede1ae9f4991e22fc1c013833cb62b79b5df6f204758e233711a605e3b7c5c25360c15e2e8da2b663f4ba2baada84aa599c29ca9d3b69c19091df66d6b1ac52085d31c9f607e9144ee9815f3003cdb468d9c7cafd5be7f6ad136fca054540ea6c5570246814f069022840a2099d7605ae30ed9b751de3b7aaa1fa30bf5514e61b316c7640f9aad65d63dd89ca850419749383586d013fb56c3990d3a028ad691b04a5f681b5b11c53673572379029a6435615c7465d59ad32f9af7c3930958141fbb7dfa9d9e8426a2689c744b04d01ab51abe4ff3f15a5f4c496e44eb01291cb814477c35d0bdf86471ea075ae49416c210", 0x2000, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup(r0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0xa, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = syz_io_uring_setup(0x10b, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x3, 0x800}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000000)=@IORING_OP_SYMLINKAT={0x26, 0x14, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000400)='./file0/file0\x00'}) io_uring_enter(r6, 0x7277, 0x0, 0x0, 0x0, 0x0) 5.384149761s ago: executing program 3 (id=712): syz_open_dev$video(&(0x7f0000000040), 0x9, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001b00)=""/102392, 0x18ff8) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x74, 0x2, 0x6, 0x101, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0x2}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x60}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x10}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x70}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x4000) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000080)={0xf0f041}) 4.584815474s ago: executing program 1 (id=713): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000), 0x14) syz_emit_ethernet(0x11dc0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x17) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4008804) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r2 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r2, 0x800442d3, &(0x7f0000000080)={0x1, 0x401, 0x8, @link_local, 'team_slave_1\x00'}) mount(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000140)='f2fs\x00', 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) ptrace$setopts(0x4200, r4, 0x8, 0x1) socket$can_raw(0x1d, 0x3, 0x1) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x30, 0x1, 0x1, 0x201, 0x0, 0x0, {0xa}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0xb38}]}, @CTA_TUPLE_ORIG={0x10, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000850}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a3000000000a0000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021640011800a0001006c696d6974000000540002800c00024000000000000000030c000140000000000000010108000440000000010c000240000000000000000508000540000000000c00"], 0x120}}, 0x0) 4.478150557s ago: executing program 5 (id=714): connect$rxrpc(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) r3 = dup3(r1, r0, 0x0) recvmmsg(r3, &(0x7f0000008840)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x40000001, 0x0) 3.272929993s ago: executing program 1 (id=715): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x8000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147c40, 0x0) keyctl$clear(0x5, 0xffffffffffffffff) r1 = getpid() syz_pidfd_open(r1, 0x0) syz_usb_connect(0x6, 0x75, &(0x7f0000000780)=ANY=[@ANYBLOB="1201010240d85bc7b1131100345c010203010902630002040800070904880400c192fa280724060000d2cf0524001c620d240f0100000000020005f29011cc03080353ee97050a2401f90a00020102092403060703020208"], &(0x7f0000000280)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x9, 0x2, 0xf4, 0x20, 0x93}, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff000060005400000000008000640"], 0x6c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="28000000030601020000000200fdffffffffff0205000100070000000900020073797a32"], 0x28}, 0x1, 0x0, 0x0, 0x4c814}, 0x40814) sched_setaffinity(0x0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x1f) ioctl$KDFONTOP_SET_DEF(r0, 0x4b72, &(0x7f0000000040)={0x2, 0x1, 0x18, 0x7, 0x73, 0x0}) 2.164084786s ago: executing program 4 (id=716): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x7, 0x8, 0x22}, 0x48) 1.849349055s ago: executing program 5 (id=717): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000000050005000a0000"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)={0x1c, 0x3, 0x6, 0x101, 0x0, 0x0, {0x1}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x8000) 1.038620799s ago: executing program 5 (id=718): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_dev$dri(0x0, 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f0000000040)={0x0}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f4080000", 0x45}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r6, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000340)={r7, 0x0, 0x0, 0x0, 0x1, [0x0], [0x0, 0x7], [0x0, 0x80000002, 0x2], [0x0, 0x0, 0x1, 0x1]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0x806}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000080)={r8, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r9}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newlink={0x34, 0x10, 0x401, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x103, 0x28820}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x44801}, 0x48000) 1.00607008s ago: executing program 4 (id=719): socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet6_sctp(0xa, 0x1, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$kcm(0xa, 0x922000000003, 0x11) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000180)=ANY=[], 0x0}, 0x94) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) lseek(0xffffffffffffffff, 0x1800000, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r4, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r6 = accept(r4, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, 0x0, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)=ANY=[@ANYRES8=r1], 0x6c}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) connect$unix(r6, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r2, 0x40505331, &(0x7f0000000100)={{}, {0xe}, 0xbf00, 0xbf}) syz_io_uring_submit(0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) 0s ago: executing program 1 (id=720): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000000)=0x7) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000200000095"], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r2, 0x90004) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.60' (ED25519) to the list of known hosts. [ 81.403325][ T5774] cgroup: Unknown subsys name 'net' [ 81.545334][ T5774] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.232947][ T5774] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 84.893349][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 84.904252][ T5798] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 84.912013][ T5798] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 84.919927][ T5798] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 84.929166][ T5798] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 84.937666][ T5798] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 84.945100][ T5798] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.002973][ T5801] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.011342][ T5801] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.012996][ T5800] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 85.023252][ T5798] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.029115][ T5797] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 85.033913][ T5798] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 85.042112][ T5797] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 85.048889][ T5798] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.054699][ T5800] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 85.068069][ T5788] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 85.075586][ T5800] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 85.087512][ T5800] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 85.099195][ T5798] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 85.099240][ T5800] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 85.114187][ T5800] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 85.123849][ T5800] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 85.131387][ T5800] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 85.552394][ T5784] chnl_net:caif_netlink_parms(): no params data found [ 85.731863][ T5787] chnl_net:caif_netlink_parms(): no params data found [ 85.767589][ T5783] chnl_net:caif_netlink_parms(): no params data found [ 85.787565][ T5790] chnl_net:caif_netlink_parms(): no params data found [ 85.860709][ T5784] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.868792][ T5784] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.876141][ T5784] bridge_slave_0: entered allmulticast mode [ 85.884133][ T5784] bridge_slave_0: entered promiscuous mode [ 85.931306][ T5784] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.938605][ T5784] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.945760][ T5784] bridge_slave_1: entered allmulticast mode [ 85.953379][ T5784] bridge_slave_1: entered promiscuous mode [ 86.087588][ T5783] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.094786][ T5783] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.102973][ T5783] bridge_slave_0: entered allmulticast mode [ 86.110020][ T5783] bridge_slave_0: entered promiscuous mode [ 86.118431][ T5783] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.125595][ T5783] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.133590][ T5783] bridge_slave_1: entered allmulticast mode [ 86.141157][ T5783] bridge_slave_1: entered promiscuous mode [ 86.150613][ T5784] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.163243][ T5784] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.172652][ T5787] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.180052][ T5787] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.187759][ T5787] bridge_slave_0: entered allmulticast mode [ 86.194860][ T5787] bridge_slave_0: entered promiscuous mode [ 86.256750][ T5787] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.263926][ T5787] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.271476][ T5787] bridge_slave_1: entered allmulticast mode [ 86.278691][ T5787] bridge_slave_1: entered promiscuous mode [ 86.285626][ T5790] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.295990][ T5790] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.303667][ T5790] bridge_slave_0: entered allmulticast mode [ 86.311411][ T5790] bridge_slave_0: entered promiscuous mode [ 86.319433][ T5790] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.326848][ T5790] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.334044][ T5790] bridge_slave_1: entered allmulticast mode [ 86.341642][ T5790] bridge_slave_1: entered promiscuous mode [ 86.352027][ T5783] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.402122][ T5783] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.414721][ T5784] team0: Port device team_slave_0 added [ 86.423609][ T5784] team0: Port device team_slave_1 added [ 86.456087][ T5790] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.497765][ T5787] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.510913][ T5787] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.522694][ T5790] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.610842][ T5783] team0: Port device team_slave_0 added [ 86.620024][ T5783] team0: Port device team_slave_1 added [ 86.639815][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.646999][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.673376][ T5784] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.689543][ T5787] team0: Port device team_slave_0 added [ 86.696278][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.703316][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.729346][ T5784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.770448][ T5787] team0: Port device team_slave_1 added [ 86.812594][ T5790] team0: Port device team_slave_0 added [ 86.819761][ T5783] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.827396][ T5783] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.853535][ T5783] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.879929][ T5787] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.887453][ T5787] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.913598][ T5787] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.927764][ T5790] team0: Port device team_slave_1 added [ 86.934268][ T5783] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.941333][ T5783] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.967360][ T5783] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.997927][ T5787] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.004942][ T5787] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.031077][ T5787] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.067457][ T5795] Bluetooth: hci0: command tx timeout [ 87.095616][ T5784] hsr_slave_0: entered promiscuous mode [ 87.111972][ T5784] hsr_slave_1: entered promiscuous mode [ 87.148120][ T5795] Bluetooth: hci1: command tx timeout [ 87.182807][ T5790] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.189988][ T5790] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.217776][ T5790] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.228596][ T5795] Bluetooth: hci3: command tx timeout [ 87.234274][ T5795] Bluetooth: hci2: command tx timeout [ 87.243040][ T5790] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.250366][ T5790] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.276748][ T5790] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.338508][ T5787] hsr_slave_0: entered promiscuous mode [ 87.345356][ T5787] hsr_slave_1: entered promiscuous mode [ 87.356895][ T5787] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 87.364813][ T5787] Cannot create hsr debugfs directory [ 87.434284][ T5783] hsr_slave_0: entered promiscuous mode [ 87.447414][ T5783] hsr_slave_1: entered promiscuous mode [ 87.453883][ T5783] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 87.461936][ T5783] Cannot create hsr debugfs directory [ 87.643641][ T5790] hsr_slave_0: entered promiscuous mode [ 87.655108][ T5790] hsr_slave_1: entered promiscuous mode [ 87.662290][ T5790] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 87.675064][ T5790] Cannot create hsr debugfs directory [ 88.057107][ T5784] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.072925][ T5784] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.083977][ T5784] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.095966][ T5784] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.181067][ T5787] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.193517][ T5787] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.203992][ T5787] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.220150][ T5787] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.321515][ T5783] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 88.346911][ T5783] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 88.359296][ T5783] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 88.399843][ T5783] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 88.456767][ T5790] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 88.471150][ T5790] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 88.482224][ T5790] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 88.492969][ T5790] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 88.529433][ T5784] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.616208][ T5784] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.630942][ T5787] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.654232][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.661673][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.692358][ T1129] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.699604][ T1129] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.752534][ T5787] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.793347][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.800533][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.842985][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.850217][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.874669][ T5783] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.927310][ T5790] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.972032][ T5783] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.997281][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.004488][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.023115][ T5787] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 89.051902][ T5790] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.071941][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.079196][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.148424][ T5795] Bluetooth: hci0: command tx timeout [ 89.170081][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.177333][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.195895][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.203283][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.237084][ T5795] Bluetooth: hci1: command tx timeout [ 89.295155][ T5783] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 89.317140][ T50] Bluetooth: hci3: command tx timeout [ 89.322688][ T5795] Bluetooth: hci2: command tx timeout [ 89.513658][ T5784] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.671332][ T5784] veth0_vlan: entered promiscuous mode [ 89.701715][ T5784] veth1_vlan: entered promiscuous mode [ 89.745368][ T5787] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.784048][ T5783] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.808591][ T5784] veth0_macvtap: entered promiscuous mode [ 89.845202][ T5784] veth1_macvtap: entered promiscuous mode [ 89.908850][ T5790] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.935434][ T5787] veth0_vlan: entered promiscuous mode [ 89.953382][ T5783] veth0_vlan: entered promiscuous mode [ 89.976051][ T5787] veth1_vlan: entered promiscuous mode [ 90.006852][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.029330][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.050284][ T5783] veth1_vlan: entered promiscuous mode [ 90.075256][ T5784] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.088657][ T5784] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.099277][ T5784] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.109022][ T5784] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.184018][ T5787] veth0_macvtap: entered promiscuous mode [ 90.198368][ T5790] veth0_vlan: entered promiscuous mode [ 90.239115][ T5783] veth0_macvtap: entered promiscuous mode [ 90.253576][ T5787] veth1_macvtap: entered promiscuous mode [ 90.268385][ T5790] veth1_vlan: entered promiscuous mode [ 90.302670][ T5783] veth1_macvtap: entered promiscuous mode [ 90.357480][ T5787] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.369536][ T5787] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.383151][ T5787] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.394218][ T5787] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.404900][ T5787] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.417930][ T5787] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.435022][ T1043] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.445045][ T1043] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.477483][ T5790] veth0_macvtap: entered promiscuous mode [ 90.493386][ T5787] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.503014][ T5787] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.513408][ T5787] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.522476][ T5787] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.533539][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.544811][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.555066][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.566291][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.579886][ T5783] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.610722][ T5790] veth1_macvtap: entered promiscuous mode [ 90.644870][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.659471][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.671390][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.681917][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.694107][ T5783] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.719401][ T1129] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.731687][ T1129] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.734873][ T5783] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.755649][ T5783] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.766287][ T5783] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.776399][ T5783] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.807665][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.837714][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.848349][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.859357][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.869665][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.880335][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.895588][ T5790] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.942779][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.954717][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.965158][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.976770][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.988473][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 91.000260][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.014843][ T5790] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.047862][ T5790] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.062885][ T5790] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.077066][ T5790] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.086603][ T5790] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.123230][ T1129] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.140226][ T1129] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.228174][ T5795] Bluetooth: hci0: command tx timeout [ 91.243197][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.247373][ T5881] syz.0.1 uses obsolete (PF_INET,SOCK_PACKET) [ 91.274652][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.307025][ T5795] Bluetooth: hci1: command tx timeout [ 91.388264][ T50] Bluetooth: hci3: command tx timeout [ 91.395250][ T5795] Bluetooth: hci2: command tx timeout [ 91.758946][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.952599][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.140299][ T1030] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.175018][ T1030] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.204996][ T1188] cfg80211: failed to load regulatory.db [ 92.207871][ T1030] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.227343][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.235735][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.236049][ T1030] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.296948][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.314006][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.312091][ T5795] Bluetooth: hci0: command tx timeout [ 93.387646][ T5795] Bluetooth: hci1: command tx timeout [ 93.466971][ T50] Bluetooth: hci3: command tx timeout [ 93.472654][ T5795] Bluetooth: hci2: command tx timeout [ 93.754761][ T5903] netdevsim netdevsim0 ªªªªª»: renamed from netdevsim0 (while UP) [ 94.026800][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 94.267662][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 94.428375][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 94.437835][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 94.446088][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 94.538677][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 94.547753][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 94.641382][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 94.699343][ T23] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 95.387203][ T23] usb 4-1: Using ep0 maxpacket: 32 [ 95.476647][ T23] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 95.548068][ T23] usb 4-1: config 0 has no interface number 0 [ 95.612608][ T23] usb 4-1: config 0 interface 12 has no altsetting 0 [ 95.661751][ T23] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 95.673017][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.681415][ T23] usb 4-1: Product: syz [ 95.686562][ T23] usb 4-1: Manufacturer: syz [ 95.692445][ T23] usb 4-1: SerialNumber: syz [ 95.878694][ T23] usb 4-1: config 0 descriptor?? [ 97.092503][ T9] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 97.528665][ T9] usb 2-1: config index 0 descriptor too short (expected 1307, got 27) [ 97.544049][ T9] usb 2-1: config 0 has an invalid interface number: 0 but max is -1 [ 97.588652][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 97.727957][ T9] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 97.748120][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10 [ 97.766575][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 97.802656][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 97.828308][ T9] usb 2-1: string descriptor 0 read error: -22 [ 97.848551][ T9] usb 2-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 97.871102][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.898060][ T9] usb 2-1: config 0 descriptor?? [ 97.928950][ T9] hub 2-1:0.0: bad descriptor, ignoring hub [ 97.955996][ T9] hub: probe of 2-1:0.0 failed with error -5 [ 97.986869][ T9] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input5 [ 98.117984][ T23] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 98.149330][ T23] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 98.189955][ T23] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 98.234539][ T23] f81534: probe of 4-1:0.12 failed with error -71 [ 98.236752][ T5929] vivid-000: disconnect [ 98.267113][ T9] usb 2-1: USB disconnect, device number 2 [ 98.348561][ T23] usb 4-1: USB disconnect, device number 2 [ 98.981305][ T5927] vivid-000: reconnect [ 102.908327][ T5795] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 102.918381][ T5795] CPU: 1 PID: 5795 Comm: kworker/u5:3 Not tainted 6.6.96-syzkaller #0 [ 102.926593][ T5795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 102.936698][ T5795] Workqueue: hci1 hci_rx_work [ 102.941482][ T5795] Call Trace: [ 102.944809][ T5795] [ 102.947793][ T5795] dump_stack_lvl+0x16c/0x230 [ 102.952528][ T5795] ? show_regs_print_info+0x20/0x20 [ 102.957782][ T5795] ? load_image+0x3b0/0x3b0 [ 102.962348][ T5795] sysfs_create_dir_ns+0x256/0x280 [ 102.967508][ T5795] ? hci_rx_work+0x43a/0xd80 [ 102.972157][ T5795] ? sysfs_warn_dup+0xa0/0xa0 [ 102.976887][ T5795] ? do_raw_spin_unlock+0x121/0x230 [ 102.982142][ T5795] kobject_add_internal+0x6b8/0xc70 [ 102.987395][ T5795] kobject_add+0x156/0x220 [ 102.991851][ T5795] ? __rwlock_init+0x150/0x150 [ 102.996655][ T5795] ? kobject_init+0x1e0/0x1e0 [ 103.001352][ T5795] ? _raw_spin_unlock+0x28/0x40 [ 103.006227][ T5795] ? get_device_parent+0x366/0x390 [ 103.011360][ T5795] device_add+0x408/0xc20 [ 103.015711][ T5795] hci_conn_add_sysfs+0xd5/0x1e0 [ 103.020689][ T5795] le_conn_complete_evt+0xc37/0x1220 [ 103.026000][ T5795] ? hci_event_packet+0x4a7/0x1210 [ 103.031145][ T5795] ? hci_le_big_info_adv_report_evt+0x8e0/0x8e0 [ 103.037416][ T5795] ? __copy_skb_header+0xa7/0x550 [ 103.042471][ T5795] ? __mutex_unlock_slowpath+0x1a2/0x6a0 [ 103.048136][ T5795] ? skb_pull_data+0xfb/0x200 [ 103.052836][ T5795] hci_le_conn_complete_evt+0x187/0x440 [ 103.058412][ T5795] ? hci_remote_host_features_evt+0x160/0x160 [ 103.064502][ T5795] hci_event_packet+0x795/0x1210 [ 103.069478][ T5795] ? bis_list+0x290/0x290 [ 103.073848][ T5795] ? lockdep_hardirqs_on+0x98/0x150 [ 103.079073][ T5795] ? hci_send_to_monitor+0xd7/0x4f0 [ 103.084310][ T5795] hci_rx_work+0x43a/0xd80 [ 103.088760][ T5795] ? process_scheduled_works+0x957/0x15b0 [ 103.094498][ T5795] process_scheduled_works+0xa45/0x15b0 [ 103.100101][ T5795] ? assign_work+0x400/0x400 [ 103.104714][ T5795] ? assign_work+0x39e/0x400 [ 103.109324][ T5795] worker_thread+0xa55/0xfc0 [ 103.113952][ T5795] kthread+0x2fa/0x390 [ 103.118038][ T5795] ? pr_cont_work+0x560/0x560 [ 103.122740][ T5795] ? kthread_blkcg+0xd0/0xd0 [ 103.127341][ T5795] ret_from_fork+0x48/0x80 [ 103.131779][ T5795] ? kthread_blkcg+0xd0/0xd0 [ 103.136386][ T5795] ret_from_fork_asm+0x11/0x20 [ 103.141204][ T5795] [ 103.144256][ C1] vkms_vblank_simulate: vblank timer overrun [ 103.160045][ T5795] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 103.174474][ T5795] Bluetooth: hci1: failed to register connection device [ 105.596229][ T5972] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 108.551434][ T5979] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 109.303510][ T5988] vivid-000: disconnect [ 109.608248][ T5985] vivid-000: reconnect [ 110.132130][ T6002] hub 6-0:1.0: USB hub found [ 110.137936][ T6002] hub 6-0:1.0: 1 port detected [ 113.270427][ T50] Bluetooth: hci1: command 0x0406 tx timeout [ 113.738116][ T6012] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 119.846364][ T6038] vivid-000: disconnect [ 120.469885][ T58] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.700106][ T6034] vivid-000: reconnect [ 120.889426][ T58] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.013560][ T58] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.115966][ T58] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.377712][ T6053] vivid-000: disconnect [ 122.185441][ T6049] vivid-000: reconnect [ 122.697229][ T6062] vivid-000: disconnect [ 122.773873][ T5795] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 122.784284][ T5795] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 122.793405][ T5795] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 122.827363][ T5795] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 122.842213][ T5795] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 122.851051][ T5795] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 123.409941][ T6070] syz.0.56: attempt to access beyond end of device [ 123.409941][ T6070] loop1: rw=0, sector=0, nr_sectors = 8 limit=0 [ 123.457057][ T6070] F2FS-fs (loop1): Unable to read 1th superblock [ 123.503806][ T6070] syz.0.56: attempt to access beyond end of device [ 123.503806][ T6070] loop1: rw=0, sector=8, nr_sectors = 8 limit=0 [ 123.527096][ T6060] vivid-000: reconnect [ 123.543187][ T6070] F2FS-fs (loop1): Unable to read 2th superblock [ 123.903508][ T9] IPVS: starting estimator thread 0... [ 123.996870][ T6084] IPVS: using max 26 ests per chain, 62400 per kthread [ 124.033126][ T6070] bridge0: entered promiscuous mode [ 124.040655][ T6070] macsec1: entered promiscuous mode [ 124.061657][ T6070] bridge0: port 3(macsec1) entered blocking state [ 124.076174][ T6070] bridge0: port 3(macsec1) entered disabled state [ 124.165103][ T6070] macsec1: entered allmulticast mode [ 124.171955][ T6070] bridge0: entered allmulticast mode [ 124.278572][ T6070] macsec1: left allmulticast mode [ 124.306620][ T6070] bridge0: left allmulticast mode [ 124.382807][ T6070] bridge0: left promiscuous mode [ 124.907299][ T50] Bluetooth: hci1: command tx timeout [ 125.056862][ T6065] chnl_net:caif_netlink_parms(): no params data found [ 125.746950][ T58] hsr_slave_0: left promiscuous mode [ 125.837938][ T58] hsr_slave_1: left promiscuous mode [ 126.193055][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 126.226560][ T58] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 126.266065][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 126.307884][ T58] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 126.320956][ T58] bridge_slave_1: left allmulticast mode [ 126.328455][ T58] bridge_slave_1: left promiscuous mode [ 126.337463][ T58] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.387625][ T58] bridge_slave_0: left allmulticast mode [ 126.393345][ T58] bridge_slave_0: left promiscuous mode [ 126.406313][ T58] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.518258][ T58] veth1_macvtap: left promiscuous mode [ 126.537970][ T58] veth0_macvtap: left promiscuous mode [ 126.566694][ T58] veth1_vlan: left promiscuous mode [ 126.572349][ T58] veth0_vlan: left promiscuous mode [ 126.986679][ T50] Bluetooth: hci1: command tx timeout [ 129.051827][ T6135] vivid-000: disconnect [ 129.080025][ T50] Bluetooth: hci1: command tx timeout [ 129.281982][ T5786] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 129.478806][ T5786] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 129.499108][ T5786] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 129.508536][ T5786] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.561487][ T5786] usb 1-1: config 0 descriptor?? [ 129.653557][ T58] team0 (unregistering): Port device team_slave_1 removed [ 129.709261][ T58] team0 (unregistering): Port device team_slave_0 removed [ 129.791462][ T6133] vivid-000: reconnect [ 129.853105][ T58] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 129.985387][ T58] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 130.021191][ T5786] keytouch 0003:0926:3333.0001: fixing up Keytouch IEC report descriptor [ 130.067442][ T5786] input: HID 0926:3333 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0926:3333.0001/input/input6 [ 130.221306][ T6137] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.268418][ T6137] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.303916][ T5786] keytouch 0003:0926:3333.0001: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.0-1/input0 [ 131.048756][ T9] usb 1-1: USB disconnect, device number 2 [ 131.146585][ T50] Bluetooth: hci1: command tx timeout [ 131.464703][ T6144] fido_id[6144]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 132.295368][ T6154] fuse: Unknown parameter '0x0000000000000004' [ 133.197279][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.204012][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.273739][ T1188] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 133.446606][ T1188] usb 2-1: device descriptor read/64, error -71 [ 133.472088][ T58] bond0 (unregistering): Released all slaves [ 133.736519][ T1188] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 133.821816][ T6065] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.844809][ T6065] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.866938][ T6065] bridge_slave_0: entered allmulticast mode [ 133.895490][ T6065] bridge_slave_0: entered promiscuous mode [ 134.046823][ T1188] usb 2-1: device descriptor read/64, error -71 [ 134.089279][ T6065] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.096764][ T6065] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.104010][ T6065] bridge_slave_1: entered allmulticast mode [ 134.854589][ T1188] usb usb2-port1: attempt power cycle [ 134.874099][ T6065] bridge_slave_1: entered promiscuous mode [ 135.066065][ T6065] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 135.183736][ T6065] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 135.408306][ T6065] team0: Port device team_slave_0 added [ 135.439283][ T6065] team0: Port device team_slave_1 added [ 135.589384][ T6065] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 135.605976][ T6065] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 135.655406][ T6065] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 135.700311][ T6065] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 135.723240][ T6065] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 135.758791][ T6065] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 135.804790][ T6195] fuse: Unknown parameter '0x0000000000000004' [ 136.466193][ T6065] hsr_slave_0: entered promiscuous mode [ 136.772764][ T6065] hsr_slave_1: entered promiscuous mode [ 136.817378][ T6065] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 136.841522][ T6065] Cannot create hsr debugfs directory [ 137.605437][ T6065] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 137.643627][ T6065] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 137.661599][ T6065] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 137.681307][ T6065] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 139.239578][ T6065] 8021q: adding VLAN 0 to HW filter on device bond0 [ 139.442447][ T6065] 8021q: adding VLAN 0 to HW filter on device team0 [ 139.754165][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.761431][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 140.143964][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.151240][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 140.194188][ T6236] fuse: Unknown parameter '0x0000000000000004' [ 140.293492][ T6065] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 140.305379][ T6065] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 141.528252][ T5834] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 141.697239][ T5834] usb 4-1: device descriptor read/64, error -71 [ 141.812455][ T6065] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 141.986974][ T5834] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 142.146603][ T5834] usb 4-1: device descriptor read/64, error -71 [ 142.283554][ T5834] usb usb4-port1: attempt power cycle [ 142.718776][ T6065] veth0_vlan: entered promiscuous mode [ 142.726733][ T5834] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 142.785250][ T6065] veth1_vlan: entered promiscuous mode [ 142.799513][ T5834] usb 4-1: device descriptor read/8, error -71 [ 142.930909][ T6065] veth0_macvtap: entered promiscuous mode [ 142.974090][ T6065] veth1_macvtap: entered promiscuous mode [ 143.058311][ T6065] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 143.085588][ T6065] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 143.102581][ T6065] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 143.153150][ T6065] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 143.336561][ T6065] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 143.709831][ T6065] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 143.741474][ T6065] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 143.859696][ T6065] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 143.891374][ T6065] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 143.931768][ T6065] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 143.968344][ T6065] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 143.988918][ T6065] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 144.025587][ T6065] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 144.058696][ T6065] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 144.120510][ T6065] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.156631][ T6065] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.170280][ T6065] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.211232][ T6065] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.429318][ T6298] vivid-000: disconnect [ 144.491381][ T6300] fuse: Unknown parameter '0x0000000000000003' [ 144.649803][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 144.681057][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 144.692807][ T6302] fuse: Unknown parameter '0x0000000000000004' [ 144.899202][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 145.635268][ T6295] vivid-000: reconnect [ 145.682586][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 149.395509][ T6340] fuse: Unknown parameter '0x0000000000000004' [ 150.770370][ T6353] netlink: 'syz.4.106': attribute type 2 has an invalid length. [ 150.778174][ T6353] netlink: 'syz.4.106': attribute type 8 has an invalid length. [ 150.786102][ T6353] netlink: 132 bytes leftover after parsing attributes in process `syz.4.106'. [ 153.925120][ T6364] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 155.566555][ T6375] netlink: 4 bytes leftover after parsing attributes in process `syz.4.111'. [ 155.685982][ T6377] netlink: 4 bytes leftover after parsing attributes in process `syz.4.111'. [ 157.252840][ T6395] vivid-000: disconnect [ 157.413974][ T6385] vivid-000: reconnect [ 158.131251][ T6404] fuse: Unknown parameter '0xffffffffffffffff' [ 159.865534][ T6416] fuse: Unknown parameter '0x0000000000000004' [ 163.286404][ C0] sched: RT throttling activated [ 165.917584][ T6456] netlink: 'syz.3.127': attribute type 2 has an invalid length. [ 169.746040][ T6475] fuse: Unknown parameter '0x0000000000000003' [ 171.145913][ T6497] fuse: Unknown parameter '0x0000000000000004' [ 171.195661][ T6499] fuse: Unknown parameter 'u00000000000000000000' [ 171.874184][ T5786] usb 5-1: new low-speed USB device number 2 using dummy_hcd [ 172.221189][ T5786] usb 5-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 172.231273][ T5786] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.278603][ T5786] usb 5-1: config 0 descriptor?? [ 173.136610][ T5786] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 173.193575][ T5786] asix: probe of 5-1:0.0 failed with error -61 [ 173.388744][ T6523] fuse: Unknown parameter '0x0000000000000003' [ 174.572321][ T786] usb 5-1: USB disconnect, device number 2 [ 174.613620][ T6545] fuse: Unknown parameter '0x0000000000000004' [ 174.813324][ T6550] fuse: Unknown parameter 'u00000000000000000000' [ 177.070479][ T786] libceph: connect (1)[c::]:6789 error -101 [ 177.117639][ T786] libceph: mon0 (1)[c::]:6789 connect error [ 177.144354][ T6559] ceph: No mds server is up or the cluster is laggy [ 177.162265][ T786] libceph: connect (1)[c::]:6789 error -101 [ 177.180030][ T786] libceph: mon0 (1)[c::]:6789 connect error [ 177.596752][ T6590] fuse: Unknown parameter 'u00000000000000000000' [ 177.776494][ T23] usb 2-1: new low-speed USB device number 6 using dummy_hcd [ 177.974589][ T23] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 178.591926][ T23] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.639042][ T23] usb 2-1: config 0 descriptor?? [ 178.747484][ T6599] fuse: Unknown parameter '0x0000000000000004' [ 179.796117][ T23] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 179.807403][ T23] asix: probe of 2-1:0.0 failed with error -61 [ 181.142487][ T6625] fuse: Unknown parameter '0x0000000000000003' [ 182.022442][ T8] usb 2-1: USB disconnect, device number 6 [ 182.159988][ T786] libceph: connect (1)[c::]:6789 error -101 [ 182.166123][ T786] libceph: mon0 (1)[c::]:6789 connect error [ 182.167329][ T6639] fuse: Unknown parameter '0x0000000000000004' [ 182.346191][ T6631] ceph: No mds server is up or the cluster is laggy [ 183.145394][ T786] libceph: connect (1)[c::]:6789 error -101 [ 183.200162][ T786] libceph: mon0 (1)[c::]:6789 connect error [ 183.415982][ T6650] fuse: Unknown parameter '0x0000000000000004' [ 186.575725][ T6688] fuse: Unknown parameter '0x0000000000000004' [ 187.913218][ T6699] fuse: Unknown parameter '0x0000000000000004' [ 189.011419][ T6714] vivid-000: disconnect [ 189.850955][ T6711] vivid-000: reconnect [ 191.976126][ T6747] fuse: Unknown parameter '0x0000000000000004' [ 194.591590][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.598103][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.955559][ T6758] fuse: Unknown parameter '0x0000000000000004' [ 195.286661][ T1188] usb 4-1: new low-speed USB device number 7 using dummy_hcd [ 195.522033][ T1188] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 195.956584][ T1188] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.977871][ T1188] usb 4-1: config 0 descriptor?? [ 196.628899][ T1188] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 196.658093][ T1188] asix: probe of 4-1:0.0 failed with error -61 [ 198.376161][ T786] usb 4-1: USB disconnect, device number 7 [ 199.476480][ T6811] fuse: Unknown parameter '0x0000000000000004' [ 199.749974][ T6817] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 202.246150][ T6838] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 204.906670][ T5786] usb 5-1: new low-speed USB device number 3 using dummy_hcd [ 205.117263][ T5786] usb 5-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 205.157712][ T6854] vivid-000: disconnect [ 205.176959][ T6853] vivid-000: reconnect [ 205.181465][ T5786] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.241673][ T5786] usb 5-1: config 0 descriptor?? [ 206.416593][ T5786] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 206.441778][ T5786] asix: probe of 5-1:0.0 failed with error -61 [ 206.500844][ T6874] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 208.589218][ T1188] usb 5-1: USB disconnect, device number 3 [ 210.025819][ T6907] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 210.525946][ T6915] fuse: Unknown parameter '0x0000000000000004' [ 211.841866][ T5879] libceph: connect (1)[c::]:6789 error -101 [ 211.869467][ T5879] libceph: mon0 (1)[c::]:6789 connect error [ 211.898506][ T6924] ceph: No mds server is up or the cluster is laggy [ 212.029193][ T5798] Bluetooth: hci2: command 0x0406 tx timeout [ 212.029210][ T5797] Bluetooth: hci3: command 0x0406 tx timeout [ 212.035286][ T5788] Bluetooth: hci0: command 0x0406 tx timeout [ 212.096259][ T6932] fuse: Unknown parameter '0x000000000000000400000000000000000000' [ 212.474831][ T6940] Zero length message leads to an empty skb [ 221.073694][ T7015] fuse: Unknown parameter '0x0000000000000004' [ 223.260360][ T7031] vivid-000: disconnect [ 225.634983][ T7027] vivid-000: reconnect [ 227.051310][ T7053] vivid-000: disconnect [ 229.466078][ T7049] vivid-000: reconnect [ 230.418148][ T7071] ======================================================= [ 230.418148][ T7071] WARNING: The mand mount option has been deprecated and [ 230.418148][ T7071] and is ignored by this kernel. Remove the mand [ 230.418148][ T7071] option from the mount to silence this warning. [ 230.418148][ T7071] ======================================================= [ 232.877003][ T7097] vivid-000: disconnect [ 235.157101][ T7089] vivid-000: reconnect [ 239.278557][ T7123] vivid-000: disconnect [ 239.972648][ T7120] vivid-000: reconnect [ 240.091967][ T5786] libceph: connect (1)[c::]:6789 error -101 [ 240.101044][ T5786] libceph: mon0 (1)[c::]:6789 connect error [ 240.154098][ T5800] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 240.163950][ T5800] CPU: 0 PID: 5800 Comm: kworker/u5:6 Not tainted 6.6.96-syzkaller #0 [ 240.172142][ T5800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 240.182221][ T5800] Workqueue: hci1 hci_rx_work [ 240.186950][ T5800] Call Trace: [ 240.190242][ T5800] [ 240.193182][ T5800] dump_stack_lvl+0x16c/0x230 [ 240.197881][ T5800] ? show_regs_print_info+0x20/0x20 [ 240.203095][ T5800] ? load_image+0x3b0/0x3b0 [ 240.207627][ T5800] sysfs_create_dir_ns+0x256/0x280 [ 240.212749][ T5800] ? hci_rx_work+0x43a/0xd80 [ 240.217364][ T5800] ? sysfs_warn_dup+0xa0/0xa0 [ 240.222057][ T5800] ? do_raw_spin_unlock+0x121/0x230 [ 240.227278][ T5800] kobject_add_internal+0x6b8/0xc70 [ 240.232510][ T5800] kobject_add+0x156/0x220 [ 240.237024][ T5800] ? __rwlock_init+0x150/0x150 [ 240.241808][ T5800] ? kobject_init+0x1e0/0x1e0 [ 240.246497][ T5800] ? _raw_spin_unlock+0x28/0x40 [ 240.251363][ T5800] ? get_device_parent+0x366/0x390 [ 240.256493][ T5800] device_add+0x408/0xc20 [ 240.260848][ T5800] hci_conn_add_sysfs+0xd5/0x1e0 [ 240.265812][ T5800] le_conn_complete_evt+0xc37/0x1220 [ 240.271144][ T5800] ? hci_event_packet+0x4a7/0x1210 [ 240.276274][ T5800] ? hci_le_big_info_adv_report_evt+0x8e0/0x8e0 [ 240.282541][ T5800] ? __copy_skb_header+0xa7/0x550 [ 240.287698][ T5800] ? __mutex_unlock_slowpath+0x1a2/0x6a0 [ 240.293360][ T5800] ? skb_pull_data+0xfb/0x200 [ 240.298072][ T5800] hci_le_conn_complete_evt+0x187/0x440 [ 240.303644][ T5800] ? hci_remote_host_features_evt+0x160/0x160 [ 240.309741][ T5800] hci_event_packet+0x795/0x1210 [ 240.314700][ T5800] ? bis_list+0x290/0x290 [ 240.319046][ T5800] ? lockdep_hardirqs_on+0x98/0x150 [ 240.324254][ T5800] ? hci_send_to_monitor+0xd7/0x4f0 [ 240.329472][ T5800] hci_rx_work+0x43a/0xd80 [ 240.333910][ T5800] ? process_scheduled_works+0x957/0x15b0 [ 240.339642][ T5800] process_scheduled_works+0xa45/0x15b0 [ 240.345217][ T5800] ? assign_work+0x400/0x400 [ 240.349838][ T5800] ? assign_work+0x39e/0x400 [ 240.354486][ T5800] worker_thread+0xa55/0xfc0 [ 240.359146][ T5800] kthread+0x2fa/0x390 [ 240.363229][ T5800] ? pr_cont_work+0x560/0x560 [ 240.367930][ T5800] ? kthread_blkcg+0xd0/0xd0 [ 240.372541][ T5800] ret_from_fork+0x48/0x80 [ 240.376976][ T5800] ? kthread_blkcg+0xd0/0xd0 [ 240.381580][ T5800] ret_from_fork_asm+0x11/0x20 [ 240.386390][ T5800] [ 240.392155][ T5800] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 240.408111][ T1188] libceph: connect (1)[c::]:6789 error -101 [ 240.414146][ T1188] libceph: mon0 (1)[c::]:6789 connect error [ 240.422729][ T7134] ceph: No mds server is up or the cluster is laggy [ 240.426440][ T5800] Bluetooth: hci1: failed to register connection device [ 247.868848][ T5800] Bluetooth: hci1: command 0x0406 tx timeout [ 248.693731][ T7184] IPVS: set_ctl: invalid protocol: 43 172.30.1.2:20007 [ 249.874063][ T7194] vivid-000: disconnect [ 249.995799][ T5786] libceph: connect (1)[c::]:6789 error -101 [ 250.003729][ T5786] libceph: mon0 (1)[c::]:6789 connect error [ 250.057280][ T7196] ceph: No mds server is up or the cluster is laggy [ 250.995316][ T7189] vivid-000: reconnect [ 252.363475][ T7215] fuse: Unknown parameter '0x0000000000000004' [ 254.550796][ T7231] netlink: 'syz.3.294': attribute type 64 has an invalid length. [ 254.567230][ T7231] netlink: 44 bytes leftover after parsing attributes in process `syz.3.294'. [ 254.680154][ T7234] ubi31: attaching mtd0 [ 254.955094][ T5795] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 254.960147][ T7234] ubi31: scanning is finished [ 254.969632][ T5795] CPU: 1 PID: 5795 Comm: kworker/u5:3 Not tainted 6.6.96-syzkaller #0 [ 254.969682][ T5795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 254.969696][ T5795] Workqueue: hci2 hci_rx_work [ 254.969741][ T5795] Call Trace: [ 254.978026][ T7234] ubi31: empty MTD device detected [ 254.988035][ T5795] [ 254.988049][ T5795] dump_stack_lvl+0x16c/0x230 [ 254.988087][ T5795] ? show_regs_print_info+0x20/0x20 [ 254.988117][ T5795] ? load_image+0x3b0/0x3b0 [ 255.018603][ T5795] sysfs_create_dir_ns+0x256/0x280 [ 255.023754][ T5795] ? sysfs_warn_dup+0xa0/0xa0 [ 255.028457][ T5795] ? do_raw_spin_unlock+0x121/0x230 [ 255.033686][ T5795] kobject_add_internal+0x6b8/0xc70 [ 255.038911][ T5795] kobject_add+0x156/0x220 [ 255.043351][ T5795] ? kobject_init+0x1e0/0x1e0 [ 255.048050][ T5795] ? _raw_spin_unlock+0x3a/0x40 [ 255.052923][ T5795] ? get_device_parent+0x366/0x390 [ 255.058058][ T5795] device_add+0x408/0xc20 [ 255.062415][ T5795] hci_conn_add_sysfs+0xd5/0x1e0 [ 255.067417][ T5795] le_conn_complete_evt+0xc37/0x1220 [ 255.072728][ T5795] ? trace_irq_disable+0x37/0xe0 [ 255.077701][ T5795] ? hci_le_big_info_adv_report_evt+0x8e0/0x8e0 [ 255.083990][ T5795] ? lockdep_hardirqs_on+0x98/0x150 [ 255.089230][ T5795] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 255.094909][ T5795] ? skb_pull_data+0xfb/0x200 [ 255.099625][ T5795] hci_le_conn_complete_evt+0x187/0x440 [ 255.105207][ T5795] ? hci_remote_host_features_evt+0x160/0x160 [ 255.111305][ T5795] hci_event_packet+0x795/0x1210 [ 255.116274][ T5795] ? bis_list+0x290/0x290 [ 255.120635][ T5795] ? kcov_remote_start+0x2b/0x7f0 [ 255.125689][ T5795] ? hci_send_to_monitor+0xd7/0x4f0 [ 255.130914][ T5795] hci_rx_work+0x43a/0xd80 [ 255.135366][ T5795] ? process_scheduled_works+0x957/0x15b0 [ 255.141129][ T5795] process_scheduled_works+0xa45/0x15b0 [ 255.146727][ T5795] ? assign_work+0x400/0x400 [ 255.151349][ T5795] ? assign_work+0x39e/0x400 [ 255.155961][ T5795] worker_thread+0xa55/0xfc0 [ 255.160600][ T5795] kthread+0x2fa/0x390 [ 255.164690][ T5795] ? pr_cont_work+0x560/0x560 [ 255.169384][ T5795] ? kthread_blkcg+0xd0/0xd0 [ 255.174006][ T5795] ret_from_fork+0x48/0x80 [ 255.178445][ T5795] ? kthread_blkcg+0xd0/0xd0 [ 255.183055][ T5795] ret_from_fork_asm+0x11/0x20 [ 255.187856][ T5795] [ 255.193074][ T5795] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 255.207621][ T5795] Bluetooth: hci2: failed to register connection device [ 255.525618][ T9] libceph: connect (1)[c::]:6789 error -101 [ 255.536559][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 255.543781][ T7234] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 255.562617][ T7233] ceph: No mds server is up or the cluster is laggy [ 255.567077][ T7234] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 255.620918][ T7234] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 255.652747][ T7234] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 255.787296][ T7234] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 255.823808][ T7234] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 256.031591][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.038162][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.044588][ T7234] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3877219366 [ 256.111449][ T7234] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 256.201988][ T7238] ubi31: background thread "ubi_bgt31d" started, PID 7238 [ 256.847936][ T7259] vivid-000: disconnect [ 257.676805][ T7256] vivid-000: reconnect [ 258.953373][ T7277] fuse: Unknown parameter '0x0000000000000004' [ 259.632709][ T7284] fuse: Unknown parameter '0x0000000000000004' [ 260.883180][ T7290] netlink: 'syz.0.309': attribute type 2 has an invalid length. [ 261.631592][ T7300] ubi: mtd0 is already attached to ubi31 [ 264.126465][ T5786] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 265.486447][ T5786] usb 4-1: Using ep0 maxpacket: 8 [ 265.502382][ T5786] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 265.552190][ T5786] usb 4-1: config 16 has 0 interfaces, different from the descriptor's value: 1 [ 265.595968][ T7325] netlink: 'syz.1.320': attribute type 2 has an invalid length. [ 265.613289][ T5786] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 265.661180][ T5786] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.385485][ T27] usb 4-1: USB disconnect, device number 8 [ 266.634542][ T7340] macvlan0: entered allmulticast mode [ 266.642559][ T7340] veth1_vlan: entered allmulticast mode [ 266.654355][ T7340] veth1_vlan: left allmulticast mode [ 266.704152][ T7340] macvlan0 (unregistering): left allmulticast mode [ 266.994842][ T7349] fuse: Unknown parameter '0x0000000000000004' [ 267.421709][ T7358] vivid-000: disconnect [ 269.771763][ T7351] vivid-000: reconnect [ 272.526876][ T5800] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 273.631175][ T7384] fuse: Unknown parameter '0x0000000000000004' [ 273.748098][ T7387] netlink: 892 bytes leftover after parsing attributes in process `syz.3.339'. [ 273.819222][ T7389] netlink: 892 bytes leftover after parsing attributes in process `syz.3.339'. [ 275.115213][ T7404] netlink: 'syz.1.344': attribute type 2 has an invalid length. [ 275.538292][ T7410] vivid-000: disconnect [ 276.096086][ T7408] vivid-000: reconnect [ 276.252780][ T7417] fuse: Unknown parameter '0x0000000000000004' [ 276.737427][ T7430] fuse: Unknown parameter '0x0000000000000004' [ 276.964450][ T7433] netlink: 868 bytes leftover after parsing attributes in process `syz.4.351'. [ 277.898446][ T7437] netlink: 868 bytes leftover after parsing attributes in process `syz.4.351'. [ 278.921227][ T7443] netlink: 'syz.0.354': attribute type 2 has an invalid length. [ 279.962009][ T7449] fuse: Unknown parameter '0x0000000000000004' [ 280.510035][ T7455] vivid-000: disconnect [ 280.586656][ T8] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 280.776552][ T8] usb 5-1: Using ep0 maxpacket: 8 [ 280.785185][ T8] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 280.811835][ T8] usb 5-1: config 0 has no interface number 0 [ 280.886886][ T8] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c0.9b [ 280.896034][ T8] usb 5-1: New USB device strings: Mfr=255, Product=0, SerialNumber=0 [ 280.952124][ T8] usb 5-1: Manufacturer: syz [ 280.983301][ T8] usb 5-1: config 0 descriptor?? [ 281.095502][ T7459] batman_adv: batadv0: Adding interface: dummy0 [ 281.103632][ T7459] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 281.128898][ C0] vkms_vblank_simulate: vblank timer overrun [ 281.146122][ T8] viperboard 5-1:0.143: version 0.00 found at bus 005 address 004 [ 281.157911][ T7459] batman_adv: batadv0: Interface activated: dummy0 [ 281.181448][ T8] viperboard-i2c viperboard-i2c.2.auto: failure setting i2c_bus_freq to 100 [ 281.220309][ T8] viperboard-i2c: probe of viperboard-i2c.2.auto failed with error -5 [ 281.242597][ T7446] vivid-000: reconnect [ 281.261019][ T7461] batadv0: mtu less than device minimum [ 281.325488][ T8] usb 5-1: USB disconnect, device number 4 [ 281.335023][ T7461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 281.351495][ T7461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 281.367829][ T7461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 281.383826][ T7461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 281.400104][ T7461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 281.416311][ T7461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 281.432194][ T7461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 281.448505][ T7461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 281.464696][ T7461] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 281.563715][ T7465] fuse: Unknown parameter '0x0000000000000004' [ 282.689453][ T7474] netlink: 868 bytes leftover after parsing attributes in process `syz.3.364'. [ 282.761891][ T7478] netlink: 868 bytes leftover after parsing attributes in process `syz.3.364'. [ 283.871119][ T7487] fuse: Unknown parameter '0x0000000000000004' [ 284.369132][ T7492] vivid-000: disconnect [ 284.555727][ T7489] vivid-000: reconnect [ 284.842966][ T7497] fuse: Unknown parameter '0x0000000000000004' [ 289.655025][ T7509] tipc: Started in network mode [ 289.676797][ T7509] tipc: Node identity 8a530c73b2bd, cluster identity 4711 [ 289.684744][ T7509] tipc: Enabled bearer , priority 0 [ 289.706949][ T7508] tipc: Resetting bearer [ 289.875824][ T7526] fuse: Unknown parameter '0x0000000000000004' [ 290.756206][ T1188] tipc: Node number set to 955124851 [ 290.832814][ T7532] vivid-000: disconnect [ 291.439152][ T7529] vivid-000: reconnect [ 293.944236][ T7562] random: crng reseeded on system resumption [ 296.136205][ T7565] fuse: Unknown parameter '0x0000000000000004' [ 297.339567][ T7573] vivid-000: disconnect [ 297.801121][ T7570] vivid-000: reconnect [ 299.804521][ T7596] fuse: Unknown parameter '0x0000000000000004' [ 301.232349][ T7606] vivid-000: disconnect [ 301.232717][ T7605] vivid-000: reconnect [ 302.806950][ T7508] tipc: Disabling bearer [ 303.298753][ T7619] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 303.470320][ T7623] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 304.002930][ T1188] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 304.532974][ T7625] fuse: Unknown parameter '0x0000000000000004' [ 304.680097][ T5800] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 304.691686][ T5800] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 304.700410][ T5800] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 304.710131][ T5800] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 304.718518][ T5800] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 304.726199][ T5800] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 304.806555][ T1188] usb 5-1: Using ep0 maxpacket: 32 [ 304.813904][ T1188] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 304.824905][ T1188] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 304.855610][ T1188] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 304.864908][ T1188] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.883422][ T1188] usb 5-1: config 0 descriptor?? [ 305.214766][ T2930] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 305.248898][ T7626] chnl_net:caif_netlink_parms(): no params data found [ 305.320044][ T2930] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 305.345912][ T1188] ft260 0003:0403:6030.0002: unknown main item tag 0x0 [ 305.356522][ T23] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 305.417052][ T7626] bridge0: port 1(bridge_slave_0) entered blocking state [ 305.424302][ T7626] bridge0: port 1(bridge_slave_0) entered disabled state [ 305.438394][ T7626] bridge_slave_0: entered allmulticast mode [ 305.453250][ T7626] bridge_slave_0: entered promiscuous mode [ 305.475247][ T7626] bridge0: port 2(bridge_slave_1) entered blocking state [ 305.490083][ T7626] bridge0: port 2(bridge_slave_1) entered disabled state [ 305.506671][ T7626] bridge_slave_1: entered allmulticast mode [ 305.514201][ T7626] bridge_slave_1: entered promiscuous mode [ 305.519203][ T1188] ft260 0003:0403:6030.0002: chip code: 6424 8183 [ 305.556674][ T2930] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 305.686398][ T23] usb 2-1: Using ep0 maxpacket: 32 [ 305.760752][ T1188] ft260 0003:0403:6030.0002: failed to retrieve system status [ 305.833726][ T1188] ft260: probe of 0003:0403:6030.0002 failed with error -5 [ 306.425857][ T23] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 306.437810][ T23] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 306.449721][ T23] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.461239][ T23] usb 2-1: config 0 descriptor?? [ 306.478700][ T23] hub 2-1:0.0: bad descriptor, ignoring hub [ 306.484670][ T23] hub: probe of 2-1:0.0 failed with error -5 [ 306.524534][ T2930] netdevsim netdevsim0 ªªªªª» (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.552272][ T1188] usb 5-1: USB disconnect, device number 5 [ 306.644364][ T7626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 306.661406][ T7626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 306.758260][ T5800] Bluetooth: hci4: command tx timeout [ 307.240912][ T7626] team0: Port device team_slave_0 added [ 307.249013][ T1188] usb 2-1: USB disconnect, device number 7 [ 307.280279][ T7626] team0: Port device team_slave_1 added [ 307.441134][ T7626] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 307.448576][ T7626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 307.503383][ T7626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 307.820893][ T7626] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 307.930496][ T7626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 308.321142][ T7626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 308.826477][ T5800] Bluetooth: hci4: command tx timeout [ 309.747085][ T7661] netlink: 'syz.1.419': attribute type 2 has an invalid length. [ 309.919848][ T7626] hsr_slave_0: entered promiscuous mode [ 309.935388][ T7626] hsr_slave_1: entered promiscuous mode [ 309.942776][ T7626] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 309.960999][ T7626] Cannot create hsr debugfs directory [ 310.274055][ T2930] tipc: Left network mode [ 310.906457][ T5800] Bluetooth: hci4: command tx timeout [ 311.111710][ T7670] fuse: Unknown parameter '0x0000000000000004' [ 312.905623][ T7626] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 312.986792][ T5800] Bluetooth: hci4: command tx timeout [ 313.170869][ T7698] netlink: 'syz.4.428': attribute type 2 has an invalid length. [ 313.196510][ T7626] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 313.679209][ T7626] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 314.147811][ T7626] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 314.702513][ T7722] fuse: Unknown parameter '0x0000000000000004' [ 316.003501][ T7736] vivid-000: disconnect [ 316.010964][ T7735] vivid-000: reconnect [ 316.186932][ T5841] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 316.212980][ T7740] netlink: 'syz.4.439': attribute type 2 has an invalid length. [ 316.467935][ T5841] usb 2-1: Using ep0 maxpacket: 32 [ 316.567647][ T5841] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 316.575952][ T2930] hsr_slave_0: left promiscuous mode [ 316.672807][ T5841] usb 2-1: config 0 has no interface number 0 [ 316.712350][ T2930] hsr_slave_1: left promiscuous mode [ 316.821129][ T5841] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 316.884842][ T2930] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 316.944790][ T5841] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.964990][ T2930] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 316.974508][ T2930] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 316.982064][ T2930] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 316.989413][ T5841] usb 2-1: Product: syz [ 317.031273][ T2930] bridge_slave_1: left allmulticast mode [ 317.037061][ T2930] bridge_slave_1: left promiscuous mode [ 317.043025][ T2930] bridge0: port 2(bridge_slave_1) entered disabled state [ 317.054393][ T2930] bridge_slave_0: left allmulticast mode [ 317.062253][ T2930] bridge_slave_0: left promiscuous mode [ 317.068363][ T2930] bridge0: port 1(bridge_slave_0) entered disabled state [ 317.105014][ T2930] veth1_macvtap: left promiscuous mode [ 317.110824][ T2930] veth0_macvtap: left promiscuous mode [ 317.136652][ T2930] veth1_vlan: left promiscuous mode [ 317.179403][ T5841] usb 2-1: Manufacturer: syz [ 317.184689][ T5841] usb 2-1: SerialNumber: syz [ 317.207291][ T5841] usb 2-1: config 0 descriptor?? [ 317.216530][ T2930] veth0_vlan: left promiscuous mode [ 317.217583][ T5841] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 317.231894][ T5841] usb 2-1: selecting invalid altsetting 1 [ 317.237803][ T5841] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 317.466458][ T5841] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 317.518719][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.525768][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.913489][ T5841] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 317.922752][ T5841] usb 2-1: media controller created [ 317.949529][ T5841] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 318.148660][ T5841] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 318.158915][ T5841] zl10353_read_register: readreg error (reg=127, ret==-71) [ 318.190196][ T5841] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 318.516907][ T7756] netlink: 8 bytes leftover after parsing attributes in process `syz.4.442'. [ 318.630685][ T7757] netlink: 8 bytes leftover after parsing attributes in process `syz.4.442'. [ 318.640068][ T7757] netlink: 4 bytes leftover after parsing attributes in process `syz.4.442'. [ 319.514447][ T5841] usb 2-1: USB disconnect, device number 8 [ 319.526600][ T7762] fuse: Unknown parameter '0x0000000000000004' [ 319.732805][ T5800] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 319.743770][ T5800] CPU: 1 PID: 5800 Comm: kworker/u5:6 Not tainted 6.6.96-syzkaller #0 [ 319.751986][ T5800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 319.762085][ T5800] Workqueue: hci3 hci_rx_work [ 319.766830][ T5800] Call Trace: [ 319.770150][ T5800] [ 319.773120][ T5800] dump_stack_lvl+0x16c/0x230 [ 319.777854][ T5800] ? show_regs_print_info+0x20/0x20 [ 319.783108][ T5800] ? load_image+0x3b0/0x3b0 [ 319.787676][ T5800] sysfs_create_dir_ns+0x256/0x280 [ 319.792889][ T5800] ? hci_rx_work+0x43a/0xd80 [ 319.797509][ T5800] ? sysfs_warn_dup+0xa0/0xa0 [ 319.802205][ T5800] ? do_raw_spin_unlock+0x121/0x230 [ 319.807459][ T5800] kobject_add_internal+0x6b8/0xc70 [ 319.812683][ T5800] kobject_add+0x156/0x220 [ 319.817116][ T5800] ? __rwlock_init+0x150/0x150 [ 319.821904][ T5800] ? kobject_init+0x1e0/0x1e0 [ 319.826601][ T5800] ? _raw_spin_unlock+0x28/0x40 [ 319.831493][ T5800] ? get_device_parent+0x366/0x390 [ 319.836644][ T5800] device_add+0x408/0xc20 [ 319.841000][ T5800] hci_conn_add_sysfs+0xd5/0x1e0 [ 319.845956][ T5800] le_conn_complete_evt+0xc37/0x1220 [ 319.851270][ T5800] ? hci_event_packet+0x4a7/0x1210 [ 319.856409][ T5800] ? hci_le_big_info_adv_report_evt+0x8e0/0x8e0 [ 319.862669][ T5800] ? __copy_skb_header+0xa7/0x550 [ 319.867712][ T5800] ? __mutex_unlock_slowpath+0x1a2/0x6a0 [ 319.873369][ T5800] ? skb_pull_data+0xfb/0x200 [ 319.878063][ T5800] hci_le_conn_complete_evt+0x187/0x440 [ 319.883635][ T5800] ? hci_remote_host_features_evt+0x160/0x160 [ 319.889720][ T5800] hci_event_packet+0x795/0x1210 [ 319.894684][ T5800] ? bis_list+0x290/0x290 [ 319.899035][ T5800] ? lockdep_hardirqs_on+0x98/0x150 [ 319.904251][ T5800] ? hci_send_to_monitor+0xd7/0x4f0 [ 319.909472][ T5800] hci_rx_work+0x43a/0xd80 [ 319.913921][ T5800] ? process_scheduled_works+0x957/0x15b0 [ 319.919657][ T5800] process_scheduled_works+0xa45/0x15b0 [ 319.925251][ T5800] ? assign_work+0x400/0x400 [ 319.929875][ T5800] ? assign_work+0x39e/0x400 [ 319.934492][ T5800] worker_thread+0xa55/0xfc0 [ 319.939125][ T5800] kthread+0x2fa/0x390 [ 319.943204][ T5800] ? pr_cont_work+0x560/0x560 [ 319.947918][ T5800] ? kthread_blkcg+0xd0/0xd0 [ 319.952526][ T5800] ret_from_fork+0x48/0x80 [ 319.956962][ T5800] ? kthread_blkcg+0xd0/0xd0 [ 319.961567][ T5800] ret_from_fork_asm+0x11/0x20 [ 319.966367][ T5800] [ 319.969499][ C1] vkms_vblank_simulate: vblank timer overrun [ 319.991290][ T5800] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 320.005871][ T5800] Bluetooth: hci3: failed to register connection device [ 322.144902][ T7785] netlink: 8 bytes leftover after parsing attributes in process `syz.3.447'. [ 322.205461][ T7786] netlink: 8 bytes leftover after parsing attributes in process `syz.3.447'. [ 322.214486][ T7786] netlink: 4 bytes leftover after parsing attributes in process `syz.3.447'. [ 323.177578][ T2930] team0 (unregistering): Port device team_slave_1 removed [ 323.285751][ T2930] team0 (unregistering): Port device team_slave_0 removed [ 323.369403][ T2930] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 323.419740][ T2930] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 324.382028][ T2930] bond0 (unregistering): Released all slaves [ 325.006153][ T7792] netlink: 'syz.1.449': attribute type 2 has an invalid length. [ 325.192108][ T7756] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 325.201652][ T7756] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 325.211472][ T7756] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 325.312114][ T28] audit: type=1800 audit(1752156720.170:2): pid=7756 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.442" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 325.341259][ T7756] syz.4.442 (7756) used greatest stack depth: 20552 bytes left [ 325.379565][ T7626] 8021q: adding VLAN 0 to HW filter on device bond0 [ 325.505024][ T7626] 8021q: adding VLAN 0 to HW filter on device team0 [ 325.590221][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 325.597505][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 326.362185][ T5795] Bluetooth: hci3: command 0x0406 tx timeout [ 326.828873][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 326.836072][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 327.289957][ T7811] fuse: Unknown parameter '0x0000000000000004' [ 329.404642][ T2930] IPVS: stop unused estimator thread 0... [ 329.502859][ T7829] vivid-000: disconnect [ 329.940103][ T7827] vivid-000: reconnect [ 330.750509][ T7839] netlink: 16 bytes leftover after parsing attributes in process `syz.3.457'. [ 330.903456][ T7626] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 331.529484][ T7850] vivid-000: disconnect [ 332.022065][ T7847] vivid-000: reconnect [ 333.410248][ T7626] veth0_vlan: entered promiscuous mode [ 333.536849][ T7626] veth1_vlan: entered promiscuous mode [ 336.308381][ T7872] workqueue: Failed to create a rescuer kthread for wq "ceph-completion": -EINTR [ 336.377859][ T7626] veth0_macvtap: entered promiscuous mode [ 336.506740][ T7626] veth1_macvtap: entered promiscuous mode [ 336.585100][ T7626] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 336.616365][ T7626] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 336.636444][ T7626] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 336.659573][ T7626] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 336.693934][ T7626] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 336.723545][ T7626] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 336.734571][ T1188] libceph: connect (1)[c::]:6789 error -101 [ 336.741489][ T1188] libceph: mon0 (1)[c::]:6789 connect error [ 337.169086][ T7626] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 337.313170][ T7626] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 337.393090][ T7626] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 338.452798][ T7626] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 338.478740][ T5786] libceph: connect (1)[c::]:6789 error -101 [ 338.517995][ T5786] libceph: mon0 (1)[c::]:6789 connect error [ 338.544999][ T7626] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 338.583099][ T7626] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 338.675748][ T7626] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 338.985368][ T7626] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 339.100215][ T7626] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.117470][ T5879] libceph: connect (1)[c::]:6789 error -101 [ 339.133604][ T7626] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.136503][ T5879] libceph: mon0 (1)[c::]:6789 connect error [ 339.164701][ T7883] ceph: No mds server is up or the cluster is laggy [ 339.171878][ T7626] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.233036][ T7626] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.607539][ T5800] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 340.617382][ T5800] CPU: 1 PID: 5800 Comm: kworker/u5:6 Not tainted 6.6.96-syzkaller #0 [ 340.625590][ T5800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 340.635702][ T5800] Workqueue: hci2 hci_rx_work [ 340.640450][ T5800] Call Trace: [ 340.643755][ T5800] [ 340.646703][ T5800] dump_stack_lvl+0x16c/0x230 [ 340.651417][ T5800] ? show_regs_print_info+0x20/0x20 [ 340.656643][ T5800] ? load_image+0x3b0/0x3b0 [ 340.661266][ T5800] sysfs_create_dir_ns+0x256/0x280 [ 340.666406][ T5800] ? sysfs_warn_dup+0xa0/0xa0 [ 340.671118][ T5800] ? do_raw_spin_unlock+0x121/0x230 [ 340.676357][ T5800] kobject_add_internal+0x6b8/0xc70 [ 340.681593][ T5800] kobject_add+0x156/0x220 [ 340.686033][ T5800] ? kobject_init+0x1e0/0x1e0 [ 340.690745][ T5800] ? _raw_spin_unlock+0x3a/0x40 [ 340.695617][ T5800] ? get_device_parent+0x366/0x390 [ 340.700750][ T5800] device_add+0x408/0xc20 [ 340.705096][ T5800] hci_conn_add_sysfs+0xd5/0x1e0 [ 340.710074][ T5800] le_conn_complete_evt+0xc37/0x1220 [ 340.715381][ T5800] ? trace_irq_disable+0x37/0xe0 [ 340.720352][ T5800] ? hci_le_big_info_adv_report_evt+0x8e0/0x8e0 [ 340.726630][ T5800] ? lockdep_hardirqs_on+0x98/0x150 [ 340.731851][ T5800] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 340.737520][ T5800] ? skb_pull_data+0xfb/0x200 [ 340.742215][ T5800] hci_le_conn_complete_evt+0x187/0x440 [ 340.747791][ T5800] ? hci_remote_host_features_evt+0x160/0x160 [ 340.753875][ T5800] hci_event_packet+0x795/0x1210 [ 340.758840][ T5800] ? bis_list+0x290/0x290 [ 340.763186][ T5800] ? kcov_remote_start+0x2b/0x7f0 [ 340.768228][ T5800] ? hci_send_to_monitor+0xd7/0x4f0 [ 340.773455][ T5800] hci_rx_work+0x43a/0xd80 [ 340.777901][ T5800] ? process_scheduled_works+0x957/0x15b0 [ 340.783643][ T5800] process_scheduled_works+0xa45/0x15b0 [ 340.789227][ T5800] ? assign_work+0x400/0x400 [ 340.793840][ T5800] ? assign_work+0x39e/0x400 [ 340.798450][ T5800] worker_thread+0xa55/0xfc0 [ 340.803083][ T5800] kthread+0x2fa/0x390 [ 340.807165][ T5800] ? pr_cont_work+0x560/0x560 [ 340.811865][ T5800] ? kthread_blkcg+0xd0/0xd0 [ 340.816474][ T5800] ret_from_fork+0x48/0x80 [ 340.820916][ T5800] ? kthread_blkcg+0xd0/0xd0 [ 340.825534][ T5800] ret_from_fork_asm+0x11/0x20 [ 340.830334][ T5800] [ 340.839294][ T5800] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 340.854585][ T5800] Bluetooth: hci2: failed to register connection device [ 341.505090][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 341.516445][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 341.592283][ T7894] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 341.624549][ T7894] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 341.775830][ T786] libceph: connect (1)[c::]:6789 error -101 [ 341.792334][ T786] libceph: mon0 (1)[c::]:6789 connect error [ 341.840967][ T7918] ceph: No mds server is up or the cluster is laggy [ 343.054264][ T7935] batman_adv: batadv0: Adding interface: dummy0 [ 343.061174][ T7935] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 343.091841][ T7935] batman_adv: batadv0: Interface activated: dummy0 [ 343.123609][ T7935] net_ratelimit: 10 callbacks suppressed [ 343.123627][ T7935] batadv0: mtu less than device minimum [ 343.138605][ T7935] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 343.153182][ T7935] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 343.164921][ T7935] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 343.176764][ T7935] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 343.188518][ T7935] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 343.200242][ T7935] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 343.211980][ T7935] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 343.223688][ T7935] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 343.235471][ T7935] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 345.327994][ T5800] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 345.362056][ T5800] CPU: 0 PID: 5800 Comm: kworker/u5:6 Not tainted 6.6.96-syzkaller #0 [ 345.370374][ T5800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 345.380446][ T5800] Workqueue: hci1 hci_rx_work [ 345.385150][ T5800] Call Trace: [ 345.388436][ T5800] [ 345.391373][ T5800] dump_stack_lvl+0x16c/0x230 [ 345.396067][ T5800] ? show_regs_print_info+0x20/0x20 [ 345.401368][ T5800] ? load_image+0x3b0/0x3b0 [ 345.405905][ T5800] sysfs_create_dir_ns+0x256/0x280 [ 345.411029][ T5800] ? hci_rx_work+0x43a/0xd80 [ 345.415630][ T5800] ? sysfs_warn_dup+0xa0/0xa0 [ 345.420411][ T5800] ? do_raw_spin_unlock+0x121/0x230 [ 345.425630][ T5800] kobject_add_internal+0x6b8/0xc70 [ 345.430852][ T5800] kobject_add+0x156/0x220 [ 345.435279][ T5800] ? __rwlock_init+0x150/0x150 [ 345.440065][ T5800] ? kobject_init+0x1e0/0x1e0 [ 345.444749][ T5800] ? _raw_spin_unlock+0x28/0x40 [ 345.449628][ T5800] ? get_device_parent+0x366/0x390 [ 345.454744][ T5800] device_add+0x408/0xc20 [ 345.459091][ T5800] hci_conn_add_sysfs+0xd5/0x1e0 [ 345.464038][ T5800] le_conn_complete_evt+0xc37/0x1220 [ 345.469345][ T5800] ? hci_event_packet+0x4a7/0x1210 [ 345.474470][ T5800] ? hci_le_big_info_adv_report_evt+0x8e0/0x8e0 [ 345.480723][ T5800] ? __copy_skb_header+0xa7/0x550 [ 345.485768][ T5800] ? __mutex_unlock_slowpath+0x1a2/0x6a0 [ 345.491416][ T5800] ? skb_pull_data+0xfb/0x200 [ 345.496210][ T5800] hci_le_conn_complete_evt+0x187/0x440 [ 345.501794][ T5800] ? hci_remote_host_features_evt+0x160/0x160 [ 345.507885][ T5800] hci_event_packet+0x795/0x1210 [ 345.512836][ T5800] ? bis_list+0x290/0x290 [ 345.517181][ T5800] ? lockdep_hardirqs_on+0x98/0x150 [ 345.522392][ T5800] ? hci_send_to_monitor+0xd7/0x4f0 [ 345.527607][ T5800] hci_rx_work+0x43a/0xd80 [ 345.532043][ T5800] ? process_scheduled_works+0x957/0x15b0 [ 345.537790][ T5800] process_scheduled_works+0xa45/0x15b0 [ 345.543628][ T5800] ? assign_work+0x400/0x400 [ 345.548253][ T5800] ? assign_work+0x39e/0x400 [ 345.552874][ T5800] worker_thread+0xa55/0xfc0 [ 345.557492][ T5800] kthread+0x2fa/0x390 [ 345.561566][ T5800] ? pr_cont_work+0x560/0x560 [ 345.566251][ T5800] ? kthread_blkcg+0xd0/0xd0 [ 345.570851][ T5800] ret_from_fork+0x48/0x80 [ 345.575712][ T5800] ? kthread_blkcg+0xd0/0xd0 [ 345.580321][ T5800] ret_from_fork_asm+0x11/0x20 [ 345.585106][ T5800] [ 345.731800][ T5800] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 345.804162][ T5800] Bluetooth: hci1: failed to register connection device [ 348.129496][ T5800] Bluetooth: hci2: command 0x0406 tx timeout [ 348.742872][ T7982] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 350.011753][ T7993] fuse: Unknown parameter '0x0000000000000004' [ 352.997789][ T1188] libceph: connect (1)[c::]:6789 error -101 [ 353.003915][ T1188] libceph: mon0 (1)[c::]:6789 connect error [ 353.017896][ T8011] ceph: No mds server is up or the cluster is laggy [ 353.484130][ T8019] netlink: 772 bytes leftover after parsing attributes in process `syz.3.493'. [ 353.904997][ T50] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 353.916026][ T50] CPU: 1 PID: 50 Comm: kworker/u5:0 Not tainted 6.6.96-syzkaller #0 [ 353.924072][ T50] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 353.934177][ T50] Workqueue: hci4 hci_rx_work [ 353.938934][ T50] Call Trace: [ 353.942342][ T50] [ 353.945303][ T50] dump_stack_lvl+0x16c/0x230 [ 353.950041][ T50] ? show_regs_print_info+0x20/0x20 [ 353.955302][ T50] ? load_image+0x3b0/0x3b0 [ 353.959866][ T50] sysfs_create_dir_ns+0x256/0x280 [ 353.965020][ T50] ? sysfs_warn_dup+0xa0/0xa0 [ 353.969723][ T50] ? do_raw_spin_unlock+0x121/0x230 [ 353.974949][ T50] kobject_add_internal+0x6b8/0xc70 [ 353.980178][ T50] kobject_add+0x156/0x220 [ 353.984618][ T50] ? kobject_init+0x1e0/0x1e0 [ 353.989314][ T50] ? _raw_spin_unlock+0x28/0x40 [ 353.994197][ T50] ? get_device_parent+0x366/0x390 [ 353.999332][ T50] device_add+0x408/0xc20 [ 354.003679][ T50] hci_conn_add_sysfs+0xd5/0x1e0 [ 354.008640][ T50] le_conn_complete_evt+0xc37/0x1220 [ 354.013949][ T50] ? hci_event_packet+0x4a7/0x1210 [ 354.019099][ T50] ? hci_le_big_info_adv_report_evt+0x8e0/0x8e0 [ 354.025369][ T50] ? __copy_skb_header+0xa7/0x550 [ 354.030425][ T50] ? __mutex_unlock_slowpath+0x1a2/0x6a0 [ 354.036088][ T50] ? skb_pull_data+0xfb/0x200 [ 354.040786][ T50] hci_le_conn_complete_evt+0x187/0x440 [ 354.046362][ T50] ? hci_remote_host_features_evt+0x160/0x160 [ 354.052452][ T50] hci_event_packet+0x795/0x1210 [ 354.057456][ T50] ? bis_list+0x290/0x290 [ 354.061807][ T50] ? lockdep_hardirqs_on+0x98/0x150 [ 354.067024][ T50] ? hci_send_to_monitor+0xd7/0x4f0 [ 354.072325][ T50] hci_rx_work+0x43a/0xd80 [ 354.076802][ T50] ? process_scheduled_works+0x957/0x15b0 [ 354.082591][ T50] process_scheduled_works+0xa45/0x15b0 [ 354.088227][ T50] ? assign_work+0x400/0x400 [ 354.092880][ T50] ? assign_work+0x39e/0x400 [ 354.097515][ T50] worker_thread+0xa55/0xfc0 [ 354.102177][ T50] kthread+0x2fa/0x390 [ 354.106273][ T50] ? pr_cont_work+0x560/0x560 [ 354.111101][ T50] ? kthread_blkcg+0xd0/0xd0 [ 354.115738][ T50] ret_from_fork+0x48/0x80 [ 354.120221][ T50] ? kthread_blkcg+0xd0/0xd0 [ 354.124857][ T50] ret_from_fork_asm+0x11/0x20 [ 354.129679][ T50] [ 354.135669][ T50] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 354.150719][ T50] Bluetooth: hci4: failed to register connection device [ 354.300627][ T8036] fuse: Unknown parameter '0x0000000000000004' [ 355.487138][ T8029] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 355.731241][ T8052] fuse: Unknown parameter '0x0000000000000004' [ 359.317533][ T50] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 359.505591][ T8074] vivid-000: disconnect [ 359.513251][ T8071] vivid-000: reconnect [ 359.532526][ T8083] fuse: Unknown parameter '0x0000000000000004' [ 360.534388][ T8091] random: crng reseeded on system resumption [ 361.492360][ T8101] fuse: Unknown parameter '0xffffffffffffffff' [ 362.701739][ T8114] vivid-000: disconnect [ 363.858149][ T8109] vivid-000: reconnect [ 365.363468][ T50] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 367.844461][ T8155] ubi: mtd0 is already attached to ubi31 [ 375.188410][ T8187] batman_adv: batadv0: Interface deactivated: dummy0 [ 375.195222][ T8187] batman_adv: batadv0: Removing interface: dummy0 [ 377.336565][ T50] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 378.913692][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.920190][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.926635][ T8214] ubi: mtd0 is already attached to ubi31 [ 382.677695][ T50] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 384.095099][ T8255] vivid-000: disconnect [ 385.287202][ T8250] vivid-000: reconnect [ 385.891771][ T8268] netlink: 4 bytes leftover after parsing attributes in process `syz.4.549'. [ 387.333668][ T8288] ubi: mtd0 is already attached to ubi31 [ 395.500495][ T8327] netlink: 4 bytes leftover after parsing attributes in process `syz.4.560'. [ 395.604522][ T8327] netlink: 4 bytes leftover after parsing attributes in process `syz.4.560'. [ 401.529368][ T8373] random: crng reseeded on system resumption [ 405.126701][ T8396] vivid-000: disconnect [ 406.154630][ T8385] vivid-000: reconnect [ 408.364331][ T8432] ubi: mtd0 is already attached to ubi31 [ 410.296765][ T8445] random: crng reseeded on system resumption [ 414.133565][ T8501] random: crng reseeded on system resumption [ 418.768998][ T8532] vivid-000: disconnect [ 419.844028][ T8526] vivid-000: reconnect [ 424.467567][ T8559] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 426.128763][ T8572] loop4: detected capacity change from 0 to 7 [ 426.260509][ T8572] Dev loop4: unable to read RDB block 7 [ 426.698461][ T8572] loop4: unable to read partition table [ 426.722177][ T8572] loop4: partition table beyond EOD, truncated [ 426.754813][ T8572] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 427.557239][ T5800] Bluetooth: hci4: command 0x0406 tx timeout [ 431.588990][ T8613] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 431.677723][ T8616] vivid-000: disconnect [ 432.968866][ T8614] vivid-000: reconnect [ 434.412492][ T8641] random: crng reseeded on system resumption [ 437.346236][ T50] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 438.037180][ T8674] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 440.885985][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.915026][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.705565][ T8695] vivid-000: disconnect [ 443.097430][ T8690] vivid-000: reconnect [ 443.447767][ T8701] ubi: mtd0 is already attached to ubi31 [ 445.198742][ T8721] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 447.789525][ T8745] netlink: 16 bytes leftover after parsing attributes in process `syz.1.648'. [ 448.306235][ T5800] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 450.323548][ T8766] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 451.308331][ T8779] vivid-000: disconnect [ 452.269880][ T8771] vivid-000: reconnect [ 452.353052][ T8782] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 452.359988][ T8782] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 452.380382][ T8782] vhci_hcd vhci_hcd.0: Device attached [ 452.481551][ T50] Bluetooth: hci4: unexpected subevent 0x0e length: 30 > 15 [ 452.506080][ T8783] vhci_hcd: connection closed [ 452.511042][ T12] vhci_hcd: stop threads [ 452.563293][ T12] vhci_hcd: release socket [ 452.589096][ T12] vhci_hcd: disconnect device [ 452.598189][ T5796] vhci_hcd: vhci_device speed not set [ 453.568400][ T8794] netlink: 16 bytes leftover after parsing attributes in process `syz.5.661'. [ 456.504574][ T8808] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 459.073804][ T8824] ubi: mtd0 is already attached to ubi31 [ 461.163157][ T8833] netlink: 'syz.5.673': attribute type 4 has an invalid length. [ 461.418128][ T8835] net_ratelimit: 10 callbacks suppressed [ 461.418172][ T8835] netlink: set zone limit has 8 unknown bytes [ 461.979380][ T8844] comedi comedi0: rti802: I/O port conflict (0xee,4) [ 461.999416][ T8845] vivid-000: disconnect [ 462.888106][ T8838] vivid-000: reconnect [ 465.050786][ T8875] ubi: mtd0 is already attached to ubi31 [ 469.121353][ T50] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 471.244681][ T8925] ubi: mtd0 is already attached to ubi31 [ 472.664113][ T8922] vivid-000: disconnect [ 472.790337][ T8929] netlink: 16 bytes leftover after parsing attributes in process `syz.1.701'. [ 473.038218][ T8921] vivid-000: reconnect [ 475.424984][ T5800] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 477.238718][ T8965] netlink: 16 bytes leftover after parsing attributes in process `syz.1.713'. [ 477.635389][ T8963] vivid-000: disconnect [ 477.913330][ T8959] vivid-000: reconnect [ 478.588616][ T8973] ubi: mtd0 is already attached to ubi31 [ 480.261546][ T8979] netlink: 20 bytes leftover after parsing attributes in process `syz.5.717'. [ 482.122890][ C0] ------------[ cut here ]------------ [ 482.128914][ C0] WARNING: CPU: 0 PID: 5937 at net/mac80211/tx.c:5021 __ieee80211_beacon_get+0x1233/0x1600 [ 482.139064][ C0] Modules linked in: [ 482.143048][ C0] CPU: 0 PID: 5937 Comm: kworker/0:2H Not tainted 6.6.96-syzkaller #0 [ 482.151314][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 482.161534][ C0] Workqueue: events_highpri snd_vmidi_output_work [ 482.168069][ C0] RIP: 0010:__ieee80211_beacon_get+0x1233/0x1600 [ 482.174490][ C0] Code: 24 4c 89 e7 e8 be 86 d5 f7 45 31 f6 4c 8b bc 24 a0 00 00 00 e9 7a fe ff ff e8 99 f9 96 f7 0f 0b e9 f6 f7 ff ff e8 8d f9 96 f7 <0f> 0b e9 48 fb ff ff e8 81 f9 96 f7 48 c7 c7 20 f9 23 8e 4c 89 e6 [ 482.194381][ C0] RSP: 0018:ffffc90000007a18 EFLAGS: 00010246 [ 482.200580][ C0] RAX: ffffffff89ee9cd3 RBX: ffffffff89ee8ad6 RCX: ffff888024691e00 [ 482.208688][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 482.216817][ C0] RBP: 0000000000000000 R08: ffff888024691e00 R09: 0000000000000003 [ 482.224927][ C0] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805e4123c0 [ 482.233025][ C0] R13: dffffc0000000000 R14: ffff88805e4128b0 R15: ffff88805ec9bc24 [ 482.241218][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 482.250281][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 482.257004][ C0] CR2: 00007f4d1682d948 CR3: 0000000061084000 CR4: 00000000003506f0 [ 482.265093][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 482.273208][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 482.281291][ C0] Call Trace: [ 482.284649][ C0] [ 482.287593][ C0] ? __ieee80211_beacon_get+0x36/0x1600 [ 482.293254][ C0] ieee80211_beacon_get_tim+0xb8/0x560 [ 482.298843][ C0] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 482.305748][ C0] mac80211_hwsim_beacon_tx+0x3c7/0x780 [ 482.311437][ C0] __iterate_interfaces+0x243/0x500 [ 482.316759][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2b0/0x2b0 [ 482.323158][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 482.330443][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2b0/0x2b0 [ 482.336769][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 482.343843][ C0] mac80211_hwsim_beacon+0xbb/0x1b0 [ 482.349095][ C0] __hrtimer_run_queues+0x51e/0xc40 [ 482.354305][ C0] ? hw_scan_work+0x1060/0x1060 [ 482.359210][ C0] ? hrtimer_interrupt+0x9c0/0x9c0 [ 482.364325][ C0] ? ktime_get_update_offsets_now+0x3d2/0x3f0 [ 482.370432][ C0] hrtimer_run_softirq+0x187/0x2b0 [ 482.375585][ C0] handle_softirqs+0x280/0x820 [ 482.380406][ C0] ? __irq_exit_rcu+0xc7/0x190 [ 482.385217][ C0] ? do_softirq+0x180/0x180 [ 482.389798][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 482.395024][ C0] __irq_exit_rcu+0xc7/0x190 [ 482.399660][ C0] ? irq_exit_rcu+0x20/0x20 [ 482.404179][ C0] irq_exit_rcu+0x9/0x20 [ 482.408508][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 482.414173][ C0] [ 482.417147][ C0] [ 482.420091][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 482.426116][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xa9/0x110 [ 482.432680][ C0] Code: 74 05 e8 3a e8 13 f7 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 82 52 e3 f6 65 8b 05 93 a8 8b 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 482.452545][ C0] RSP: 0018:ffffc90004cafa00 EFLAGS: 00000206 [ 482.458687][ C0] RAX: e0d829c449291b00 RBX: 0000000000000a02 RCX: e0d829c449291b00 [ 482.466784][ C0] RDX: dffffc0000000000 RSI: ffffffff8aaab2c0 RDI: 0000000000000001 [ 482.474783][ C0] RBP: ffffc90004cafa98 R08: ffffffff90da5627 R09: 1ffffffff21b4ac4 [ 482.482784][ C0] R10: dffffc0000000000 R11: fffffbfff21b4ac5 R12: dffffc0000000000 [ 482.490790][ C0] R13: ffff88802c4f5c18 R14: ffff88802c4f5c30 R15: 1ffff92000995f40 [ 482.498825][ C0] ? _raw_spin_unlock+0x40/0x40 [ 482.503696][ C0] snd_rawmidi_transmit+0x9c/0xc0 [ 482.508811][ C0] snd_vmidi_output_work+0x1a4/0x410 [ 482.514120][ C0] ? snd_virmidi_output_drain+0x70/0x70 [ 482.519717][ C0] ? preempt_schedule_thunk+0x1a/0x30 [ 482.525120][ C0] ? process_scheduled_works+0x957/0x15b0 [ 482.530959][ C0] ? process_scheduled_works+0x957/0x15b0 [ 482.536716][ C0] process_scheduled_works+0xa45/0x15b0 [ 482.542309][ C0] ? assign_work+0x400/0x400 [ 482.546936][ C0] ? assign_work+0x39e/0x400 [ 482.551538][ C0] worker_thread+0xa55/0xfc0 [ 482.556149][ C0] ? _raw_spin_unlock_irqrestore+0xae/0x110 [ 482.562073][ C0] ? _raw_spin_unlock+0x40/0x40 [ 482.566957][ C0] ? _raw_spin_unlock_irqrestore+0x86/0x110 [ 482.572906][ C0] kthread+0x2fa/0x390 [ 482.577002][ C0] ? pr_cont_work+0x560/0x560 [ 482.581690][ C0] ? kthread_blkcg+0xd0/0xd0 [ 482.586425][ C0] ret_from_fork+0x48/0x80 [ 482.590904][ C0] ? kthread_blkcg+0xd0/0xd0 [ 482.595505][ C0] ret_from_fork_asm+0x11/0x20 [ 482.600326][ C0] [ 482.603366][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 482.610666][ C0] CPU: 0 PID: 5937 Comm: kworker/0:2H Not tainted 6.6.96-syzkaller #0 [ 482.618822][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 482.628922][ C0] Workqueue: events_highpri snd_vmidi_output_work [ 482.635367][ C0] Call Trace: [ 482.638656][ C0] [ 482.641510][ C0] dump_stack_lvl+0x16c/0x230 [ 482.646201][ C0] ? show_regs_print_info+0x20/0x20 [ 482.651409][ C0] ? load_image+0x3b0/0x3b0 [ 482.656005][ C0] panic+0x2c0/0x710 [ 482.659903][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 482.664507][ C0] ? ret_from_fork_asm+0x11/0x20 [ 482.669455][ C0] __warn+0x2e0/0x470 [ 482.673457][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 482.679191][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 482.684937][ C0] report_bug+0x2be/0x4f0 [ 482.689278][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 482.695018][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 482.700741][ C0] ? __ieee80211_beacon_get+0x1235/0x1600 [ 482.706467][ C0] handle_bug+0xcf/0x120 [ 482.710731][ C0] exc_invalid_op+0x1a/0x50 [ 482.715246][ C0] asm_exc_invalid_op+0x1a/0x20 [ 482.720127][ C0] RIP: 0010:__ieee80211_beacon_get+0x1233/0x1600 [ 482.726494][ C0] Code: 24 4c 89 e7 e8 be 86 d5 f7 45 31 f6 4c 8b bc 24 a0 00 00 00 e9 7a fe ff ff e8 99 f9 96 f7 0f 0b e9 f6 f7 ff ff e8 8d f9 96 f7 <0f> 0b e9 48 fb ff ff e8 81 f9 96 f7 48 c7 c7 20 f9 23 8e 4c 89 e6 [ 482.746132][ C0] RSP: 0018:ffffc90000007a18 EFLAGS: 00010246 [ 482.752206][ C0] RAX: ffffffff89ee9cd3 RBX: ffffffff89ee8ad6 RCX: ffff888024691e00 [ 482.760193][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 482.768166][ C0] RBP: 0000000000000000 R08: ffff888024691e00 R09: 0000000000000003 [ 482.776141][ C0] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805e4123c0 [ 482.784110][ C0] R13: dffffc0000000000 R14: ffff88805e4128b0 R15: ffff88805ec9bc24 [ 482.792086][ C0] ? __ieee80211_beacon_get+0x36/0x1600 [ 482.797673][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 482.803409][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 482.809133][ C0] ? __ieee80211_beacon_get+0x36/0x1600 [ 482.814691][ C0] ieee80211_beacon_get_tim+0xb8/0x560 [ 482.820174][ C0] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 482.826949][ C0] mac80211_hwsim_beacon_tx+0x3c7/0x780 [ 482.832511][ C0] __iterate_interfaces+0x243/0x500 [ 482.837713][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2b0/0x2b0 [ 482.843965][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 482.851172][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2b0/0x2b0 [ 482.857440][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 482.864493][ C0] mac80211_hwsim_beacon+0xbb/0x1b0 [ 482.869700][ C0] __hrtimer_run_queues+0x51e/0xc40 [ 482.874905][ C0] ? hw_scan_work+0x1060/0x1060 [ 482.879767][ C0] ? hrtimer_interrupt+0x9c0/0x9c0 [ 482.885307][ C0] ? ktime_get_update_offsets_now+0x3d2/0x3f0 [ 482.891385][ C0] hrtimer_run_softirq+0x187/0x2b0 [ 482.896536][ C0] handle_softirqs+0x280/0x820 [ 482.901306][ C0] ? __irq_exit_rcu+0xc7/0x190 [ 482.906073][ C0] ? do_softirq+0x180/0x180 [ 482.910583][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 482.915791][ C0] __irq_exit_rcu+0xc7/0x190 [ 482.920394][ C0] ? irq_exit_rcu+0x20/0x20 [ 482.924928][ C0] irq_exit_rcu+0x9/0x20 [ 482.929174][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 482.934808][ C0] [ 482.937745][ C0] [ 482.940680][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 482.946672][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xa9/0x110 [ 482.953178][ C0] Code: 74 05 e8 3a e8 13 f7 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 82 52 e3 f6 65 8b 05 93 a8 8b 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 482.972787][ C0] RSP: 0018:ffffc90004cafa00 EFLAGS: 00000206 [ 482.978856][ C0] RAX: e0d829c449291b00 RBX: 0000000000000a02 RCX: e0d829c449291b00 [ 482.986839][ C0] RDX: dffffc0000000000 RSI: ffffffff8aaab2c0 RDI: 0000000000000001 [ 482.994813][ C0] RBP: ffffc90004cafa98 R08: ffffffff90da5627 R09: 1ffffffff21b4ac4 [ 483.002810][ C0] R10: dffffc0000000000 R11: fffffbfff21b4ac5 R12: dffffc0000000000 [ 483.010783][ C0] R13: ffff88802c4f5c18 R14: ffff88802c4f5c30 R15: 1ffff92000995f40 [ 483.018775][ C0] ? _raw_spin_unlock+0x40/0x40 [ 483.023640][ C0] snd_rawmidi_transmit+0x9c/0xc0 [ 483.028686][ C0] snd_vmidi_output_work+0x1a4/0x410 [ 483.033982][ C0] ? snd_virmidi_output_drain+0x70/0x70 [ 483.039531][ C0] ? preempt_schedule_thunk+0x1a/0x30 [ 483.044912][ C0] ? process_scheduled_works+0x957/0x15b0 [ 483.050637][ C0] ? process_scheduled_works+0x957/0x15b0 [ 483.056366][ C0] process_scheduled_works+0xa45/0x15b0 [ 483.061954][ C0] ? assign_work+0x400/0x400 [ 483.066559][ C0] ? assign_work+0x39e/0x400 [ 483.071162][ C0] worker_thread+0xa55/0xfc0 [ 483.075753][ C0] ? _raw_spin_unlock_irqrestore+0xae/0x110 [ 483.081647][ C0] ? _raw_spin_unlock+0x40/0x40 [ 483.086503][ C0] ? _raw_spin_unlock_irqrestore+0x86/0x110 [ 483.092411][ C0] kthread+0x2fa/0x390 [ 483.096485][ C0] ? pr_cont_work+0x560/0x560 [ 483.101174][ C0] ? kthread_blkcg+0xd0/0xd0 [ 483.105762][ C0] ret_from_fork+0x48/0x80 [ 483.110204][ C0] ? kthread_blkcg+0xd0/0xd0 [ 483.114795][ C0] ret_from_fork_asm+0x11/0x20 [ 483.119578][ C0] [ 483.122969][ C0] Kernel Offset: disabled [ 483.127347][ C0] Rebooting in 86400 seconds..