last executing test programs: 3.672908847s ago: executing program 2 (id=323): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="64000000020601080000a10000000005000400000000000900020073797a31000000001400078005001500020000000800124000000000050005000a0000000500010006000000160003"], 0x64}}, 0x0) syz_usb_connect$hid(0x2, 0x0, 0x0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x23, &(0x7f0000000400)=@string={0x23, 0x3, "b9298ebed18a3d7deb211cbfdb8fe5a8ddb5ceca76cb2f41c12e9170beccc210ec"}}]}) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="020d000014000000000000000000000005000500000000000a00000000000000f65e0190536134fc010000000000000000000000000000000000000000000005000500000000000a000000000000000000000000000000000000000000000000000000000000000800120002000200ff"], 0xa0}}, 0x0) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r0, 0x29, 0x40, &(0x7f00000001c0)=ANY=[@ANYBLOB="000a000000000fd60730000000000a0000000000000000000000000000000000000000000000000000000d00000000000000000000ef60fc4bd8ecc4e3200000000006004dee00000000000032acaace3269d47147"], 0xd0060) 3.078975607s ago: executing program 2 (id=332): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) exit(0x100000000000035) tkill(r0, 0x12) waitid(0x0, r0, 0x0, 0x100000e, 0x0) 2.159679322s ago: executing program 2 (id=350): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)={0x2c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x84}, 0x0) 2.058880209s ago: executing program 3 (id=351): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f00000000c0)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$bt_hci(r1, 0x84, 0x7d, 0x0, &(0x7f0000000100)) 1.983694135s ago: executing program 2 (id=352): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x37e, @private2={0xfc, 0x2, '\x00', 0x1}, 0x13}], 0x1c) setsockopt(r0, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000100), 0x4) recvmsg(r0, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) 1.983431025s ago: executing program 3 (id=353): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x4) write(r1, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) 1.920825905s ago: executing program 3 (id=356): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="000086dd0000120000000000000063b9e7a900480000fc0200800000000000af5897ac8800b69d00000000000001ff0200000000000000000500"], 0x7e) 1.748046183s ago: executing program 3 (id=359): futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc)=0x4, 0x10b, 0x4, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000040), &(0x7f0000048000), 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) exit(0x0) 1.610361459s ago: executing program 0 (id=362): syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100"], 0x16) syz_clone3(0x0, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_usb_connect(0x3, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="0405"], 0x7) 1.115047924s ago: executing program 2 (id=364): socket$unix(0x1, 0x1, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r0, &(0x7f0000000080)={0x2020}, 0x206e) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000040)={{@local, 0x2}, 0x4, 0x6, 0x0, 0x40}) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) 1.071113012s ago: executing program 0 (id=365): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000001240)={@val={0x8, 0xf7}, @val={0x7, 0x0, 0x0, 0x0, 0x14}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0x24, 0x66, 0x0, 0x40, 0x11, 0x0, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x3a}}, {0x4e20, 0x4e21, 0x10, 0x0, @gue={{0x2, 0x1, 0x0, 0x7, 0x100, @val=0x80}}}}}, 0x32) 1.060348351s ago: executing program 2 (id=366): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b000100001000090455070103490200090582030004"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00N\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x40, &(0x7f0000000480)=ANY=[]) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x0) 926.364473ms ago: executing program 0 (id=367): r0 = memfd_create(&(0x7f0000000000)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x1) pwrite64(r0, &(0x7f00000008c0)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f00000000c0)='./file0\x00') openat2$dir(0xffffffffffffff9c, &(0x7f0000000640)='./file0/file0/..\x00', &(0x7f0000000080)={0x200000, 0x0, 0x11}, 0x18) 895.93498ms ago: executing program 0 (id=368): r0 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r1) write$UHID_INPUT(r2, &(0x7f0000002080)={0x200f, {"20e30a30ed0d09f91b5e070987f70e06d038e7ff7fc6e5539b0d3e0e8b089b3f363063030890e0879b0af8c6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c526db51b1b5b31070d0773090acd3b78130daa61d8e8040001000000b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19300305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f6709000000a141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a027d5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf050000008000000000f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b3f3f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7af1d0e54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c01008e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2f5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d21488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e1a63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e09d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a603336c00000077cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046ca5b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe6531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e6586df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59555e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0d8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb601203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f900000930dedf800", 0x1000}}, 0x1006) write(r0, &(0x7f0000000040)="1c0000001a", 0x5) 861.153776ms ago: executing program 3 (id=369): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000140)=[@in={0x2, 0x0, @private=0xa018101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000001180)={0x1, [0x0]}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000000)=@sack_info={r2, 0x600000}, &(0x7f00000000c0)=0xc) 752.376011ms ago: executing program 0 (id=370): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) write$UHID_INPUT(r0, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3591bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22ebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed499cfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a", 0x1000}}, 0xb00) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x13, r0, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) 678.856547ms ago: executing program 0 (id=371): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000b7403340861a22753635f10203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000040)={0x1c, &(0x7f0000000080)=ANY=[@ANYBLOB="200302"], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 660.579861ms ago: executing program 1 (id=372): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000400)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "fc0300", 0x48, 0x2c, 0x0, @local, @mcast2, {[@fragment={0x3a}], @pkt_toobig={0x2, 0x0, 0x0, 0xd93f, {0x4, 0x6, '\x00', 0xf08, 0x11, 0xb9e02c7ea3376920, @ipv4={'\x00', '\xff\xff', @loopback}, @empty, [@dstopts={0x11, 0x0, '\x00', [@enc_lim={0x4, 0x1, 0x4}]}]}}}}}}, 0x7e) 513.401293ms ago: executing program 1 (id=373): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000340), 0x802, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000001c0)={{0x0, 0x0, 0xfffd, 0x8001}, 'syz1\x00'}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) write$uinput_user_dev(r0, &(0x7f0000000d80)={'syz1\x00', {0x9, 0x0, 0x6, 0x1}, 0x37b4, [0xfeff, 0x4, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x3, 0x100, 0x0, 0x5, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0xbffffffe, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3, 0xffffffff, 0xfffffffd, 0xffff, 0x2, 0x20, 0x3, 0x5, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x6, 0x0, 0x7, 0x0, 0x6, 0x0, 0x0, 0x20004, 0x0, 0x0, 0x105], [0x10, 0xffffffff, 0x7, 0x0, 0xffffffff, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x7, 0x0, 0x0, 0x0, 0xbb, 0x1, 0xfffffffc, 0x5, 0x7fc, 0x0, 0xfffffffc, 0x0, 0x1, 0x0, 0x3, 0x800ec6a, 0x5, 0x40000000, 0xffffffff, 0xfffffffc, 0x6ed8ec1a, 0xfffffffd, 0x7fffffff, 0xfffffffc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0xfffffffc, 0x0, 0x18c, 0x0, 0x0, 0x2, 0x5, 0x0, 0x100, 0x0, 0x100000, 0x0, 0x0, 0x4, 0x4000000, 0x80, 0x0, 0x80000, 0x0, 0x7, 0x800000, 0x7], [0x10000, 0x4, 0x0, 0x0, 0xffffffff, 0x1, 0xa000000, 0x0, 0x9, 0xffff7fff, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4f, 0x0, 0x2e270, 0xfffe, 0x0, 0x0, 0x520, 0xc, 0x0, 0x0, 0x9, 0x1ff, 0x0, 0xfffffffd, 0x0, 0xfffffffc, 0x401, 0x0, 0x9, 0x0, 0x10000, 0x3, 0x0, 0x0, 0x0, 0x6, 0x400, 0x0, 0x0, 0x0, 0x82ce, 0xe, 0x3, 0x0, 0x0, 0xff, 0x4000005, 0x0, 0x4, 0x2, 0x400000, 0x0, 0x6, 0x0, 0x0, 0x0, 0xb], [0x0, 0x0, 0x0, 0x7, 0x0, 0x401, 0x0, 0x211, 0x4, 0x0, 0x100, 0x2000003, 0x40, 0x0, 0x80, 0x0, 0x3, 0x0, 0x2, 0x5, 0x7fff, 0x0, 0xd, 0x800000, 0x0, 0x7, 0x0, 0x0, 0x4, 0x8000000, 0x0, 0x9, 0x3, 0x0, 0x0, 0x6, 0xbfb6, 0x4, 0x7, 0x3, 0x0, 0x0, 0x1, 0xffffffff, 0x100, 0x0, 0x6, 0x3, 0xfffffffd, 0x53591b27, 0x3fffffd, 0x0, 0x0, 0x5, 0x400, 0x7, 0x9, 0x0, 0x0, 0x80000000, 0x1000000, 0x0, 0x5]}, 0x45c) 428.033448ms ago: executing program 1 (id=374): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x7, 0x80000) close(r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000180)={0x1, r1}) 358.727598ms ago: executing program 1 (id=375): r0 = socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) splice(r2, 0x0, r1, 0x0, 0x7fffffffffffffff, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 244.219892ms ago: executing program 1 (id=376): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0) sendmsg$NL802154_CMD_NEW_SEC_KEY(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={0x28, r3, 0x5eae78d9c54e9d3f, 0x0, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SEC_KEY={0xc, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xa}]}]}, 0x28}}, 0x200440c4) 138.35244ms ago: executing program 1 (id=377): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x0, 0xb8, &(0x7f0000000e00)={{0x12, 0x1, 0x300, 0x6a, 0xd2, 0xfd, 0x40, 0x1199, 0x9007, 0xf5d6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa6, 0x1, 0xe, 0x0, 0x20, 0xeb, [{{0x9, 0x4, 0x0, 0x1, 0x0, 0xdf, 0x6e, 0x9c, 0x5, [@cdc_ecm={{0x5}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0xd, 0xe, 0xb, 0x81}, [@network_terminal={0x7, 0x24, 0xa, 0x3, 0x7, 0x7, 0xff}, @dmm={0x7, 0x24, 0x14, 0xfffa, 0x4a60}, @dmm={0x7, 0x24, 0x14, 0x4, 0x8000}, @mdlm_detail={0x62, 0x24, 0x13, 0x3d, "86d412af81430637a5af65020818b3a485eb70e3d636d879addc4a8251429851531f7f6b9bf076e1429eb39d7601891e374e66c7cc9ded050df8a7932ed7ea5becf5e9157b39fa20884b634216f9e4c0dda334dede7f233bb9a7abfa7018"}, @ncm={0x6, 0x24, 0x1a, 0x6, 0x6}]}]}}]}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f0000000500)={0x2c, &(0x7f0000000340)={0x20, 0x3, 0x2, {0x2, 0xa}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0xfffffdf6, &(0x7f0000000200)="b9425b44651dd23241963599000000110000004a16941ff5f4b4f1f0add7fcf2b877fceafffffffffff1ffdf4cd9f5d3969890522c77157d88010000003a5bd5531d459dffff03000000000091ff000000e8f5b3371da3635b8b4fa637135800001f65e4b436aa9e50bc0f19b7d3372ff9ebcede1fb5e9428f54d5d1f0cc752cf246a5d2da34a5aa97dc14a469c3dd3e26b41c7807e8773eed7b94fa099ab84feadec2ea95f67aba452eae5b0900f98a979a88c517a2dc360a00237723e2f467af706ea17226296b3a10a351cb47aba2c6b836c90679b4dd859ddc9e9b8e4fb4634f8d4c0000000d75f34bb50d8f7084000000000000000000") 0s ago: executing program 3 (id=378): openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000340)={0x2c, &(0x7f0000000240)={0x0, 0x10, 0x2, "23e6"}, 0x0, 0x0, 0x0, 0x0}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) write$bt_hci(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="0000020008"], 0xe) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.60' (ED25519) to the list of known hosts. [ 67.465830][ T5813] cgroup: Unknown subsys name 'net' [ 67.581695][ T5813] cgroup: Unknown subsys name 'cpuset' [ 67.590300][ T5813] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 69.037773][ T5813] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.124626][ T5837] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 71.133395][ T5837] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 71.143191][ T5837] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 71.151427][ T5837] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 71.159487][ T5837] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 71.168420][ T5837] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 71.172990][ T5842] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 71.176174][ T5837] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 71.184193][ T5842] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 71.198220][ T5837] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 71.198388][ T5842] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 71.208879][ T5147] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 71.214071][ T5842] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 71.222210][ T5147] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 71.229365][ T5842] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 71.235619][ T5147] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 71.241992][ T5842] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 71.257247][ T5147] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 71.260033][ T5842] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 71.272964][ T5147] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 71.398049][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.404746][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.764716][ T5829] chnl_net:caif_netlink_parms(): no params data found [ 71.903239][ T5824] chnl_net:caif_netlink_parms(): no params data found [ 71.959328][ T5826] chnl_net:caif_netlink_parms(): no params data found [ 71.971637][ T5825] chnl_net:caif_netlink_parms(): no params data found [ 72.102716][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.110712][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.118269][ T5829] bridge_slave_0: entered allmulticast mode [ 72.125638][ T5829] bridge_slave_0: entered promiscuous mode [ 72.155286][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.162609][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.169950][ T5829] bridge_slave_1: entered allmulticast mode [ 72.177055][ T5829] bridge_slave_1: entered promiscuous mode [ 72.207500][ T5824] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.214873][ T5824] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.223231][ T5824] bridge_slave_0: entered allmulticast mode [ 72.230691][ T5824] bridge_slave_0: entered promiscuous mode [ 72.270158][ T5824] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.277694][ T5824] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.285185][ T5824] bridge_slave_1: entered allmulticast mode [ 72.293062][ T5824] bridge_slave_1: entered promiscuous mode [ 72.344430][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.354036][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.362048][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.369617][ T5826] bridge_slave_0: entered allmulticast mode [ 72.376822][ T5826] bridge_slave_0: entered promiscuous mode [ 72.384735][ T5825] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.393484][ T5825] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.401300][ T5825] bridge_slave_0: entered allmulticast mode [ 72.409339][ T5825] bridge_slave_0: entered promiscuous mode [ 72.432160][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.442186][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.450400][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.458639][ T5826] bridge_slave_1: entered allmulticast mode [ 72.466089][ T5826] bridge_slave_1: entered promiscuous mode [ 72.473828][ T5825] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.482088][ T5825] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.490931][ T5825] bridge_slave_1: entered allmulticast mode [ 72.498933][ T5825] bridge_slave_1: entered promiscuous mode [ 72.510563][ T5824] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.554648][ T5824] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.607034][ T5829] team0: Port device team_slave_0 added [ 72.615699][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.629888][ T5825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.652421][ T5829] team0: Port device team_slave_1 added [ 72.660387][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.672459][ T5825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.685948][ T5824] team0: Port device team_slave_0 added [ 72.729229][ T5824] team0: Port device team_slave_1 added [ 72.773703][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.781725][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.810219][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.824422][ T5826] team0: Port device team_slave_0 added [ 72.835046][ T5826] team0: Port device team_slave_1 added [ 72.843602][ T5825] team0: Port device team_slave_0 added [ 72.860457][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.867871][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.894743][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.916558][ T5825] team0: Port device team_slave_1 added [ 72.923630][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.931115][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.958428][ T5824] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.992389][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.000279][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.027975][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.051096][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.058099][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.084448][ T5824] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.097426][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.104522][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.132149][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.170900][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.180502][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.207919][ T5825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.220782][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.227893][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.255992][ T5825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.308105][ T5840] Bluetooth: hci1: command tx timeout [ 73.308406][ T5147] Bluetooth: hci3: command tx timeout [ 73.314154][ T51] Bluetooth: hci0: command tx timeout [ 73.319829][ T5842] Bluetooth: hci2: command tx timeout [ 73.358244][ T5829] hsr_slave_0: entered promiscuous mode [ 73.365211][ T5829] hsr_slave_1: entered promiscuous mode [ 73.412720][ T5825] hsr_slave_0: entered promiscuous mode [ 73.420141][ T5825] hsr_slave_1: entered promiscuous mode [ 73.427132][ T5825] debugfs: 'hsr0' already exists in 'hsr' [ 73.433975][ T5825] Cannot create hsr debugfs directory [ 73.446271][ T5824] hsr_slave_0: entered promiscuous mode [ 73.453125][ T5824] hsr_slave_1: entered promiscuous mode [ 73.459733][ T5824] debugfs: 'hsr0' already exists in 'hsr' [ 73.465883][ T5824] Cannot create hsr debugfs directory [ 73.476480][ T5826] hsr_slave_0: entered promiscuous mode [ 73.483207][ T5826] hsr_slave_1: entered promiscuous mode [ 73.490024][ T5826] debugfs: 'hsr0' already exists in 'hsr' [ 73.495858][ T5826] Cannot create hsr debugfs directory [ 73.986692][ T5829] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 74.019049][ T5829] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 74.033991][ T5829] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 74.057105][ T5829] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 74.120957][ T5826] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 74.131990][ T5826] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 74.143428][ T5826] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 74.183142][ T5826] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 74.258353][ T5825] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 74.278479][ T5825] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 74.301103][ T5825] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 74.330590][ T5825] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 74.435304][ T5824] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 74.452898][ T5824] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 74.463826][ T5824] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 74.474436][ T5824] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 74.541878][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.584987][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.605062][ T5829] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.626221][ T3552] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.633542][ T3552] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.663034][ T3552] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.670402][ T3552] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.694731][ T5826] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.734824][ T3552] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.742382][ T3552] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.752602][ T3552] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.759737][ T3552] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.773858][ T5825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.853007][ T5825] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.870931][ T5824] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.897143][ T3073] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.904397][ T3073] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.934396][ T1004] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.941609][ T1004] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.966014][ T5824] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.008789][ T1004] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.015980][ T1004] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.064127][ T3073] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.071476][ T3073] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.225432][ T5824] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 75.251452][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.293043][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.389905][ T5842] Bluetooth: hci2: command tx timeout [ 75.389924][ T51] Bluetooth: hci0: command tx timeout [ 75.389949][ T51] Bluetooth: hci3: command tx timeout [ 75.395366][ T5147] Bluetooth: hci1: command tx timeout [ 75.472144][ T5829] veth0_vlan: entered promiscuous mode [ 75.523621][ T5829] veth1_vlan: entered promiscuous mode [ 75.598337][ T5826] veth0_vlan: entered promiscuous mode [ 75.623079][ T5825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.636631][ T5829] veth0_macvtap: entered promiscuous mode [ 75.654036][ T5826] veth1_vlan: entered promiscuous mode [ 75.664040][ T5829] veth1_macvtap: entered promiscuous mode [ 75.691412][ T5824] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.712694][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.735625][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.758945][ T3552] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.769781][ T3552] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.782611][ T3552] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.793284][ T3552] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.816703][ T5826] veth0_macvtap: entered promiscuous mode [ 75.861937][ T5826] veth1_macvtap: entered promiscuous mode [ 75.875586][ T5825] veth0_vlan: entered promiscuous mode [ 75.915839][ T5825] veth1_vlan: entered promiscuous mode [ 75.939701][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.988786][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.999445][ T5824] veth0_vlan: entered promiscuous mode [ 76.008522][ T1004] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.016475][ T1004] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.042116][ T3552] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.055193][ T3552] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.076590][ T3552] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.085536][ T3552] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.111980][ T5825] veth0_macvtap: entered promiscuous mode [ 76.123987][ T5824] veth1_vlan: entered promiscuous mode [ 76.139200][ T5825] veth1_macvtap: entered promiscuous mode [ 76.147426][ T3552] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.155770][ T3552] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.242098][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.243009][ T5829] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 76.295434][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.314197][ T1004] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.338019][ T1004] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.393834][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.403409][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.431387][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.439284][ T5914] syz.1.2 uses obsolete (PF_INET,SOCK_PACKET) [ 76.440722][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.464203][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.483695][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.496078][ T5824] veth0_macvtap: entered promiscuous mode [ 76.548444][ T5824] veth1_macvtap: entered promiscuous mode [ 76.613894][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.700381][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.734151][ T1004] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.743881][ T1004] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.755044][ T1004] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.763998][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.800281][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.816805][ T1004] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.899499][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.920974][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.117062][ T3073] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.153568][ T3073] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.262274][ T145] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.284707][ T145] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.472870][ T5842] Bluetooth: hci2: command tx timeout [ 77.472900][ T5840] Bluetooth: hci0: command tx timeout [ 77.479587][ T5147] Bluetooth: hci1: command tx timeout [ 77.487927][ T51] Bluetooth: hci3: command tx timeout [ 77.781399][ T5941] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 78.641097][ T5961] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 78.818364][ T29] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 79.012600][ T29] usb 3-1: Using ep0 maxpacket: 32 [ 79.031431][ T29] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 79.045145][ T29] usb 3-1: config 0 has no interface number 0 [ 79.052082][ T29] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 79.106064][ T29] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 79.132410][ T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.141171][ T29] usb 3-1: Product: syz [ 79.145400][ T29] usb 3-1: Manufacturer: syz [ 79.161522][ T29] usb 3-1: SerialNumber: syz [ 79.182103][ T29] usb 3-1: config 0 descriptor?? [ 79.209957][ T29] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 79.220079][ T29] em28xx 3-1:0.132: Video interface 132 found: [ 79.547549][ T51] Bluetooth: hci1: command tx timeout [ 79.547688][ T5147] Bluetooth: hci2: command tx timeout [ 79.553834][ T5840] Bluetooth: hci3: command tx timeout [ 79.559143][ T5842] Bluetooth: hci0: command tx timeout [ 79.602312][ T29] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 80.012935][ T29] em28xx 3-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 80.062597][ T29] em28xx 3-1:0.132: board has no eeprom [ 80.137275][ T29] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 80.167281][ T29] em28xx 3-1:0.132: analog set to bulk mode. [ 80.178506][ T5866] em28xx 3-1:0.132: Registering V4L2 extension [ 80.219251][ T5996] vxcan0: tx address claim with different name [ 80.226935][ T29] usb 3-1: USB disconnect, device number 2 [ 80.264060][ T29] em28xx 3-1:0.132: Disconnecting em28xx [ 80.437889][ T6008] warning: `syz.1.37' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 80.455167][ T5866] em28xx 3-1:0.132: Config register raw data: 0xffffffed [ 80.462728][ T5866] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 80.469926][ T5866] em28xx 3-1:0.132: No AC97 audio processor [ 80.479862][ T5866] usb 3-1: Decoder not found [ 80.484496][ T5866] em28xx 3-1:0.132: failed to create media graph [ 80.491348][ T5866] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 80.520221][ T5866] em28xx 3-1:0.132: Remote control support is not available for this card. [ 80.545028][ T29] em28xx 3-1:0.132: Closing input extension [ 80.573583][ T29] em28xx 3-1:0.132: Freeing device [ 80.585570][ T6011] input: syz0 as /devices/virtual/input/input5 [ 80.944823][ T6026] netlink: 'syz.1.42': attribute type 39 has an invalid length. [ 81.311463][ T6045] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.49'. [ 81.472885][ T5912] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 81.637428][ T5912] usb 1-1: Using ep0 maxpacket: 32 [ 81.676832][ T5912] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 81.686009][ T5912] usb 1-1: config 0 has no interface number 0 [ 81.700222][ T5912] usb 1-1: config 0 interface 184 has no altsetting 0 [ 81.721262][ T5912] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 81.747298][ T5912] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.774077][ T5912] usb 1-1: Product: syz [ 81.796955][ T5912] usb 1-1: Manufacturer: syz [ 81.806102][ T5912] usb 1-1: SerialNumber: syz [ 81.835578][ T5912] usb 1-1: config 0 descriptor?? [ 81.862964][ T5912] smsc75xx v1.0.0 [ 82.279783][ T6072] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input6 [ 82.470996][ T5912] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 82.495075][ T5912] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 82.689391][ T6079] binder: 6078:6079 ioctl c0306201 200000001a80 returned -14 [ 82.719279][ T5912] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 82.757468][ T5912] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 82.767740][ T5912] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 82.789625][ T5912] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 82.817532][ T5912] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 82.848138][ T5912] usb 1-1: USB disconnect, device number 2 [ 83.068156][ T5866] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 83.074710][ T6103] loop8: detected capacity change from 0 to 8 [ 83.084241][ T6101] kvm: user requested TSC rate below hardware speed [ 83.092333][ T6103] Dev loop8: unable to read RDB block 8 [ 83.100217][ T6103] loop8: unable to read partition table [ 83.106591][ T6103] loop8: partition table beyond EOD, truncated [ 83.116540][ T6103] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 83.251851][ T5866] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 83.277301][ T5866] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 83.291436][ T5866] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 83.317702][ T5866] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 83.353941][ T5866] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 83.384031][ T5866] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 83.413906][ T5866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 83.435935][ T5866] usb 2-1: Product: syz [ 83.444990][ T5866] usb 2-1: Manufacturer: syz [ 83.455111][ T5866] usb 2-1: SerialNumber: syz [ 83.478637][ T5866] usb 2-1: config 0 descriptor?? [ 83.714784][ T5866] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 83.727313][ T5866] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 83.852483][ T6120] ./file0: Can't open blockdev [ 83.923861][ T5866] radio-si470x 2-1:0.0: software version 0, hardware version 0 [ 83.957028][ T5866] radio-si470x 2-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 83.975803][ T5866] radio-si470x 2-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 84.003604][ T6134] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 84.124439][ T5866] radio-si470x 2-1:0.0: submitting int urb failed (-90) [ 84.217780][ T6136] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 84.224315][ T6136] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 84.237083][ T6136] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 84.248154][ T6136] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 84.254198][ T6136] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 84.262866][ T6136] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 84.272086][ T6136] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 84.279392][ T6136] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 84.286851][ T6136] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 84.295456][ T6136] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 84.303007][ T6136] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 84.312916][ T6136] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 84.413375][ T6150] process 'syz.0.93' launched './file1' with NULL argv: empty string added [ 84.429001][ T6150] ======================================================= [ 84.429001][ T6150] WARNING: The mand mount option has been deprecated and [ 84.429001][ T6150] and is ignored by this kernel. Remove the mand [ 84.429001][ T6150] option from the mount to silence this warning. [ 84.429001][ T6150] ======================================================= [ 84.527061][ T5866] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 84.541706][ T5866] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -22 [ 84.557364][ T5912] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 84.559012][ T5866] usb 2-1: USB disconnect, device number 2 [ 84.717341][ T5912] usb 3-1: Using ep0 maxpacket: 16 [ 84.725407][ T5912] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 84.735735][ T5912] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 84.746545][ T5912] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 84.770234][ T5912] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 84.783181][ T5912] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.792707][ T5912] usb 3-1: Product: syz [ 84.797748][ T5912] usb 3-1: Manufacturer: syz [ 84.802643][ T5912] usb 3-1: SerialNumber: syz [ 85.037411][ T29] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 85.190832][ T29] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 85.205851][ T29] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 85.219356][ T5912] usb 3-1: 0:2 : does not exist [ 85.219440][ T29] usb 1-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 85.243906][ T29] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 85.254943][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.264714][ T29] usb 1-1: Product: syz [ 85.279061][ T29] usb 1-1: Manufacturer: syz [ 85.284095][ T29] usb 1-1: SerialNumber: syz [ 85.308623][ T6165] IPv6: NLM_F_CREATE should be specified when creating new route [ 85.318294][ T6165] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 85.326011][ T6165] IPv6: NLM_F_CREATE should be set when creating new route [ 85.333600][ T6165] IPv6: NLM_F_CREATE should be set when creating new route [ 85.348675][ T6165] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 85.740055][ T6178] syzkaller1: entered promiscuous mode [ 85.745789][ T6178] syzkaller1: entered allmulticast mode [ 85.839320][ T5912] usb 3-1: 1:0: failed to get current value for ch 0 (-22) [ 85.940043][ T5912] usb 3-1: USB disconnect, device number 3 [ 86.009222][ T5839] udevd[5839]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 86.187366][ T5840] Bluetooth: hci0: command 0x0c1a tx timeout [ 86.256520][ T6186] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 86.268743][ T5840] Bluetooth: hci2: command 0x0c1a tx timeout [ 86.318208][ T29] cdc_ncm 1-1:1.0: bind() failure [ 86.331883][ T29] cdc_ncm 1-1:1.1: probe with driver cdc_ncm failed with error -71 [ 86.342512][ T29] cdc_mbim 1-1:1.1: probe with driver cdc_mbim failed with error -71 [ 86.352451][ T5840] Bluetooth: hci1: command 0x0c1a tx timeout [ 86.353391][ T51] Bluetooth: hci3: command 0x0c1a tx timeout [ 86.372339][ T29] usbtest 1-1:1.1: probe with driver usbtest failed with error -71 [ 86.390036][ T29] usb 1-1: USB disconnect, device number 3 [ 86.758693][ T911] cfg80211: failed to load regulatory.db [ 86.889874][ T6204] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 87.128677][ T29] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 87.250892][ T6224] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 87.297693][ T6224] CIFS mount error: No usable UNC path provided in device string! [ 87.297693][ T6224] [ 87.313180][ T29] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 87.323527][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.341427][ T6224] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 87.357486][ T29] usb 2-1: Product: syz [ 87.365295][ T29] usb 2-1: Manufacturer: syz [ 87.371521][ T29] usb 2-1: SerialNumber: syz [ 87.391888][ T29] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 87.420869][ T911] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 87.833779][ T6242] syzkaller1: entered promiscuous mode [ 87.839511][ T6242] syzkaller1: entered allmulticast mode [ 87.880522][ T795] usb 2-1: USB disconnect, device number 3 [ 88.178992][ T6255] input: syz1 as /devices/virtual/input/input7 [ 88.193367][ T6255] input: failed to attach handler leds to device input7, error: -6 [ 88.268047][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 88.350049][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 88.429296][ T51] Bluetooth: hci3: command 0x0c1a tx timeout [ 88.429312][ T5840] Bluetooth: hci1: command 0x0c1a tx timeout [ 88.507304][ T911] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 88.514669][ T911] ath9k_htc: Failed to initialize the device [ 88.550779][ T795] usb 2-1: ath9k_htc: USB layer deinitialized [ 88.756583][ T6278] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993 [ 89.258046][ T795] IPVS: starting estimator thread 0... [ 89.367599][ T6304] IPVS: using max 33 ests per chain, 79200 per kthread [ 89.782896][ T6322] syzkaller1: entered promiscuous mode [ 89.808438][ T6322] syzkaller1: entered allmulticast mode [ 90.043419][ T6332] input: syz1 as /devices/virtual/input/input8 [ 90.201279][ T6338] netlink: 'syz.3.181': attribute type 29 has an invalid length. [ 90.252592][ T6338] netlink: 'syz.3.181': attribute type 29 has an invalid length. [ 90.283940][ T6338] netlink: 44 bytes leftover after parsing attributes in process `syz.3.181'. [ 90.347523][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 90.427433][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 90.508710][ T51] Bluetooth: hci1: command 0x0c1a tx timeout [ 90.508768][ T5840] Bluetooth: hci3: command 0x0c1a tx timeout [ 91.376550][ T6389] capability: warning: `syz.2.203' uses deprecated v2 capabilities in a way that may be insecure [ 92.104017][ T6408] bridge0: entered allmulticast mode [ 92.119761][ T6408] bridge0: left allmulticast mode [ 92.312485][ T6419] kvm: kvm [6417]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010001) = 0x9 [ 92.639562][ T6432] netlink: 132 bytes leftover after parsing attributes in process `syz.3.222'. [ 93.817364][ T5830] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 93.977485][ T5830] usb 3-1: Using ep0 maxpacket: 32 [ 93.988303][ T5830] usb 3-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 93.998306][ T5830] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.021956][ T5830] usb 3-1: config 0 descriptor?? [ 94.040759][ T5830] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 94.190863][ T6505] netlink: 108 bytes leftover after parsing attributes in process `syz.0.255'. [ 94.201899][ T6505] netlink: 72 bytes leftover after parsing attributes in process `syz.0.255'. [ 94.523739][ T6518] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 95.078157][ T5830] gspca_vc032x: reg_w err -71 [ 95.082866][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.097272][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.102599][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.117265][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.122686][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.128829][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.134234][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.139987][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.145384][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.151478][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.156776][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.163422][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.169027][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.174413][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.181805][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.187119][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.194088][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.199947][ T5830] gspca_vc032x: I2c Bus Busy Wait 00 [ 95.205362][ T5830] gspca_vc032x: Unknown sensor... [ 95.211062][ T5830] vc032x 3-1:0.0: probe with driver vc032x failed with error -22 [ 95.230232][ T5830] usb 3-1: USB disconnect, device number 4 [ 95.947746][ T6557] loop2: detected capacity change from 0 to 7 [ 95.966371][ T5841] loop2: [POWERTEC] p1 [ 95.970879][ T5841] loop2: p1 start 1819500397 is beyond EOD, truncated [ 95.982611][ T6557] loop2: [POWERTEC] p1 [ 95.991342][ T6557] loop2: p1 start 1819500397 is beyond EOD, truncated [ 96.047768][ T6559] netlink: 4 bytes leftover after parsing attributes in process `syz.0.280'. [ 96.251733][ T6567] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 96.694189][ T6584] batadv_slave_0: entered promiscuous mode [ 96.710484][ T6584] batadv_slave_0: left promiscuous mode [ 96.728011][ T5912] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 96.887355][ T5912] usb 1-1: Using ep0 maxpacket: 8 [ 96.914852][ T5912] usb 1-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 96.937264][ T5912] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.954119][ T5912] usb 1-1: Product: syz [ 96.958606][ T5912] usb 1-1: Manufacturer: syz [ 96.963597][ T5912] usb 1-1: SerialNumber: syz [ 96.999824][ T5912] usb 1-1: config 0 descriptor?? [ 97.030180][ T5912] gspca_main: se401-2.14.0 probing 047d:5003 [ 97.608797][ T5912] usb 1-1: reset high-speed USB device number 4 using dummy_hcd [ 97.778800][ T5912] usb 1-1: device firmware changed [ 97.791021][ T5912] gspca_se401: read req failed req 0x06 error -19 [ 97.803388][ T5912] usb 1-1: USB disconnect, device number 4 [ 97.957855][ T5912] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 98.016425][ T30] audit: type=1326 audit(1769262914.740:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6618 comm="syz.3.307" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9f1059acb9 code=0x0 [ 98.151401][ T5912] usb 1-1: Using ep0 maxpacket: 8 [ 98.162307][ T5912] usb 1-1: string descriptor 0 read error: -22 [ 98.168871][ T5912] usb 1-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 98.178036][ T5912] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.193813][ T5912] usb 1-1: config 0 descriptor?? [ 98.204244][ T5912] gspca_main: se401-2.14.0 probing 047d:5003 [ 98.363751][ T6628] input: syz1 as /devices/virtual/input/input9 [ 98.627708][ T5912] gspca_se401: Wrong descriptor type [ 98.869919][ T5912] usb 1-1: USB disconnect, device number 5 [ 99.823019][ T6664] input: syz1 as /devices/virtual/input/input10 [ 99.829662][ T6664] input: failed to attach handler leds to device input10, error: -6 [ 100.242711][ T6678] 9pnet: p9_errstr2errno: server reported unknown error ÿÿÿÿ [ 100.282632][ T6684] binder: 6683:6684 ioctl c0306201 200000000480 returned -14 [ 100.495066][ T6697] Invalid argument reading file caps for ./file0 [ 100.691504][ T6705] netlink: 'syz.0.345': attribute type 11 has an invalid length. [ 101.270209][ T6729] syzkaller1: entered promiscuous mode [ 101.275984][ T6729] syzkaller1: entered allmulticast mode [ 102.061658][ T5840] Bluetooth: hci0: adv larger than maximum supported [ 102.123306][ T6750] syzkaller1: entered promiscuous mode [ 102.136046][ T6750] syzkaller1: entered allmulticast mode [ 102.357395][ T29] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 102.508153][ T29] usb 3-1: Using ep0 maxpacket: 32 [ 102.521516][ T29] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 102.530487][ T29] usb 3-1: config 0 has no interface number 0 [ 102.540165][ T29] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 102.558532][ T29] usb 3-1: config 0 interface 85 has no altsetting 0 [ 102.567976][ T29] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 102.577098][ T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.585335][ T29] usb 3-1: Product: syz [ 102.589603][ T29] usb 3-1: Manufacturer: syz [ 102.594753][ T29] usb 3-1: SerialNumber: syz [ 102.601846][ T29] usb 3-1: config 0 descriptor?? [ 102.658692][ T6768] input: syz1 as /devices/virtual/input/input12 [ 102.677330][ T5881] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 102.841372][ T5881] usb 1-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 102.850949][ T5881] usb 1-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 102.860224][ T5881] usb 1-1: Product: syz [ 102.864585][ T5881] usb 1-1: Manufacturer: syz [ 102.870062][ T5881] usb 1-1: SerialNumber: syz [ 102.879977][ T5881] usb 1-1: config 0 descriptor?? [ 102.892192][ T5881] ch341 1-1:0.0: ch341-uart converter detected [ 103.214998][ T29] appletouch 3-1:0.85: Geyser mode initialized. [ 103.223354][ T29] input: appletouch as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.85/input/input11 [ 103.232999][ T5866] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 103.390490][ T5866] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 103.403383][ T5866] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 103.413014][ T5866] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.421267][ T5830] usb 3-1: USB disconnect, device number 5 [ 103.434426][ T5866] usb 2-1: config 0 descriptor?? [ 103.461862][ T5830] appletouch 3-1:0.85: input: appletouch disconnected [ 103.547477][ T51] ================================================================== [ 103.549083][ T5840] Bluetooth: hci1: command 0x0c1a tx timeout [ 103.555676][ T51] BUG: KASAN: slab-use-after-free in hci_conn_drop+0x34/0x2a0 [ 103.555704][ T51] Write of size 4 at addr ffff88805b8f4010 by task kworker/u9:0/51 [ 103.555716][ T51] [ 103.555743][ T51] CPU: 1 UID: 0 PID: 51 Comm: kworker/u9:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 103.555762][ T51] Tainted: [L]=SOFTLOCKUP [ 103.555768][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 103.555778][ T51] Workqueue: hci1 hci_cmd_sync_work [ 103.555809][ T51] Call Trace: [ 103.555816][ T51] [ 103.555823][ T51] dump_stack_lvl+0xe8/0x150 [ 103.555842][ T51] print_report+0xba/0x230 [ 103.555860][ T51] ? hci_conn_drop+0x34/0x2a0 [ 103.555879][ T51] kasan_report+0x117/0x150 [ 103.555892][ T51] ? hci_conn_valid+0x21/0x230 [ 103.555905][ T51] ? hci_conn_drop+0x34/0x2a0 [ 103.555925][ T51] kasan_check_range+0x264/0x2c0 [ 103.555940][ T51] hci_conn_drop+0x34/0x2a0 [ 103.555959][ T51] ? __pfx_le_read_features_complete+0x10/0x10 [ 103.555978][ T51] hci_cmd_sync_work+0x262/0x400 [ 103.555999][ T51] ? process_one_work+0x87c/0x15a0 [ 103.556016][ T51] process_one_work+0x949/0x15a0 [ 103.556040][ T51] ? __pfx_process_one_work+0x10/0x10 [ 103.556056][ T51] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.556075][ T51] ? assign_work+0x3d5/0x5e0 [ 103.556094][ T51] worker_thread+0x9af/0xee0 [ 103.556121][ T51] kthread+0x388/0x470 [ 103.556135][ T51] ? __pfx_worker_thread+0x10/0x10 [ 103.556151][ T51] ? __pfx_kthread+0x10/0x10 [ 103.556165][ T51] ret_from_fork+0x51b/0xa40 [ 103.556185][ T51] ? __pfx_ret_from_fork+0x10/0x10 [ 103.556201][ T51] ? __switch_to+0xc7d/0x1400 [ 103.556216][ T51] ? __pfx_kthread+0x10/0x10 [ 103.556230][ T51] ret_from_fork_asm+0x1a/0x30 [ 103.556254][ T51] [ 103.556259][ T51] [ 103.739757][ T51] Allocated by task 5840: [ 103.744279][ T51] kasan_save_track+0x3e/0x80 [ 103.748963][ T51] __kasan_kmalloc+0x93/0xb0 [ 103.753556][ T51] __kmalloc_cache_noprof+0x31c/0x660 [ 103.758968][ T51] __hci_conn_add+0x3c4/0x1e00 [ 103.763712][ T51] le_conn_complete_evt+0x706/0x1430 [ 103.768980][ T51] hci_le_conn_complete_evt+0x187/0x470 [ 103.774549][ T51] hci_event_packet+0x7af/0x12c0 [ 103.779918][ T51] hci_rx_work+0x3ee/0x1030 [ 103.784417][ T51] process_one_work+0x949/0x15a0 [ 103.789529][ T51] worker_thread+0x9af/0xee0 [ 103.794199][ T51] kthread+0x388/0x470 [ 103.798312][ T51] ret_from_fork+0x51b/0xa40 [ 103.802894][ T51] ret_from_fork_asm+0x1a/0x30 [ 103.807655][ T51] [ 103.809958][ T51] Freed by task 5840: [ 103.814000][ T51] kasan_save_track+0x3e/0x80 [ 103.818835][ T51] kasan_save_free_info+0x46/0x50 [ 103.823852][ T51] __kasan_slab_free+0x5c/0x80 [ 103.828615][ T51] kfree+0x1c1/0x610 [ 103.832507][ T51] device_release+0x9e/0x1d0 [ 103.837081][ T51] kobject_put+0x228/0x560 [ 103.841480][ T51] hci_conn_del+0xc36/0x1230 [ 103.846053][ T51] hci_disconn_complete_evt+0x64e/0x950 [ 103.851584][ T51] hci_event_packet+0x805/0x12c0 [ 103.856592][ T51] hci_rx_work+0x3ee/0x1030 [ 103.861202][ T51] process_one_work+0x949/0x15a0 [ 103.866213][ T51] worker_thread+0x9af/0xee0 [ 103.870786][ T51] kthread+0x388/0x470 [ 103.874834][ T51] ret_from_fork+0x51b/0xa40 [ 103.879405][ T51] ret_from_fork_asm+0x1a/0x30 [ 103.884156][ T51] [ 103.886636][ T51] The buggy address belongs to the object at ffff88805b8f4000 [ 103.886636][ T51] which belongs to the cache kmalloc-8k of size 8192 [ 103.900775][ T51] The buggy address is located 16 bytes inside of [ 103.900775][ T51] freed 8192-byte region [ffff88805b8f4000, ffff88805b8f6000) [ 103.915012][ T51] [ 103.917427][ T51] The buggy address belongs to the physical page: [ 103.923857][ T51] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5b8f0 [ 103.932618][ T51] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 103.941626][ T51] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 103.949167][ T51] page_type: f5(slab) [ 103.953167][ T51] raw: 00fff00000000040 ffff88813ffa7280 dead000000000100 dead000000000122 [ 103.961729][ T51] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 103.970301][ T51] head: 00fff00000000040 ffff88813ffa7280 dead000000000100 dead000000000122 [ 103.978982][ T51] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 103.987635][ T51] head: 00fff00000000003 ffffea00016e3c01 00000000ffffffff 00000000ffffffff [ 103.996287][ T51] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 104.005025][ T51] page dumped because: kasan: bad access detected [ 104.011429][ T51] page_owner tracks the page as allocated [ 104.017221][ T51] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP), pid 5826, tgid 5826 (syz-executor), ts 74191974656, free_ts 23661619836 [ 104.036908][ T51] post_alloc_hook+0x231/0x280 [ 104.041661][ T51] get_page_from_freelist+0x24dc/0x2580 [ 104.047297][ T51] __alloc_frozen_pages_noprof+0x18d/0x380 [ 104.053150][ T51] alloc_pages_mpol+0x232/0x4a0 [ 104.058002][ T51] allocate_slab+0x87/0x660 [ 104.062501][ T51] ___slab_alloc+0x150/0x6a0 [ 104.067078][ T51] __kvmalloc_node_noprof+0x34d/0x8a0 [ 104.072441][ T51] pfifo_fast_init+0x372/0x6c0 [ 104.077192][ T51] qdisc_create_dflt+0x13b/0x4c0 [ 104.082127][ T51] dev_activate+0x378/0x1150 [ 104.086723][ T51] __dev_open+0x67a/0x830 [ 104.091035][ T51] __dev_change_flags+0x1f7/0x690 [ 104.096230][ T51] netif_change_flags+0x88/0x1a0 [ 104.102302][ T51] do_setlink+0xf82/0x4590 [ 104.106705][ T51] rtnl_newlink+0x15a9/0x1be0 [ 104.111364][ T51] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 104.116281][ T51] page last free pid 1 tgid 1 stack trace: [ 104.122241][ T51] __free_frozen_pages+0xbb9/0xd10 [ 104.127428][ T51] free_contig_range+0xbb/0x170 [ 104.132269][ T51] destroy_args+0x4e5/0x570 [ 104.136771][ T51] debug_vm_pgtable+0x3f8/0x410 [ 104.141789][ T51] do_one_initcall+0x250/0x840 [ 104.146626][ T51] do_initcall_level+0x104/0x190 [ 104.151547][ T51] do_initcalls+0x59/0xa0 [ 104.155869][ T51] kernel_init_freeable+0x2a6/0x3e0 [ 104.161045][ T51] kernel_init+0x1d/0x1d0 [ 104.165400][ T51] ret_from_fork+0x51b/0xa40 [ 104.169971][ T51] ret_from_fork_asm+0x1a/0x30 [ 104.174718][ T51] [ 104.177038][ T51] Memory state around the buggy address: [ 104.182756][ T51] ffff88805b8f3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.190806][ T51] ffff88805b8f3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.198857][ T51] >ffff88805b8f4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.206896][ T51] ^ [ 104.211469][ T51] ffff88805b8f4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.219854][ T51] ffff88805b8f4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.227897][ T51] ================================================================== [ 104.245523][ T51] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 104.252751][ T51] CPU: 1 UID: 0 PID: 51 Comm: kworker/u9:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 104.263969][ T51] Tainted: [L]=SOFTLOCKUP [ 104.268295][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 104.278336][ T51] Workqueue: hci1 hci_cmd_sync_work [ 104.283548][ T51] Call Trace: [ 104.286901][ T51] [ 104.289825][ T51] vpanic+0x1e0/0x670 [ 104.293800][ T51] panic+0xc5/0xd0 [ 104.297510][ T51] ? __pfx_panic+0x10/0x10 [ 104.301912][ T51] ? preempt_schedule_common+0x82/0xd0 [ 104.307442][ T51] ? hci_conn_drop+0x34/0x2a0 [ 104.312102][ T51] check_panic_on_warn+0x89/0xb0 [ 104.317031][ T51] ? hci_conn_drop+0x34/0x2a0 [ 104.321780][ T51] end_report+0x6f/0x140 [ 104.326099][ T51] kasan_report+0x128/0x150 [ 104.330667][ T51] ? hci_conn_valid+0x21/0x230 [ 104.335411][ T51] ? hci_conn_drop+0x34/0x2a0 [ 104.340076][ T51] kasan_check_range+0x264/0x2c0 [ 104.345004][ T51] hci_conn_drop+0x34/0x2a0 [ 104.349585][ T51] ? __pfx_le_read_features_complete+0x10/0x10 [ 104.355726][ T51] hci_cmd_sync_work+0x262/0x400 [ 104.360648][ T51] ? process_one_work+0x87c/0x15a0 [ 104.365957][ T51] process_one_work+0x949/0x15a0 [ 104.370905][ T51] ? __pfx_process_one_work+0x10/0x10 [ 104.376356][ T51] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.381592][ T51] ? assign_work+0x3d5/0x5e0 [ 104.386198][ T51] worker_thread+0x9af/0xee0 [ 104.390817][ T51] kthread+0x388/0x470 [ 104.394892][ T51] ? __pfx_worker_thread+0x10/0x10 [ 104.400001][ T51] ? __pfx_kthread+0x10/0x10 [ 104.404579][ T51] ret_from_fork+0x51b/0xa40 [ 104.409242][ T51] ? __pfx_ret_from_fork+0x10/0x10 [ 104.414337][ T51] ? __switch_to+0xc7d/0x1400 [ 104.419006][ T51] ? __pfx_kthread+0x10/0x10 [ 104.423578][ T51] ret_from_fork_asm+0x1a/0x30 [ 104.428333][ T51] [ 104.431810][ T51] Kernel Offset: disabled [ 104.436126][ T51] Rebooting in 86400 seconds..