last executing test programs: 26.088449086s ago: executing program 1 (id=2301): socket$inet6_udp(0xa, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xffffffffbfffe9cc, 0xc, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000d, 0x4008031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) umount2(0x0, 0x2) syz_emit_ethernet(0x7a, &(0x7f0000000500)={@broadcast, @remote, @val={@void}, {@ipv6={0x86dd, @udp={0x0, 0x6, "f7d8ff", 0x40, 0x3c, 0x0, @rand_addr=' \x01\x00', @mcast2, {[@hopopts={0x0, 0x4, '\x00', [@hao={0xc9, 0x10, @loopback}, @hao={0xc9, 0x10, @private0}]}], {0x0, 0x0, 0x10, 0x0, @gue={{0x2, 0x0, 0x1}}}}}}}}, 0x0) syz_usb_connect(0x4, 0x5e, &(0x7f0000000140)=ANY=[@ANYBLOB="127b06a1279bb00102030109024c0001000010000904e700022efeac000b240201030205f61fb0b1af43c250d57ff49bfd052406000105240002000d240f0105000000090007000806241a7f200109050602ff80000000000000"], 0x0) 12.968919848s ago: executing program 3 (id=2323): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f0000001300)=""/244, 0xfdef}], 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, "000080f100df00000000000000000009f600"}) r1 = syz_open_pts(r0, 0x101) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xd) write$UHID_INPUT(r2, &(0x7f00000001c0)={0xa, {"08c39ee52f329f1698b1c4865f8b540a5eee9f496a0809c3d20325867b6edda88489ab4c09fe0a7f1e8640aa8e344f412df0d69475a5d6570e21f31fac7dfb4aa7ade0e851582d5c1abdd809580cb34c9e48576b1c73ed76023256fca058ada3db47d86cc75b33cf762b67fe61f152618c49a40858f68794a4fc484ab73ccd254ba3d147f5feddaf91dacc238c0a8096f79597ca1e6da781fcf37a0141a335c6a7577d2d53c6e552a7be208381bb31d1d3e0e92ea651655217535734b286d3f19780a4c720075a36a734151f8c00e651cb3a6bbe30e3f6aee48750436da6471e965e81f38134674fcb697108fb7345010bb8fa15fba9b33355d7858327171ab9c68f6c21b2ffbff4eb061dab80bc77a4a7769e7ff73bcd98790e09415bfc5978cf5af45c3ec9ef9c1a39f766c59d59590281038dbcb765580ba2b3f141d5bbfc40910a0894cd1f22d2a8b6d4e4778debef99438b54d44b4b7568de2777431a5b2f3e8d1a45a60a468f5e33e8ef534f803dfb6798c270f52edf031ecd996bb78c4e92961c63c079676d77412ebc6074e5f235417785e7a14b14ce7626b015071c154cc2bf8f4499b93293e9997c23df4c7a1498cf12414fb31eb873728e4f613b540d22e7ca718f18da5b82ed24995e4309c3af4a2e1097465bf09728082d09e71ea365522035eb9772b8e072f8454777ee304dacd59d3eb9f933f151fa14f8c38eadbeba04810a2dea7a66824f09235c13a45f07870210d0d310ce3ae6284577bd4e65f32700f6723727926cb52e4f27776a1dab0f6668327ab5cf1893879a635261f2e0d9923ccecbf5b80f10a8275c1515f47930d614e787f14c105d3a4f8faf8e7f738cf4eae4fc39ef3db3cb87794ace87f7239b69dc4ab4e5ae57cdfbd309e847d99600ef14b51faead01e8ade57d24270bc13a1787896096eeacb8ab1c93d31d93cfb244bb09ecfecf336362a5656db7df327cbb9aeb898f8af229c7bb9452805f2b4510c5df86b6d564e01f000000167ade5205331523a6392af2bea9e6db0ba5480cbf1b202714233289c4017cb66e83c0c8b6e88bedb922162d0ceecf6c5da173bbefe6781ab7720d2be6cca378db650c69d4228141ae190922fbbaddb86c7f0fe138b704e8305b3bcc7910b2280d96d71dafdbfa876b0013fc4de586f85d9ee077b6349becbdca8bd989a51c4c76ed8a8cc691a65078e0272a62edec8236a779f0cbffeda49dcdccd4def7064e0d77ae5a8c64f3057b4a3a0d4457d33f2bc6c112378315411baa4bb126fe540d750491fc58fbb66911ef82bce5ed76872dbcd8e05dea2f3f347a653aa39ab5d75e71671bfeb924e71476134dbf91e3f287fd853cc34bf81e717edd41aa04b6fbeb43cf2074f0c8fe5350401b6cff801c147a3b58b972aa5652629a9fd8b1df2852708ce958d4e9974ec4383aa5da4e3f75fdc85981e97b75863546f67a8703673b6fe2c26f0e9eeb8c45c26f673adac55fa5d69b82ae7d032fd3b26866047e8c029b90a62794a89c11398944b398b4177b2dcc5a743c16d4a5333b1e30af678d3db8df849c1753db067a6f94bab00c0dd3c7e94a8675924c89bda98ac09e10bcdf83f5114b9b466c413477a5cdc48c857230798934bcc1f0eb3a2d2944b139e459af32e515785f46ed4e97cdcb23c7e4dc7c4f91b5b5ca5228344aeb6652fffaf31325c7429bc70a5f6beaaa98ef190dffdeccc94bd814b3edfdd48243bf34291076ab5438ee00e924a827d5b453df42d24144fe1a45bb6c84fcbb2143d0a561c1e867c1279bdf0a47061ea77a84f36c720aff785f0db10eda84c767b5f3874f9455c0f026735ded32f0403ef7dbcf97d2233d59c670114ddf89314ba74fc248bcbdbf43c24e46304e229b3cf583aa410f4dfd119152495da8737518ee2a05a8ca1f004be3c551408f2e4013e444b63bf2bb26ddeae505642dffcc989ee241c48741181b506e22fdc4530319522780c74bf786852dc66ebbb51f8ecbb1e35de09ef7afe589bb8a31c5d63477db5d5e7174694ea04cfa98057d39127a4e5eedb4897a491c6693acd0a036abf846f3b6f3006e5e5fd586f29a4a8a31abbccf732e4f1b88187a72d669c16302657e9cbbeb9322662e111edc7771526400b6123d0f8207bcaa38bee07043e36e223d418ac948d65e7acfe72cc3fdcf03a3e43ecfec8ae489ddba09126709c5c7968829e3504de8a5010c9372de09476a7b96b04d7aed2486d8f89f21f075321abe350024abe00a81f87df3dc372fc3206496776c26b6958243070bda4cace3e358da5d39a3945765c2ba4b002b06efd416af66f3343f218ed84550ea83f02f9a5c3fc677ea60987aa25f0406d6154081cfdc074814a2465accdfa102858f5a52c9eae293c56ddcaf8f6926d3dd0ccb51a30c960d6b7e473038ebd3702b5106f6bc040efdfd7169fd3f2dc42ff23de26a239e13b74278729fd7e843b38a35c55fd50181ac13a9cbbbfd8feb36afaeb1993349c0ac5a0c44ffd92919dfe272b0f8ed7df7198cd299715f021109a58dced4753d3c7ddd6e9ea01596f18b2fe7000000004ccfca57aed5b5cebdff65de480a56bd53f4c7f83ddef00d7c9686311d1fce76f320bb3222a11db30ba6ed31535d8fda61e694478ca9935d72719b8d6b9be88ae3df30b60ee251b919b4d1734b994c62accdf855488b351738331b462eccf27efdc5577d7a5548579dc90d227a42ac010f33a720dc3cf0a63454f8b07c775287495761a058ec1e28e6aaf8057241f4ef8b5de56e279355bb66630c4ddf35e7c2cfff26a4241b1df0379d2a1e9f959e46d3843f89844ead50aff44640fcbc4a1edb033afff7cc9e57c4f8d31900764233e11fa4c28e547788c1b00de4268df692ba3415a9ad90fa712f9618f5ecff57da32809380eeff040cd3b23f508614c72b303cec3bcd732708303b166193366a062b9cea536f28478c387e626744c6a611a8e7162d274efccc84eee8eb31d3310c86752777dd5b5ffe234e895c54909f19a4aabcf3c15b90c02170409e314fd90e766ec4ba93c8ec6321237a980ad3c32fb2fab69e57541ea7f5427a85c2c57d40f9ebe9de5572f46a4713fb28e0af42d0adef3e29195aa41a3ba318181512eebfadffede4e35ff7f975928edc5d4d9f2d931fb44b30e1df55e66c52e1648e9cdaf71221b57c6a6b087428ccc57ade5b1531341cba2be452b426c434c70fd8c493337d4995cbd76ea1dd545226e3eb59d5f94ffb5352f87a4a66cd7c5e88322404fd397c46e198646a9c819d0eb1f10e54d8a3ea912f1cb134ff1095aa7325287f6ea9af8c13b67d6abcbb70dbc06838ecb33e45b60f6cb832c3e72d1401770f66bd02f35a2d007815ab676099e31f5102000000c0e83d5e7107c8dc5830c9cddb9781185b94d7f2814c5058ba3ac54c268741c5728f4997a9628602c2a36090162379f3f37c47619b3e7c7397a5913b7060b51e0c7f7226ff1135444f866f89a4b74136cbd3acb7178bd63183b3fd9cd19fdeb6fcc6341910ad4605da76a9af4bfb8b75fcd666f8188902b380ae560d9aa04f8f9b0ac5c109d1824a470726e06a49d955f8f71c8a86081e75b13f62600deb941da181eaff544cd559c467d8dae432debd22e7a7b3e1ad731a5b9470f5f60423dda061ff899c07c79f3da34f38e1d8182d6ee0c36c602945509167be440382a8a8a759b20e41638fd57152029b190b5701d30a86f579e2d0cc53a2f809ca9bd3aba1eb2772a7acc35c4d983afa83a9baea35c0ed4931234719636cf8f5fe1884bde6cebbdf23bd62b1ebf0a5cb78c27295349bd7d5cf28c4ee4689497238fd3aa71a417914e6892667a56bd69dc2e5882cfb67df71494e9a9199e025892e4e7435f727636cd988cc7563d28db5133f649849c5b3973a3428de10ad39d96146b22acc50f50eee5a038876452b960686892de40efe30081ccdaa2bf64af78d5988026e529b36c62a21378ac42d220d0dd878010178e374e6dbb2b61206066d04e729ed03c6fd9a4e00547fe9304aec0925d85a0acd07fdc5d48c1a1cff656916f5d25952327792255e0d606a32517781cc3d737ec753eb95b5b5b95dabd8946907ab54cc85d05b475e2e5486c6fc070417198d3a50910e2949d20d3fa68fd327934cff5171224942b8f18d88947763a7c710d09c4b269bdf2d3e715329917fb70728a4a0530999b755ba8fc04deabf4bc4bcffc4d62d491538c65078122bf2c263ae0020af67cfc9cf19e5b929e086af281fb43d5504d728935c5cfac136eb81703d50fddb39a5a713b2914c6acd9b2d07819cf7bba495ac5734fe423e611d309b80eeafcf9053d51b0ab3c29d5ca5eb8861ffc1ebc4d53f361b8991baecb52860c15202f979e34054fcde869d018103ccd6d914a70f1840fc6aaf426beec975ddb980b19b0f4cc2ca393c0b9e6ebe5e7d1c9fc1ef7a1c91378f0b73262993fb80667ecf62bac3c47cbd002ae1b87b8dc3ec99d5c987765d778868eb55022cc3bed14b8f934a584bcc98fa0b4f6e6982ab8d8a2bb49f9074ef429dd7b8db332a96ccec6983a97be7c8634c02e7937ffc8d613b83aa375886bf40a87ec062090382f874bf2c8e5fbb58ac18a46c4d9e85af3ca21bdacb7755f49776b0eb3972ff682c84beb07d74cbe2764e378253e72128991b73d2730704a5448280e8a0fd8cc87d4cddcffbfe5525ae3d2304877a3988e33c8e12bf77793e753f25840e9af2ce56bdb999fc62623a2298b4244534f662eb398a2577c72f6cfd5174697dcee151d4f3a7293b11de3889c43744da4165aca4e4a1e926d37ae4d7471584a06f3641f2037a74a58c2397a594f29d142d59f91bb57e24e1a3f30f68c626033cc34895c1b16d62e3a375c3e09f5dbd9338cd3a500643143cd404b57019c648c3ec31d696233fe16efc3c4c84aca0830ca8b9fbf1144b98d82f41e4cf67631c74cdcf8d9c8b8556b876ff1592683ccac0b47a26cb3a2cb1b917f433bb54e0b53deae9ac4b1cd0594c1fa0e6744e7ed88fdac60901e3da989f3b0d7c12b140cc576fa1b0e8e705321d37c303691aafc9fed9c3dc419078d0925ead56455ea5f3cd57941e410c1c14c2e8972d7cca44fcaca1f64fc817f4a41b6d9fb237fed159cb09e788ae560726537f49cb64b9f60915d402e0931355c55ad792cde758548b1af54b196e414046d4af3579a6c30ceac3d68bbfd2adef309c064e759a9f0dd69d682a3880b8ff27b69abffaa45ee7e65d8f1f6e40c188f6249fdf72220b4c87243217ba0292b9e9b67ebeda4fb83406216a4d765812bafeff34cc57f7d2cd1608282079c076055b9cabffe5fa491b970291bc2672540ccc15ed877d7dbe3ef683724c715ace770905e48c2dc6a44e1fc095773676d070eac00ee3834b07590cba7093f56b678313870471c81599d34c53fc03ec6c913d8ba3f604ace8da12d2025cbb5000bc062f4db65a6feacaf3915206d1c15ce7e78c17dc2ea32cb57d6fab0a22d487c77118e75016006f812541ec8180a321287a2d57248d4ee4a19706a19d802c70e250c3b0fc400a0b5cdc06537d2f55fd5300be4eeeaab8cc481a84b6a5e17d8c47ec92fe40710d4ec3530a94ca16710ade2ec7562398106e0ddbb6c8af6412166afd99d45d29a3a967e58decd0d6fc5bebb98d639b5606efd358a43d635d50f0ccb8472197da604994e7fb700243d5f7e45700", 0x1000}}, 0xffffff5c) pipe(0x0) io_setup(0x3ff, &(0x7f0000000500)) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x8, 0x8, 0x0, 0x0, 0xffffffffffffffff, 0x400, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @void, @value, @void, @value}, 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="30000000030805000000000000000000000000000c0004800800014000000000060002400000000005000300ff"], 0x30}}, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0xcf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_clone3(&(0x7f00000004c0)={0x200001000, &(0x7f0000000180), &(0x7f0000000300), 0x0, {0xe}, &(0x7f0000000740)=""/238, 0xee, &(0x7f0000000100)=""/54, &(0x7f00000003c0)=[0x0], 0x1}, 0x58) sched_setscheduler(0x0, 0x2, &(0x7f0000000600)=0x6) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r6, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) madvise(&(0x7f000044b000/0x1000)=nil, 0x1000, 0x0) pipe(0x0) 11.231584726s ago: executing program 3 (id=2327): r0 = socket$l2tp6(0xa, 0x2, 0x73) socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000200), 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}, 0x1, 0x0, 0x0, 0x4000840}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000000201010100"], 0x44}}, 0x0) bind$l2tp6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x20) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000900)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}, {0x0, 0x1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x0, 0xfffffffb, 0x0, 0x0, 0xffffffff, 0x4f77}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xfffffdfd, 0x2000000}}]}}}]}, 0x58}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000000180)={'erspan0\x00', &(0x7f0000000380)={'syztnl0\x00', r8, 0x80, 0x80, 0x4, 0x0, {{0x13, 0x4, 0x3, 0x2, 0x4c, 0x67, 0x0, 0x3, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102, {[@end, @cipso={0x86, 0x29, 0x2, [{0x5, 0x5, "8dffe8"}, {0x6, 0xe, "c0931d368973889980a5aead"}, {0x7, 0x9, "43e7d95ed49249"}, {0x2, 0x7, "1b9e17a68a"}]}, @generic={0x89, 0xd, "cce3d9428429db4ebee879"}]}}}}}) sendmsg$inet(r5, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) connect$l2tp6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0x0, 0x80000000}, 0x20) connect$l2tp6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x20) 10.838022451s ago: executing program 3 (id=2329): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000540)={0x1, 0x0, [{0xd, 0x800, 0x2, 0xf6, 0x903f, 0x1ff, 0xb7}]}) r3 = syz_usb_connect(0x4, 0x24, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="580000000001050400000000000000000200000004001880240001801400018008000100e000000108000200e00000010c00028005000100000000001c000e"], 0x58}}, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_NR(r1, 0x4008ae73, &(0x7f0000000000)={0x5, 0xcf2a}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r6, &(0x7f0000000140)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x38}}, 0x10) connect$inet(r6, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg(r6, &(0x7f00000057c0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000004c0)='k', 0x1}], 0x1}}], 0x1, 0x0) recvmmsg(r6, &(0x7f00000048c0)=[{{0x0, 0x0, &(0x7f0000004a00)=[{&(0x7f0000001a00)=""/4099, 0x1003}], 0x1}}], 0x1003, 0x10122, 0x0) sendmsg$sock(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000500)="c4", 0x1}], 0x1}, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000080)={0xf6b0}) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_disconnect(r3) bpf$MAP_CREATE(0x0, 0x0, 0x48) r7 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r8 = dup(r7) write$6lowpan_enable(r8, &(0x7f0000000000)='0', 0xfffffd2c) r9 = openat$cgroup(r8, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) openat$cgroup(r9, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.swap.current\x00', 0x275a, 0x0) 9.164737915s ago: executing program 0 (id=2335): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='freezer.parent_freezing\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)={'#! ', './bus'}, 0x9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) write$binfmt_script(r0, &(0x7f0000000180)={'#! ', './file0', [{0x20, 'netdevsim0\x00'}, {0x20, '/'}, {0x20, 'netdevsim0\x00'}, {0x20, 'netdevsim0\x00'}, {0x20, '\'!&[}\'\xd4'}, {0x20, '\\})\x00'}, {0x20, '+$*\\-/&^&'}, {0x20, '\'\'*\\):-'}], 0xa, "b3a74784357e6181e7486bf19d4e12caccdd8fcca5f5b64d4cfa04cc50272b466bc1b69a661f36fdeaa738e71b28629ac83a0c26918e81fefcbfc0686383b29d623fb2e604745c96e26e160101a7553ddfd1663cfa7103765b9de57a78794c207019477c5dcecc5d8db4f586af62cd5cede156300be438ff6d26182eb7c247aa185bc142c0d5f59d280a0b592991debf3d54c6abebd76e493a030c64d0e0c4de7f5e91535d893f325df68225a0fb38c87ef4250b"}, 0x104) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000040)=@ethtool_dump={0x3f, 0xfffffff7, 0x1, 0xf2, "87648ba663d84cb6406505eed579f51463b7ba4e634c4dbef060d944dd07438b1a711291215ee1c87a1db9010e4f9a03652c0f170d0d908845f21c2438893d97f812717697b83fddbbb93725854dfdf2a4be33af3b0cbef951a412dc7219c00f494ca400c95d0eaf359a86f03e07137af279ca5c79bc602c078849241d1ea532f87381fbc5aa2f4205ccd74752b1bb61d23a93747a4512032a6f037b59b26ceacd26c37cab06659ee638c4a77fc922447dcddc59535d576fc57d3d92df43fe319f17cd071d0227b1e635120e50fc54a9fd2110f372fc465e0456f8df7f0c71bd4a6468cdb08462a0b1d01a6f445134db02cc"}}) 8.655820316s ago: executing program 0 (id=2336): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="3c00000010001ffe00989837a182138b00268f1c", @ANYRES32=0x0, @ANYBLOB="ff7f0000e0000000140012800a00010076786c616e0000000400028008000a00", @ANYRES32], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) 8.582585697s ago: executing program 1 (id=2302): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000090003206d0414c340000000000109022400010000a0000904000001030101000921000800012201000905", @ANYRES64], 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) connect$unix(r2, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r3 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r3) syz_usb_connect(0x6, 0x24, &(0x7f0000000580)=ANY=[], 0x0) ioctl$EVIOCRMFF(r3, 0x550c, 0x0) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000180)={0x0, 0xea60}, 0x10) unshare(0x22020400) unshare(0x2c060000) ftruncate(0xffffffffffffffff, 0x0) r4 = openat$vcs(0xffffff9c, &(0x7f00000001c0), 0x200000, 0x0) syz_io_uring_setup(0x3bd7, &(0x7f0000000200)={0x0, 0xc88b, 0x1, 0x3, 0xdb, 0x0, r4}, &(0x7f0000000280), &(0x7f00000002c0)) connect$unix(r1, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) pipe(&(0x7f0000000100)) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$random(0xffffff9c, &(0x7f0000000000), 0x400, 0x0) socket$tipc(0x1e, 0x5, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0xb000000000000000, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="00001c"], 0x0, 0x0, 0x0, 0x0}, 0x0) 8.463683952s ago: executing program 0 (id=2338): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x800, @empty}, 0x1c) listen(r0, 0xfffbf7f5) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendto$inet(r1, &(0x7f00000000c0)="1c", 0x10002, 0x0, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001e00)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000480000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6939fc404000000c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a3449abe802f5ab3e89cf6cfdffffffb8580218ce740068720000074e8b1715807ea0ca469e46968eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000000000000005335000000143ea70c2ab40c7cb70c943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a33e680846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2200af6c7784a1975fa807de38a3a61e44a9ecab19bdfb15a32a4fd67ce446adb431d07db79240acaf091231b986e77d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061629d1822f720ec23812770d72c700a44e113d17088fdd00600000f7889b8c7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f747c08f4010586903500000000000000000000be34cf652e28e700000000000000b24478a78a0f9d640dd782ac0cbc46903243d0d0f4bc7f253d0500000032daaf281c450e64c33aac8ff7e7d1c94c450503009688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0000f5e1671bc5eb7739daa7820a91cb0e732df2ae1d39c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b4cbaf5a6b649dd5f13cd776e6c7c4b5c4b0de20e033b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13e434aae9df81ecaf5f744f22f2e45afe2c9e8632276cffe5f1fc215c0797d0244cf1ce269d10525745caaa3f77d1b80116cb9a384002421d898913c45a9ac091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c045a17e9a61c3b064e679508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2434ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd911e0e5f00019be25b5910a3193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f5513662809073710937ed0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c68549e9da89ad4218cea744b332ab232a09cf1ec375627074ce2d3d7619936768a84a1465fff4eedba55955434f132ab7b8840558b3f918d675a79907a72a8252cd3fbaea5d3006a03507838231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68196c7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f27859946e72f80bb1c9cfcde57b79625e2979fe689a5a246cbbdf6ad488f43f46b2536f175f46dfb27d522946727024de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546eb7c32dbecb18a308a0004be94dfab28c2a51dc856df00000000000000000000dfa4c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5d00f26126d4cf2c73e5f94030000000000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d0e68d7eef5d32d5fcc7923d7544fa492aa38717481c55e86dcd7816ad8940bd1995369d89ae6eadeb9117e8b94ab422c8d62fc9dfffeb13b4858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1ef90ed4cb9fe6d19b11d4d38239d318016e622b9683b7e46be64dc097982e23462392a0cd05afb2e060fd42ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1af45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5c81aebc0cada819895b377d6cf0a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9573abb0a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b14952139bd4bdbccc5e334c49584655c4fce8c5bb7c54664aef6d78429d358aa54b4b49926c4be9ee4659153d9f9f5d07cc4efdab2c5f4503148d0255d0b748366dafe042d78479c21d832e1431ed6d646d13e8e7230300920a5642bbed1dee9b46b6f02e572024ccf3c8edd82660e5d74c52be71d780c300000000d0267ac40d1130a9000000000045f50812a1a0530b02baed19f4c977ac0d397ed6371ec589bf5943690250bdfa5b676d5d53d2ab3aeee1a6910c1a33b6c06c93386768f8b1bb27ec31cffbd4f5c7b0c2e14e4fc6c2f089ab08567254e93780afdddefb3f0d2143ad73c0bf2467859049d46dc5aa91f918a307e7dcaaccd6cbe66e8a04d201392a487f681f82528a800e27d65200ae10e1b5d39a29d8a2c8ed2dfa77e21249b45806733e674a9e8e72ad1cb0d3bfadb00a18a5008ea1e4c8fb93d311f52a476c576a3f65c9bdd4e4b870aed4cb9906a8aa25986e6e30be249d9911114b42b2fb51168e56000a62b794c193f7797ebeb7f8b91c70b6e720af06ecfcfb89a2d5a25f"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000380)="b6e403c6630d698cb8a00b04339c", 0x0, 0x7e4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r3, 0xffffffffffffffff, 0x0) 7.571352321s ago: executing program 0 (id=2343): syz_usb_connect(0x4, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="120100202b0a0e4047050168f4a4000000010a29e51f28caf009021200011a0000000904"], 0x0) r0 = memfd_create(&(0x7f0000000100)='\x103q}2\x9a\xce\xaf\x03\x86\xe7\xc0\x14\x8f\xf8\x81\xff\xf4T\xc0\xf9\x05\x00\x00\x00i\xe4^\xd5W \xe3\xf3\xb7\xa8\xc0\x8dC8\xb7\xfd\xa9\r\xac7A\x94\x03\xce\t\r\x84\x87\x1c\b\x8c`\xea\x13A\x90m\xb6&\xd0\x9daA\xc5\xb8_\xd4\x18,\f\xd4s\xb2\x99\xc0\x8b\x19\x17\xb7Rvd\xcb:\b\x1eS\xb7\xb4\xee\xa8\xf7\xbe zA\xe3\xd4\xcb\xde\x90]\xa5\xd8\x99h\xa3\x9044\'\xadLLj(\xe5gB\x1e\xe9\x0f\x86u\t\xb3FF\x00\xe2/\x17\x89\xf93\rs\xb7\xd9\x7f\x8e\xd3I0\x16\xab\xacJ\xbe\x1d=\x90g\xce\"x\xc4\x01\xff\xc29\xfd\xe76\xdc}\xfb\xc6\x90\xde\xbd\xb6T\x7f\x9b\xcd\xc3\xf0\xfe\xd9\xb0:\xf4\x17\xcc\xbae\xc1)\xfc=)\x99/\x00\x00\x00\x00\x00\xcd\xc7\x8eg\x1e\x97}J_\xfe\\C\xf6\x13V\xac\xf8$\x13O\xb1#3g4{\x1eF\xa9\xb7\xee\xa3\x943\xde\xd9\x89\x1c\x9f\xa9\xff\xd3\xb8\xaekvN\x19\x91\xc1\xd9\x1c\xd3@{\xce\xcf)\xe2\xe1&\x8c>\r\xd0\xf0\xc1\x8a\xd5H\x89\xc6\r!r5D.k\xc0\xe9E\x87\xc6\xa1\xba`^\xc39\x99\".\xfc\x04\xe6\x9f\xd6\x0eMp\xfe\xa1\x12\xae\xded!\xae=\x87\xbb\x8cX\xea\r\xc7\xce\x8f6{\x1dT?\xa1v\xd3df\n\xf7\xf7\xd4\x91\xe2\xf6-\x10\xb4\xb5$b/\x0eZ2\xf6\x94(d \x0e\x81Y\xacu\x1b\x8d4L_o\xe7p\xed\aT\"\xe3T\x1b\xc2\xc4S2', 0x6) ftruncate(r0, 0x80079a4) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) ptrace(0x10, 0x0) r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x10, 0x0) landlock_restrict_self(r1, 0x0) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, 0x0) ptrace(0x11, 0x0) ptrace(0x10, r2) landlock_restrict_self(r1, 0x0) ptrace(0x11, r2) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3fffffe, 0x13, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x2) r3 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r4, 0x3b82, &(0x7f0000000100)={0x18, r5, 0x1, 0x0, &(0x7f00000000c0)=[{0x80000001, 0xfffffffffffffffa}]}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000380)={0x48, 0x2, r5}) write$binfmt_script(r3, &(0x7f0000000100), 0x1670e68) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000e3a000/0x2000)=nil, 0x2000, 0x17) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r6, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}}) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x15) 7.563956723s ago: executing program 3 (id=2344): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_dccp(0xa, 0x6, 0x0) setsockopt$inet6_int(r0, 0x29, 0x13, &(0x7f0000000080)=0xfffffffb, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000580)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000002100000008000300", @ANYRES32, @ANYBLOB="08009e0040bc"], 0x24}}, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x6b) r3 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'team0\x00'}) bind$packet(r3, 0x0, 0x0) syz_usb_connect(0x0, 0x46, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xcc, 0x73, 0x9f, 0x20, 0x4a4, 0x14, 0xc957, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x34, 0x1, 0x0, 0x0, 0x80, 0x0, [{{0x9, 0x4, 0x13, 0x0, 0x3, 0x4, 0xce, 0x10, 0x0, [], [{{0x9, 0x5, 0x0, 0xc, 0x40, 0xa4, 0x8, 0x8}}, {{0x9, 0x5, 0x5, 0x2, 0x10, 0x3, 0xfc, 0x1, [@generic={0x7, 0x5, "910e3a85ea"}]}}, {{0x9, 0x5, 0x8, 0x3, 0x10, 0x7, 0x1}}]}}]}}]}}, 0x0) getsockname$packet(r3, 0x0, &(0x7f0000000000)) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001000010000003a194618d96d6d2e8553", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2002}, [@IFLA_IFNAME={0x14, 0x3, 'wg2\x00'}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) 7.287171075s ago: executing program 2 (id=2346): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000000)={0x0, 0x8}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000080)=r2, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000f00000008000300", @ANYRES64=r4], 0x34}}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000003c0)={&(0x7f0000000400)={0x7c, 0x0, 0x8, 0x70bd28, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x3}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8, 0x3f, 0x9}, @NL80211_ATTR_WIPHY_TXQ_PARAMS={0x44, 0x25, 0x0, 0x1, [@NL80211_TXQ_ATTR_AIFS={0x5, 0x5, 0x81}, @NL80211_TXQ_ATTR_QUEUE={0x5, 0x1, 0x7}, @NL80211_TXQ_ATTR_QUEUE={0x5, 0x1, 0x4}, @NL80211_TXQ_ATTR_QUEUE={0x5, 0x1, 0x8a}, @NL80211_TXQ_ATTR_TXOP={0x6, 0x2, 0x7f}, @NL80211_TXQ_ATTR_QUEUE={0x5, 0x1, 0x81}, @NL80211_TXQ_ATTR_QUEUE={0x5, 0x1, 0x40}, @NL80211_TXQ_ATTR_QUEUE={0x5, 0x1, 0x6}]}, @NL80211_ATTR_WIPHY_TXQ_PARAMS={0x14, 0x25, 0x0, 0x1, [@NL80211_TXQ_ATTR_AIFS={0x5, 0x5, 0x8}, @NL80211_TXQ_ATTR_QUEUE={0x5}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x850}, 0x10) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000d00)=@mangle={'mangle\x00', 0x2, 0x6, 0x618, 0x338, 0x428, 0x0, 0x428, 0x338, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, 0x0, {[{{@ipv6={@mcast2, @mcast1, [], [], 'macvlan1\x00', 'erspan0\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000000000000}}, @HL={0x28}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2, [], [], 'syzkaller0\x00', 'team_slave_1\x00'}, 0x0, 0xd0, 0x108, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ipv6={@private2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @mcast2, @local, @empty}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00'}}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678) getpeername$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000200)=0x1c) epoll_pwait(r1, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x3ff, &(0x7f00000000c0)={[0x3]}, 0x8) 6.785273643s ago: executing program 0 (id=2347): r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001280)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) r1 = syz_io_uring_setup(0x60f2, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x3, r4, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0}}) io_uring_enter(r1, 0x5b43, 0x2, 0x0, 0x0, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000780)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x30, 0x3a, 0x0, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "5b29ab", 0x0, 0x11, 0x0, @private1, @empty}}}}}}}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc38, &(0x7f00000002c0)=ANY=[]) 6.374911295s ago: executing program 2 (id=2348): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="3c00000010001ffe00989837a182138b00268f1c", @ANYRES32=0x0, @ANYBLOB="ff7f000006010000140012800a00010076786c616e0000000400028008000a00", @ANYRES32], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) 5.999748408s ago: executing program 2 (id=2349): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000bf020000000a00007b9af8ff00000000b609080089ffffff7baaf0ff00000000bf8700000000000007090000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004600020076004000bf980000000000007e080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) 5.999284576s ago: executing program 0 (id=2350): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CHANNEL_SWITCH(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x9) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f00000001c0)=[{&(0x7f000001a040)=""/102385, 0x18ff1}], 0x1, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x15, 0x10, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r2, &(0x7f0000000000), 0x0}, 0x20) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) r4 = socket$inet(0x2, 0x5, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000001100)='veth0_macvtap\x00', 0x10) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000000)=0x829a, 0x4) io_setup(0x9, &(0x7f00000000c0)=0x0) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/power/sync_on_suspend', 0x20001, 0x0) io_submit(r5, 0x1, &(0x7f0000000040)=[&(0x7f0000001500)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000540)='9U', 0x2}]) inotify_init1(0x0) dup3(r0, r3, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000240)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x28, 0x2000, @fd_index=0x2, 0x3, 0x0, 0x0, 0xb, 0x1, {0x1}}) io_uring_enter(0xffffffffffffffff, 0x47f6, 0x0, 0x0, 0x0, 0x0) r7 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r7, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x39}}}, 0x1c) syz_usb_connect(0x3, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000009980708b5192100c7980000000109021b00012000ac00090400000107000009090585cf", @ANYBLOB="c1126655e43f74db"], 0x0) 5.93686225s ago: executing program 2 (id=2351): syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0008060001080006040001aaaaaaaa01f8ff1600ffffff00000000ac1414"], 0x0) r0 = fsopen(&(0x7f0000002200)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) (async) r1 = fsmount(r0, 0x0, 0x0) mknodat$loop(r1, &(0x7f0000000000)='./file1\x00', 0x0, 0x1) (async, rerun: 64) r2 = openat(r1, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) (async, rerun: 64) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000140), 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) futex(0x0, 0x9, 0x0, &(0x7f00000006c0)={0x77359400}, 0x0, 0x0) (async, rerun: 64) ioctl$vim2m_VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x0, 0xffffffffffffffff}) (rerun: 64) r7 = fcntl$dupfd(r6, 0x0, r4) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r2, 0x0) syz_emit_ethernet(0x82, &(0x7f0000000000)=ANY=[], 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1000004, 0x42031, 0xffffffffffffffff, 0x0) 5.810674784s ago: executing program 2 (id=2352): socket$can_bcm(0x1d, 0x2, 0x2) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x84, 0x18, &(0x7f0000000000)="03020000008002ff", 0x8) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000240)=ANY=[@ANYRES32=r0], 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5334, &(0x7f0000001040)={0xa3, 0x7, 0x0, 'queue0\x00', 0x6}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$unix(r1, &(0x7f0000007580)=[{{&(0x7f0000000140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000240)=ANY=[], 0x88}}], 0x1, 0x0) r4 = socket(0x1e, 0x4, 0x0) r5 = socket(0x1e, 0x4, 0x0) getsockopt$inet_tcp_buf(r5, 0x6, 0xe, &(0x7f0000000140)=""/156, &(0x7f0000000200)=0x9c) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="0000000000000000380012800b00010069703667726500002800028006000f000000000014000700ff"], 0x58}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x2, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip_vs\x00') preadv2(r7, &(0x7f0000000240), 0x0, 0x68, 0x0, 0x0) fsconfig$FSCONFIG_SET_FD(r7, 0x5, &(0x7f0000000080)='[\x00', 0x0, r4) socket$inet6_sctp(0xa, 0x801, 0x84) ioctl$sock_ifreq(0xffffffffffffffff, 0x8947, &(0x7f00000000c0)={'bond0\x00', @ifru_mtu}) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYRESDEC=r6, @ANYRES64=r5], 0x28}}, 0x24048011) syz_usb_control_io(r2, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="1f769a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)=ANY=[@ANYBLOB="0000020000009c56"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f00000017c0)={0x44, &(0x7f0000000440)=ANY=[@ANYBLOB="50a8ca31aa25c4fcfed3e31c58cfadb2924f86b69c0dc45b8f086a0e66ac6f41b3149b1f15eaf936ceaaefdb4f443299290c54210c85204bd7682d2b23726fd2e3aa5e24f45b9308bb618d66a174262ffb12e074b9d8d48820fc0b9f4c233e35dd71206c7438c53735defef8165325934eeca6cfff72b28812f624c36894b981a42a0dfc479bde59373a10bb0642b0e7f6910d5c6f30974ac8088ca0141a4375e2fc4ac4d3061f2bdf7b3eda22a4a501801d2c41dd14e051c77383e25b53ce8891504fdcd4cb9d917b57c2e6051f3706aa3a921d4f0aa1aa438048cf81afe4a4d63591bae2acb9df3b83351cbacf1707ec9ec4949cc482b3846d0b4c6b23a76555924a1f6be5706eb5e460b00a3d6f1895fc07c87c70756a72d9942e8789c6c3851618d0112da00079a18a14fb5bbcc71f7b0c3cc028cd9002adba1dd419dce5fb9069ee775d842d46c0c92bfeb6b106f21d5617b4310839bb6b334225a909034d76ca3092f647752946e2c8115e4b53d432ea6cc6ab5948bcfa07632615a0105ac5355bd26df41b55e98e81aca69a0f6236c692952dd8bd256cb950574c0aed7019f230997ae74d450934e384808aa4d61c2f7d60a7c70cab8ba3f4f4a698862685019ff9aee463a5e901bd96202444b883578d1aac6149f7df4a132011635b58aa772cf5e54be7a2e948dde9409d0eeda8a568f119ed7d178f002a4cc7c6074027c6491b537b6dd0e4062d8c669958ba9f6f1dbda7d617bce197a8c6505492c3428647c1d70f7d5f93db74601997ae662511cbc810f7dbdc0975420b6b17a8df46e05347e06dfef283b0b5c6df8ab050b92f9c0fa815d6fa4eb1cad315"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r2, 0x0, 0x0) 5.583590675s ago: executing program 4 (id=2353): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000780)=@filter={'filter\x00', 0x42, 0x4, 0x298, 0xffffffff, 0x98, 0x98, 0x98, 0xffffffff, 0xffffffff, 0x200, 0x200, 0x200, 0xffffffff, 0x4, 0x0, {[{{@ip={@local, @loopback, 0x0, 0x0, 'team_slave_0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0x98, 0x0, {0x100000000000000}}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}, {{@ip={@multicast1, @loopback, 0x0, 0x0, 'batadv_slave_0\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f8) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000280)=0x1, 0x4) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'bridge_slave_0\x00', 0x0}) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r8 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='io.stat\x00', 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r8, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x140f, 0x800, 0x70bd26, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x80}, 0x44040) sendmsg$nl_route(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYRESOCT=r2, @ANYRES32=0x0, @ANYBLOB="00000000000000004c00128009000100766c616e000000003c00028006000100000000000600050081000000280003800c00010000008004000000000c00010000000000000000000c000100000001000700000008000500", @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r7], 0x7c}, 0x1, 0xba01}, 0x0) 5.567815149s ago: executing program 3 (id=2354): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x20040, 0x0) pipe2(&(0x7f0000000040), 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000600)={0x28, 0x1, 0x4, 0x5, 0x0, 0x0, {}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_MODE={0xa}]}, 0x28}}, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'netdevsim0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x115}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r3}, @IFLA_BROADCAST={0xa, 0x2, @random="669bd3a87f0e"}]}, 0x48}}, 0x0) r5 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000000)={@dev, 0x9, r7}) setsockopt$inet6_mreq(r6, 0x29, 0x1b, &(0x7f0000004c40)={@ipv4={'\x00', '\xff\xff', @remote}, r7}, 0x14) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000400)={0xf0f03e, 0x1}) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000003100)=@gcm_128={{0x303}, "0400", "0d07080d004fcf0000e8ffff1a8600", "cf0d00", "8647e2b7f43be400"}, 0x28) write$binfmt_script(0xffffffffffffffff, &(0x7f0000001300), 0x8f) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x14\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd}]}, 0x24}}, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000200)={&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000740)=0x40) writev(0xffffffffffffffff, &(0x7f00000030c0)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000180)=0x40) writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000240)="12", 0x1}], 0x1) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="400100001000130700000000000000007f000001000000000000000000000000ac1414bb00000000000000000000000000000000000000000300000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000aa0000000032000000fe8000000000000000000000000000aa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000b0000000000"], 0x140}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000400)={{0x12, 0x1, 0x0, 0xe4, 0xc5, 0xad, 0x10, 0x61d, 0xc020, 0x9c15, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x10, 0x2d, 0xb0}}]}}]}}, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), &(0x7f0000000080), 0x2, 0x3) 5.494107878s ago: executing program 1 (id=2355): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, 0x0, 0x0) 5.480713297s ago: executing program 4 (id=2356): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4, 0x8002}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xe2, 0x2, 0x1000, 0x52, 0x2, 0x20, 0x8, 0xf1ff}}, {0x4}}]}]}, 0x58}}, 0x2000400c) 5.357027754s ago: executing program 4 (id=2357): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0xfffd}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x32658aeb}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14}}, 0xcc}}, 0x0) (async) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @loopback}}}}}}, 0x0) (async) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) (async) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000040)) (async) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) (async) r2 = dup2(r0, r0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000040)=0x1) (async, rerun: 32) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x5) (async, rerun: 32) preadv(r2, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/248, 0xf8}], 0x1, 0x0, 0xa13c996b) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$VIDIOC_G_SELECTION(r3, 0xc040565e, &(0x7f0000000480)={0x9, 0x100, 0x0, {0x0, 0x159}}) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r4, &(0x7f00000030c0)={0x0, 0x0, &(0x7f0000003080)={&(0x7f0000000380)=ANY=[@ANYBLOB="30000000030101090069d68367d78a946a0000001c001980080001000900000008000180"], 0x30}}, 0x0) (async) read$FUSE(r2, &(0x7f00000041c0)={0x2020}, 0x2020) close_range(r0, 0xffffffffffffffff, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x5, 0x0, 0x0) (async) fsopen(&(0x7f0000000040)='omfs\x00', 0x1) syz_usb_connect(0x3, 0xfffffffffffffea7, &(0x7f0000000100)=ANY=[@ANYBLOB="12010300bb909398d2ec0fc4a9bf0212f98f35e5518700ab11ceb4cee77c7d9b228afc08de6446380b2ecbbec77f43723958df973e454ee21383f47b1ce9dae0a1f70e2a5a89561244163d06dcc4c6f7002020df0206b8146edf09c56fb4426f46bdf372fdf95bc94ebbc7cbe85039d3e6cfcbf2fd6fce1f6270d886e62eefefb85f2ebfc1cda146cbe6ecb69c1b91bcc151f57e93f081941b6842d79c45b15692361f068853bf888044ca59eaa4c86c253f64e0b7ea1ebdd2d50157696d5d6607e7440989df2cda55"], 0x0) 5.032787163s ago: executing program 4 (id=2358): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040), 0xc, 0x0}, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, 0x0, 0x0) getsockopt$inet_mptcp_buf(r1, 0x11c, 0x3, &(0x7f0000000040)=""/185, &(0x7f0000000100)=0xb9) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, &(0x7f0000000dc0)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 5.031765986s ago: executing program 1 (id=2359): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0x1ffffe, 0x10100, 0x0, 0x0, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@ipv4_newroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc8}}, 0x1c}}, 0x0) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r8, 0x40045569, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) ioctl$UI_DEV_DESTROY(r8, 0x5502) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYBLOB="0000000000000000340012800e00010069703665727370616e00000020000280040012000500160002000000060018000008000005001700"], 0x54}}, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xc2) r9 = socket$inet(0x2, 0x3, 0x4) r10 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)=@newqdisc={0x284, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x9c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x0, 0x0, 0x0, 0x5000000}}, @TCA_HTB_INIT={0x18, 0x2, {0x3, 0xfffffffc}}, @TCA_HTB_INIT={0x18}, @TCA_HTB_DIRECT_QLEN={0x8}, @TCA_HTB_INIT={0x18}, @TCA_HTB_INIT={0x18}, @TCA_HTB_INIT={0x18}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}}, {0x4}}]}, @TCA_STAB={0x198, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x4, 0x9, 0x965, 0x8, 0x2, 0x28, 0x80000001, 0x1}}, {0x6, 0x2, [0xa]}}, {{0x1c, 0x1, {0xc9, 0xf, 0x19, 0x4, 0x1, 0x9, 0x5, 0x3}}, {0xa, 0x2, [0x8, 0xa839, 0x3]}}, {{0x1c, 0x1, {0x9, 0x6, 0xa, 0xb8, 0x0, 0x8001, 0x8001, 0x6}}, {0x10, 0x2, [0x3, 0x4, 0xd, 0x681, 0x1, 0x8001]}}, {{0x1c, 0x1, {0x4, 0xc6, 0x5, 0xc, 0x2, 0x800, 0x5, 0x3}}, {0xa, 0x2, [0x8001, 0xff, 0x2]}}, {{0x1c, 0x1, {0x6, 0x8, 0x2, 0x2, 0x1, 0xf, 0xffff, 0x2}}, {0x8, 0x2, [0x6, 0x7]}}, {{0x1c, 0x1, {0x4, 0x32, 0x56e, 0x2, 0x1, 0x5, 0x7, 0x3}}, {0xa, 0x2, [0x4, 0x2, 0x522]}}, {{0x1c, 0x1, {0x7, 0x0, 0x37b5, 0x1, 0x1, 0x8, 0x970, 0x3}}, {0xa, 0x2, [0x8, 0xf, 0x6]}}, {{0x1c, 0x1, {0xb, 0x7, 0xfffc, 0xa, 0x1, 0x1, 0xfffffff0, 0x7}}, {0x12, 0x2, [0x1, 0x1, 0x2, 0x2, 0x2, 0x800, 0xe]}}, {{0x1c, 0x1, {0x66, 0x0, 0x3, 0x6, 0x0, 0x7f, 0xda18, 0x1}}, {0x6, 0x2, [0x2]}}, {{0x1c, 0x1, {0x3, 0x5, 0x4, 0x4, 0x2, 0x4, 0x8, 0x5}}, {0xe, 0x2, [0x2, 0xe4f, 0xcc, 0x6, 0x6]}}]}]}, 0x284}}, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r5, 0x84, 0x0, &(0x7f0000000200)={0x0, 0x8, 0x20200, 0xe5e1}, &(0x7f0000000240)=0x10) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x1d) socket(0x10, 0x803, 0x0) socket(0x200000100000011, 0x3, 0x0) 1.700603941s ago: executing program 2 (id=2360): unshare(0x20020000) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f00000008c0)}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) (async) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x18, 0x3a, 0xff, @empty, @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @empty, [{0x0, 0x0, 'Qh'}]}}}}}}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff00000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000000000000000000000000100000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x38, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x6, 0x2, [{0x4, 0x7}, {0x7, 0x6}]}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x15}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) (async) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') 1.700044873s ago: executing program 3 (id=2361): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="3c00000010001ffe00989837a182138b00268f1c", @ANYRES32=0x0, @ANYBLOB="ff7f000000050000140012800a00010076786c616e0000000400028008000a00", @ANYRES32], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) 1.333176605s ago: executing program 1 (id=2362): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000037000/0x10000)=nil, 0x10000, 0x3000, 0x3, &(0x7f000061a000/0x3000)=nil) mprotect(&(0x7f0000a00000/0x1000)=nil, 0x1000, 0x6) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x67b}]}, 0x10) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x25, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}}, 0x9c) mremap(&(0x7f0000b29000/0x4000)=nil, 0x4000, 0x3000, 0x3, &(0x7f00005b7000/0x3000)=nil) madvise(&(0x7f000056f000/0x2000)=nil, 0x2000, 0x1) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) 859.023103ms ago: executing program 4 (id=2363): r0 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$KDDELIO(r0, 0x4b35, 0x8) (async) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(0xffffffffffffffff, 0x0, 0x20000800) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) (async) socket$inet6(0xa, 0x3, 0x8000000003c) (async) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_open_dev$audion(0x0, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_GET_SCAN(0xffffffffffffffff, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f000050b000/0x1000)=nil, 0x1000, 0x1000006, 0x10, 0xffffffffffffffff, 0x10000000) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000640)={0x0, 0x9, 0x1, [0xfffffffffffffffd, 0xf, 0x7fffffffffffffff, 0x3fc], [0x100, 0x801, 0x0, 0x0, 0x7, 0x1000000, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x10000000000, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x8, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x100000001, 0x0, 0x0, 0x8000000000000001, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x204, 0x0, 0x0, 0xd74a, 0x20000000000000, 0x0, 0x0, 0x100000, 0x0, 0x0, 0xffc, 0x0, 0x8, 0x0, 0x0, 0xfffffffffffffffd, 0x7, 0x0, 0x0, 0x200, 0x40000000000000, 0x200, 0x4000000, 0x0, 0x3e3, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x40000, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xe000000000, 0x0, 0x3, 0x1, 0x0, 0x4, 0x0, 0x0, 0x2, 0x6, 0x3, 0x1, 0x1, 0x5, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x4000000000]}) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000000480)={0x0, "1e16e4c1a3eafa83c022874b320fa2ad"}) (async) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r0, 0x5000943f, &(0x7f0000000ec0)={{}, 0x0, 0x0, @unused=[0x2, 0x4, 0x4, 0x5], @devid}) (async) syz_open_procfs(0x0, &(0x7f0000000080)='auxv\x00') (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x16) (async) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='numa_maps\x00') (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600707, 0x19) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000003b0007010000000000000000047c0000040000000c00018006000600800a00000c0007000400000004"], 0x30}}, 0x200400c0) (async) syz_io_uring_complete(0x0) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="120100001517ee40f00a057a000001e802010902120001000000000904000000ff054900ce8beaced472f58456e6bcce1d03b909b5fffcba6e6d8ecbd7d420c9525820d06528d072d283768f036c23d83f497ce1049782c199158261ab8ddf0e01163aeac0d8660baa6e3cad6773e25310fa035c92446d8709d0ff53"], 0x0) syz_usb_control_io$printer(r3, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000180)=ANY=[@ANYBLOB="00141100000075cf0000000000000000000000f3ff0000"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x1, 0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010002b1fe9208151403005d65010203010902120001000000000904000000d3a53e00"], &(0x7f0000000e80)={0x0, 0x0, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="050f0f00010a1003000000000000"], 0x1, [{0x0, 0x0}]}) openat$nullb(0xffffff9c, &(0x7f0000000040), 0x200000, 0x0) 217.515576ms ago: executing program 1 (id=2364): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x70) sendmsg$rds(r0, &(0x7f0000000100)={&(0x7f0000000140)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000940)=[@rdma_dest={0x18, 0x10c}, @rdma_dest={0x18, 0x114, 0x2, {0xffffffff, 0x4}}], 0x30, 0x20040054}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f0000000080)=0x9c) ioctl$KVM_CAP_SPLIT_IRQCHIP(r3, 0x4068aea3, &(0x7f0000000240)={0x79, 0x0, 0x1}) ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f0000000080)=ANY=[]) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x40d, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x1}, @IFLA_BR_AGEING_TIME={0x8}]}}}]}, 0x44}}, 0x0) 0s ago: executing program 4 (id=2365): socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009c9abc0825105f0029fe0102030109021200caa70000000904"], 0x0) unshare(0x20020000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000640)={'syztnl2\x00', &(0x7f0000019940)={'ip_vti0\x00', 0x0, 0x1, 0x8000, 0x7, 0xd11, {{0x1f, 0x4, 0x2, 0x5, 0x7c, 0x66, 0x0, 0x3b, 0x2f, 0x0, @local, @rand_addr=0x64010101, {[@ssrr={0x89, 0x17, 0x7b, [@local, @loopback, @multicast1, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x33}]}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x4, 0xc9, 0x3, 0x2}, @lsrr={0x83, 0xb, 0x7a, [@broadcast, @remote]}, @noop, @noop, @timestamp_prespec={0x44, 0x3c, 0xc7, 0x3, 0x1, [{@rand_addr=0x64010102, 0x60b}, {@loopback, 0x9}, {@dev={0xac, 0x14, 0x14, 0x11}}, {@dev={0xac, 0x14, 0x14, 0x32}, 0x4}, {@loopback, 0x2}, {@local}, {@empty, 0x6}]}]}}}}}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000440)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(r4, &(0x7f0000000280)=[{&(0x7f0000000940)=""/102399, 0x18fff}], 0x1, 0x0, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000002c0)={&(0x7f0000000040)="90d30723630f997b34730c3fc4fc3785e3c548bc56e8bcee8a7112af45b6e4a7ce93a3be8429fd2e33407bd5d50463467fc8e2a4bf2f1b6e229bc59ad1d9ce87d7fbffa4bcdc7937f6f5617966fc4d6a630395fafcb34a7f6ed316db445804ec7d114cdc99a7f9ccff6aaaa5f0832e7f559de716275accfbe23d73719c26046b0fb99ca8333c80bd956ff73157318001dd52f1a4bd2b1477dd47535f216df6c467296c8caed8470debbee2705fb38b7cd581f0993952a040ac4b61e6c75dee57c136102a7133f0b1749f278bc3a9e4f2abfa81bc", &(0x7f0000000140)=""/102, &(0x7f0000000300)="5f72b09bef5caaa6bcc6acb0c612497484dce9cea8d73c628ee2bfa6d2fb283c97bc853eca11ed43a02b0926f1b5dbdfff1ab80bc997382fa2dde539cd83169ba64d2cb5902b9bc03fa3256a8fa2540bb1654215500bcb9e", &(0x7f0000000200)="cc2e8b9d92d9f1040bf1a59a471f4a01eac4b7118692d3928bb230547b647b4fec9dda46451cfa160b4a21a1c9ae12cb2b8a94af1745b20b9a799e185d50e9f19802f3aec465385c1cf4b6c61428375f079f8bebc2545900cfbce1206f53a0a20d15d33252169b1ef70578c91f3785db7ff3eba6d0450959905cb4eb56661e92bc98139f87202d95a6aea55692b3b75cb55a0633014a5c8444a53f0b073a3e2cafa9a82ed654bf29cab0cdd557be406fb98a1e9aa9f4", 0x3634aaf, r4}, 0x38) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x8d, 0xc8, 0x31, 0x40, 0x830, 0x60, 0x132b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x15, 0xde, 0x7b}}]}}]}}, 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000280)=ANY=[@ANYBLOB="203023000e003558b9268b9483d65701eaabf7bec68e341df5e99fa4943756600b71c2d36330002679"], &(0x7f00000002c0)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000340)={0x20, 0x0, 0x4, {0x0, 0x3}}, &(0x7f0000000380)=ANY=[@ANYBLOB="20000400fb30e55d2000"], &(0x7f00000003c0)={0x40, 0x7, 0x2, 0x46f}, &(0x7f0000000400)={0x40, 0x9, 0x1}, &(0x7f0000000440)={0x40, 0xb, 0x2, "de7b"}, 0x0, 0x0, &(0x7f0000000500)={0x40, 0x17, 0x6}, 0x0, &(0x7f0000000580)={0x40, 0x1a, 0x2, 0x4}, &(0x7f00000005c0)={0x40, 0x1c, 0x1, 0x8}, &(0x7f0000000600)={0x40, 0x1e, 0x1, 0x8}, 0x0}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000002c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f00000000c0)={0x28, 0x7, r7, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000}) ioctl$FS_IOC_SETFLAGS(r6, 0x40086602, &(0x7f00000004c0)=0x400) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f00000001c0)={0x48, 0x5, r7}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000000000104000000", @ANYRES32, @ANYBLOB="0000f231fb050000008522d94a0000c36239a1c160905cd3ea5a989da42a0878f0dee2", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) ioctl$IOMMU_IOAS_COPY(r6, 0x3b83, &(0x7f0000000480)={0x28, 0x2, r7, r7, 0x254, 0x9, 0x3}) r8 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x881, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r8, 0xc0045009, &(0x7f0000001080)=0x2) renameat(0xffffffffffffffff, &(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00') sendto$packet(0xffffffffffffffff, &(0x7f00000001c0)="f0", 0x1, 0x0, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendmmsg$inet6(r0, &(0x7f0000020880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f000001f800)=[{&(0x7f0000019a40)="3d127bf54460fd7f896eab529c26d7bb6717b3f54ad989dd06fb06988f940eb1fa2de206d237114b2737245199be154bd10fcee7471c8e7a000000000000d114af53827570197c4d8ea89e3e789eabbf09c989a92e2d423222daae0c131a7b8e0c0208a95677eaf32617f7dee05d83fe30545e75fe867931090eec17e900000000fabd4314325208550e7ea6cf00000000000000000011000033f34c535d5e70cc67aa12db293e41b60bf5c6152bafd418640663efbf15bf4d28e5f3cd91b940e03f7498dd56cbf069cbae5c0826f195225e2c7455209247dc08fdebb40079a338cb3c8378781ea175d8f3d6265e43732def509d3baf29e76e03896c4b61", 0xfe}, {0x0}, {&(0x7f0000000800)="fd1e559031fce91997e9faa8bdfa4e2a4747989e25ec61c0dd20f729631858bb537ccf1dda9612f6c72b5261306abd9e273de19bdf31161f4c90139673a7260db68743e5bfecc854709f", 0x4a}, {&(0x7f0000000540)="ff7d6ec6d9fd304df7c7abfe56d985bd4cd5bed44fe44ee266fca439379b120d6b69", 0x22}, {&(0x7f000001f500)="3b51a03f34a344c8901007e804eb70926b59", 0x12}, {&(0x7f000001f540)}, {&(0x7f000001f640)="c6f7b37fac7cacaac24949a0c37bacb74b47c57b593a8af020e8d63a41c4b5da49e737ef4418dad3f39071845903f6a79a75fcb59c04301618f0959348116352c33604b0ee5d1ac4ced406ba553f6b1c141fb0e8193c50ebe7ce7c", 0x5b}, {&(0x7f000001f700)="c2290bbfb1fbc024951155d07d8904d485f3cb2c0540bcae4935ba0be4c7fce8337a30627a47cd0342e0b253c88f952f61f65cc55edc", 0x36}, {&(0x7f000001f740)="48fa786266eeec12d479574270d6d0d63438276734f2f2630c812451f9f19ad36ad9b6ea82a5dd28990e49f784b8bc89198c0a5c2700b367a30393403ea300d7683cc8204102f46add8a1a42545120efe20d9bda8866f1f439e7bff761691ea63f05218b8470108cf92768eabffc0a4451014bc84a536f3877e212373e75b0c5860c0f4c8b4b02e46709ec906c215dce", 0x90}], 0x9, &(0x7f0000019fc0)=ANY=[@ANYBLOB="780000000000000029000000390000003c0c020300000000ff010000000000000000000000000001fe8000000000000000000000000000bb000000000000000000000000000000010000000000000000000000000000000120010000000000000000000000000000fe800000000000000000000000000040200000000000000034000000360000003a000000000000000401680000000000500000000000000029000000370000006c0600000000000005020100c910fc020000000000000000000000000001010000010007100000000302019b23ffffff7f00000000c204000001ff040102000048000000000000002900000039000000040601080000000000000000000000000000000000000000ff020000000000000000000000000001ff010000000000000000000000000001200100000000000029000000040000008720000000000000c91020010000000000000000000000000001ffc5de310ca5492a0b3202a82d21b97164490f55e9c3f734e3827c3af895bb79709cb64a6674d29eb3c7561e4cd12260a789368ca2999640c378a2411812651ec573d210f32024c0732a9a1bbebc1727ccba5cc7ed05dd57df6eb5df9bc728a499d87b5a97f1412b28eb2f2da9089aeea9a08cbc330c8c0ac7d81dfe6c2786129d72ea850e56c0e9f57247fd58d311326b0a6d217ced70cbc6b0b4a5d36b27790e8f537721e9fb6a47279984c5ec8ae610ed5bdf264a3af30ff46db6fe8b5f2e30f1d7ca91f125c91000000000000000000000ffff0000000005020001c910fe88000000000000000000000000000100000000000000140000000000000029000000430000000700000000000000"], 0x268}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000020840)=[{0x0}, {0x0}], 0x2}}], 0x4, 0x225ae3e7683dfd9f) setns(0xffffffffffffffff, 0x20000) syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x0) kernel console output (not intermixed with test programs): read error: -22 [ 605.808695][ T5288] usb 3-1: New USB device found, idVendor=1415, idProduct=0003, bcdDevice=65.5d [ 605.821709][ T5288] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.833205][ T5288] usb 3-1: config 0 descriptor?? [ 605.946122][T16214] netlink: 'syz.1.2117': attribute type 21 has an invalid length. [ 605.954293][T16214] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2117'. [ 605.978796][T16214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 605.993987][T16214] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 606.011305][ T5288] usb 2-1: USB disconnect, device number 113 [ 606.018856][ T5235] Bluetooth: hci5: command tx timeout [ 606.062734][T16216] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 606.071764][T16216] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 606.081005][T16216] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 606.090089][T16216] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 606.102184][T16216] vxlan0: entered promiscuous mode [ 606.117704][T16216] vxlan0: entered allmulticast mode [ 606.129617][T16216] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 606.138694][T16216] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 606.147736][T16216] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 606.156706][T16216] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 606.298217][ T5238] usb 3-1: USB disconnect, device number 4 [ 606.637764][T16228] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 606.646924][T16228] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 606.656391][T16228] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 606.665455][T16228] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 606.674785][T16228] vxlan0: entered promiscuous mode [ 606.679933][T16228] vxlan0: entered allmulticast mode [ 606.695587][T16228] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 606.704625][T16228] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 606.713783][T16228] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 606.722668][T16228] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 606.910034][T16233] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2122'. [ 607.063894][ T5289] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 607.233754][ T1847] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 607.245431][ T5289] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 607.257137][ T5289] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 104, changing to 10 [ 607.283611][ T5289] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 1730, setting to 1024 [ 607.313614][ T5289] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 607.326782][ T5289] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 607.336016][ T5289] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.349129][ T5289] usb 5-1: config 0 descriptor?? [ 607.356504][T16230] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 607.397328][ T1847] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 607.414248][ T1847] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.435507][ T1847] usb 2-1: config 0 descriptor?? [ 607.662755][ T1847] [drm] vendor descriptor length:e0 data:00 00 00 00 00 00 00 00 00 00 00 [ 607.683623][ T1847] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 607.726089][ T1847] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 607.770702][ T1847] [drm] Initialized udl on minor 2 [ 607.785880][ T5289] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 607.794805][T16178] usbtmc 4-1:16.0: usb_control_msg returned -110 [ 607.813738][ T5289] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 607.822681][ T5289] plantronics 0003:047F:FFFF.0013: No inputs registered, leaving [ 607.991440][ T5282] usb 4-1: USB disconnect, device number 17 [ 608.031929][ T5289] plantronics 0003:047F:FFFF.0013: hiddev1,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 608.050304][ T55] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 608.061880][ T55] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 608.072234][ T55] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 608.081567][ T55] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 608.089323][ T55] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 608.097796][ T55] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 608.482598][T16249] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2126'. [ 608.559704][T16244] chnl_net:caif_netlink_parms(): no params data found [ 608.640602][ T5279] usb 5-1: USB disconnect, device number 77 [ 608.760354][T16244] bridge0: port 1(bridge_slave_0) entered blocking state [ 608.798802][T16244] bridge0: port 1(bridge_slave_0) entered disabled state [ 608.822881][T16244] bridge_slave_0: entered allmulticast mode [ 608.858343][T16244] bridge_slave_0: entered promiscuous mode [ 608.892442][T16244] bridge0: port 2(bridge_slave_1) entered blocking state [ 608.904272][T16244] bridge0: port 2(bridge_slave_1) entered disabled state [ 608.911763][T16244] bridge_slave_1: entered allmulticast mode [ 608.924373][T16244] bridge_slave_1: entered promiscuous mode [ 608.982699][T16244] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 609.009829][T16244] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 609.096746][T16244] team0: Port device team_slave_0 added [ 609.115077][T16244] team0: Port device team_slave_1 added [ 609.145175][ T5279] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 609.181822][T16244] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 609.208420][T16244] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 609.284067][T16244] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 609.323725][ T5279] usb 5-1: Using ep0 maxpacket: 8 [ 609.342471][T16244] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 609.357846][ T5279] usb 5-1: config 0 has an invalid interface number: 33 but max is 1 [ 609.363682][T16244] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 609.367170][ T5279] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 609.414779][ T5279] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 609.433611][ T5279] usb 5-1: config 0 has no interface number 0 [ 609.450133][ T5279] usb 5-1: config 0 interface 33 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 609.453470][T16244] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 609.485639][ T5279] usb 5-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 609.495258][ T5279] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.504979][ T5279] usb 5-1: Product: syz [ 609.519646][ T5279] usb 5-1: Manufacturer: syz [ 609.555963][ T5279] usb 5-1: SerialNumber: syz [ 609.612734][T16244] hsr_slave_0: entered promiscuous mode [ 609.614016][ T5279] usb 5-1: config 0 descriptor?? [ 609.634767][T16244] hsr_slave_1: entered promiscuous mode [ 609.646889][ T5279] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 609.656826][T16244] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 609.673497][T16244] Cannot create hsr debugfs directory [ 609.857121][ T2034] pvrusb2: Invalid write control endpoint [ 609.904808][ T2034] usb 5-1: Direct firmware load for v4l-pvrusb2-29xxx-01.fw failed with error -2 [ 609.915749][ T2034] usb 5-1: Falling back to sysfs fallback for: v4l-pvrusb2-29xxx-01.fw [ 609.962327][T16272] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2131'. [ 610.069935][ T5288] usb 5-1: USB disconnect, device number 78 [ 610.140149][T16244] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 610.176711][ T5235] Bluetooth: hci6: command tx timeout [ 610.194922][ T1847] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 610.207197][ T1847] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 610.222564][ T52] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 610.234991][ T1847] usb 2-1: USB disconnect, device number 114 [ 610.271856][ T52] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 610.331281][T16244] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 610.425736][T16244] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 610.541869][T16244] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 610.723798][T16244] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 610.774488][T16244] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 610.809566][T16282] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2134'. [ 610.883769][T16244] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 610.892825][T16244] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 611.092649][T16244] 8021q: adding VLAN 0 to HW filter on device bond0 [ 611.173406][T16244] 8021q: adding VLAN 0 to HW filter on device team0 [ 611.214046][ T7578] bridge0: port 1(bridge_slave_0) entered blocking state [ 611.221153][ T7578] bridge0: port 1(bridge_slave_0) entered forwarding state [ 611.262685][ T7578] bridge0: port 2(bridge_slave_1) entered blocking state [ 611.269805][ T7578] bridge0: port 2(bridge_slave_1) entered forwarding state [ 611.397424][T16244] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 611.411576][T16244] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 611.470265][T16244] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 611.589677][T16293] loop8: detected capacity change from 0 to 7 [ 611.601101][T16293] Dev loop8: unable to read RDB block 7 [ 611.633802][T16293] loop8: unable to read partition table [ 611.643080][T16293] loop8: partition table beyond EOD, truncated [ 611.663059][T16293] loop_reread_partitions: partition scan of loop8 (þ被xüŸÑø éÚ¬§½dƤ´à–ƒÝ¡¯¨â·û [ 611.663059][T16293] ) failed (rc=-5) [ 611.690562][ T7584] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.825632][ T5284] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 611.896643][ T7584] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.977777][T16244] veth0_vlan: entered promiscuous mode [ 611.993622][ T5284] usb 3-1: Using ep0 maxpacket: 16 [ 612.012272][ T5284] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 612.030769][ T5284] usb 3-1: config 0 has no interface number 0 [ 612.044237][ T5284] usb 3-1: config 0 interface 8 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 612.062277][ T7584] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.086093][ T5284] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 612.103550][ T5284] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 612.111852][ T5284] usb 3-1: Product: syz [ 612.122018][ T5284] usb 3-1: SerialNumber: syz [ 612.130749][T16244] veth1_vlan: entered promiscuous mode [ 612.153067][ T5284] usb 3-1: config 0 descriptor?? [ 612.187253][ T5284] usbhid 3-1:0.8: couldn't find an input interrupt endpoint [ 612.235270][ T7584] team0: Port device netdevsim0 removed [ 612.266969][ T5235] Bluetooth: hci6: command tx timeout [ 612.282026][ T7584] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.414279][T16244] veth0_macvtap: entered promiscuous mode [ 612.426572][T16244] veth1_macvtap: entered promiscuous mode [ 612.434938][ T55] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 612.449001][ T55] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 612.457329][ T55] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 612.476343][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 612.487282][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.497881][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 612.508747][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.518729][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 612.529334][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.539411][ T55] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 612.546801][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 612.559600][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.570382][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 612.580996][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.590995][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 612.601549][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.611552][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 612.622105][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.663559][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 612.684239][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.696233][ T55] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 612.702952][T16244] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 612.704113][ T55] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 612.713337][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.727926][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.737871][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.748350][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.758374][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.768888][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.779679][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.790959][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.800904][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.811386][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.821676][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.832206][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.842100][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.852638][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.862515][T16244] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 612.873025][T16244] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 612.886482][T16244] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 612.896772][T16244] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.905590][T16244] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.914328][T16244] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.923024][T16244] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 613.447246][ T5289] usb 3-1: USB disconnect, device number 5 [ 613.499315][ T7584] bridge_slave_1: left allmulticast mode [ 613.528050][ T7584] bridge_slave_1: left promiscuous mode [ 613.557077][ T7584] bridge0: port 2(bridge_slave_1) entered disabled state [ 613.596112][T16317] input: syz0 as /devices/virtual/input/input177 [ 613.623118][ T7584] bridge_slave_0: left allmulticast mode [ 613.648662][ T7584] bridge_slave_0: left promiscuous mode [ 613.678543][ T7584] bridge0: port 1(bridge_slave_0) entered disabled state [ 614.209524][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.244669][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.338714][ T5235] Bluetooth: hci6: command tx timeout [ 614.350254][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.368806][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.379063][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.388309][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.397950][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.406317][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.431630][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.441654][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.451370][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.469070][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.485924][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.500418][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.509120][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.527632][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.543143][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.552085][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.560641][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.569495][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.578059][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.586369][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.594878][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.602880][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.611486][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.621285][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.629474][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.637521][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.645672][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.655296][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.663304][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.671485][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.679728][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.687789][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.696176][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.731968][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.749262][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.757599][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.784829][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.792817][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.819811][ T5235] Bluetooth: hci3: command tx timeout [ 614.819933][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.820017][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.853586][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.882094][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.890239][ T7584] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 614.899626][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.910421][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.910821][ T7584] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 614.929051][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.937881][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.947346][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.957728][ T7584] bond0 (unregistering): Released all slaves [ 614.968461][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.968548][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 614.986430][T16339] binder: 16337:16339 ioctl c00c6211 9999999999999999 returned -14 [ 615.004001][T16317] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2146'. [ 615.286582][ T29] kauditd_printk_skb: 802 callbacks suppressed [ 615.286600][ T29] audit: type=1326 audit(1728244685.358:1355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16356 comm="syz.2.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c8f17dff9 code=0x7ffc0000 [ 615.333942][ T29] audit: type=1326 audit(1728244685.388:1356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16356 comm="syz.2.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c8f17dff9 code=0x7ffc0000 [ 615.341887][ T7578] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 615.392635][ T7578] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 615.473589][ T29] audit: type=1326 audit(1728244685.388:1357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16356 comm="syz.2.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=277 compat=0 ip=0x7f0c8f17dff9 code=0x7ffc0000 [ 615.505471][ T5238] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 615.551135][ T29] audit: type=1326 audit(1728244685.388:1358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16356 comm="syz.2.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c8f17dff9 code=0x7ffc0000 [ 615.608215][ T29] audit: type=1326 audit(1728244685.388:1359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16356 comm="syz.2.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c8f17dff9 code=0x7ffc0000 [ 615.648727][ T29] audit: type=1326 audit(1728244685.388:1360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16356 comm="syz.2.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f0c8f17dff9 code=0x7ffc0000 [ 615.687489][ T29] audit: type=1326 audit(1728244685.388:1361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16356 comm="syz.2.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c8f17dff9 code=0x7ffc0000 [ 615.710268][T16308] chnl_net:caif_netlink_parms(): no params data found [ 615.718000][ T5238] usb 4-1: Using ep0 maxpacket: 16 [ 615.724697][ T29] audit: type=1326 audit(1728244685.388:1362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16356 comm="syz.2.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c8f17dff9 code=0x7ffc0000 [ 615.749148][ T5238] usb 4-1: config 0 has an invalid interface number: 104 but max is 1 [ 615.759405][ T5238] usb 4-1: config 0 has an invalid interface number: 104 but max is 1 [ 615.760176][ T7582] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 615.769327][ T5238] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 615.785294][ T5238] usb 4-1: config 0 has no interface number 0 [ 615.791568][ T5238] usb 4-1: config 0 interface 104 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 615.805337][ T29] audit: type=1326 audit(1728244685.388:1363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16356 comm="syz.2.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f0c8f17dff9 code=0x7ffc0000 [ 615.815455][ T7582] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 615.843798][ T5238] usb 4-1: config 0 interface 104 has no altsetting 1 [ 615.867008][ T5238] usb 4-1: New USB device found, idVendor=1189, idProduct=0893, bcdDevice= 6.79 [ 615.877361][ T29] audit: type=1326 audit(1728244685.398:1364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16356 comm="syz.2.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c8f17dff9 code=0x7ffc0000 [ 615.877439][ T5238] usb 4-1: New USB device strings: Mfr=0, Product=189, SerialNumber=3 [ 615.918446][ T7584] hsr_slave_0: left promiscuous mode [ 615.930826][ T5238] usb 4-1: Product: syz [ 615.935803][ T7584] hsr_slave_1: left promiscuous mode [ 615.950189][ T7584] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 615.958014][ T7584] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 615.965386][ T5238] usb 4-1: SerialNumber: syz [ 615.970922][ T7584] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 615.979921][ T7584] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 615.988463][ T5238] usb 4-1: config 0 descriptor?? [ 616.039714][ T7584] veth1_macvtap: left promiscuous mode [ 616.045829][ T7584] veth0_macvtap: left promiscuous mode [ 616.061396][ T7584] veth1_vlan: left promiscuous mode [ 616.072622][ T7584] veth0_vlan: left promiscuous mode [ 616.206409][ T5238] asix 4-1:0.104 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 616.243951][ T5238] asix 4-1:0.104: probe with driver asix failed with error -71 [ 616.294718][ T5238] usb 4-1: USB disconnect, device number 18 [ 616.418135][ T5235] Bluetooth: hci6: command tx timeout [ 616.902246][ T5235] Bluetooth: hci3: command tx timeout [ 617.243956][ T7584] team0 (unregistering): Port device team_slave_1 removed [ 617.368625][ T7584] team0 (unregistering): Port device team_slave_0 removed [ 618.115079][T16386] rdma_op ffff88807bfe09f0 conn xmit_rdma 0000000000000000 [ 618.122783][T16386] netlink: 276 bytes leftover after parsing attributes in process `syz.4.2158'. [ 618.204213][T16381] pimreg3: entered allmulticast mode [ 618.342556][T16308] bridge0: port 1(bridge_slave_0) entered blocking state [ 618.379666][T16308] bridge0: port 1(bridge_slave_0) entered disabled state [ 618.399460][T16396] input: syz0 as /devices/virtual/input/input178 [ 618.407357][T16308] bridge_slave_0: entered allmulticast mode [ 618.427020][T16308] bridge_slave_0: entered promiscuous mode [ 618.450619][T16381] pimreg3: left allmulticast mode [ 618.523567][ T1847] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 618.558767][T16396] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2160'. [ 618.585238][T16308] bridge0: port 2(bridge_slave_1) entered blocking state [ 618.633883][T16308] bridge0: port 2(bridge_slave_1) entered disabled state [ 618.641143][T16308] bridge_slave_1: entered allmulticast mode [ 618.660084][T16308] bridge_slave_1: entered promiscuous mode [ 618.708019][ T1847] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 618.719679][ T1847] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 618.731542][ T1847] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 618.741649][ T1847] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 618.749764][ T1847] usb 3-1: SerialNumber: syz [ 618.945370][T16308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 618.967011][T16391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 618.976187][ T5235] Bluetooth: hci3: command tx timeout [ 618.997906][T16308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 619.030932][T16391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 619.339991][T16308] team0: Port device team_slave_0 added [ 619.358340][T16308] team0: Port device team_slave_1 added [ 619.465980][T16308] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 619.488314][T16308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 619.590198][T16308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 619.632622][T16308] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 619.656206][T16308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 619.717547][T16308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 619.852338][ T1847] usb 3-1: 0:2 : does not exist [ 619.879090][ T1847] usb 3-1: USB disconnect, device number 6 [ 619.906161][T16308] hsr_slave_0: entered promiscuous mode [ 619.926204][T16444] Cannot find set identified by id 65535 to match [ 619.944214][T16308] hsr_slave_1: entered promiscuous mode [ 619.977968][T16308] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 620.006767][ T5243] udevd[5243]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 620.041276][T16308] Cannot create hsr debugfs directory [ 620.333686][ T1847] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 620.495472][ T1847] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 620.538921][ T1847] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 620.549273][ T1847] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 620.559822][ T1847] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 620.584223][ T1847] usb 3-1: config 0 descriptor?? [ 620.617112][T16461] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2168'. [ 621.018518][T16476] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 621.052764][T16476] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 621.068569][ T5235] Bluetooth: hci3: command tx timeout [ 621.076607][T16308] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 621.087172][T16308] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 621.098674][T16308] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 621.143166][T16308] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 621.448907][T16308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 621.513293][T16308] 8021q: adding VLAN 0 to HW filter on device team0 [ 621.554698][ T7584] bridge0: port 1(bridge_slave_0) entered blocking state [ 621.561848][ T7584] bridge0: port 1(bridge_slave_0) entered forwarding state [ 621.667503][ T7584] bridge0: port 2(bridge_slave_1) entered blocking state [ 621.674702][ T7584] bridge0: port 2(bridge_slave_1) entered forwarding state [ 621.760731][T16446] bridge0: port 3(vlan2) entered blocking state [ 621.772449][T16446] bridge0: port 3(vlan2) entered disabled state [ 621.786696][T16446] vlan2: entered allmulticast mode [ 621.796730][T16446] vlan2: entered promiscuous mode [ 621.846443][ T1847] uclogic 0003:256C:006D.0014: failed retrieving string descriptor #200: -71 [ 621.885056][ T1847] uclogic 0003:256C:006D.0014: failed retrieving pen parameters: -71 [ 621.917616][ T1847] uclogic 0003:256C:006D.0014: failed probing pen v2 parameters: -71 [ 621.932654][ T1847] uclogic 0003:256C:006D.0014: failed probing parameters: -71 [ 621.942653][ T1847] uclogic 0003:256C:006D.0014: probe with driver uclogic failed with error -71 [ 621.944517][ T5281] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 621.970220][ T1847] usb 3-1: USB disconnect, device number 7 [ 622.046545][T16308] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 622.187909][T16308] veth0_vlan: entered promiscuous mode [ 622.225340][ T5281] usb 4-1: config 0 has an invalid interface number: 117 but max is 0 [ 622.240574][T16308] veth1_vlan: entered promiscuous mode [ 622.258992][ T5281] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 622.302303][T16308] veth0_macvtap: entered promiscuous mode [ 622.313816][ T5281] usb 4-1: config 0 has no interface number 0 [ 622.319944][ T5281] usb 4-1: too many endpoints for config 0 interface 117 altsetting 0: 239, using maximum allowed: 30 [ 622.328697][T16308] veth1_macvtap: entered promiscuous mode [ 622.367000][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 622.393858][ T5281] usb 4-1: config 0 interface 117 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 239 [ 622.424996][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 622.450839][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 622.470886][ T5281] usb 4-1: New USB device found, idVendor=0742, idProduct=2009, bcdDevice=61.46 [ 622.479109][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 622.510510][ T5281] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 622.518383][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 622.539238][ T5281] usb 4-1: Product: syz [ 622.550441][ T5281] usb 4-1: Manufacturer: syz [ 622.562453][ T5281] usb 4-1: SerialNumber: syz [ 622.579483][ T5281] usb 4-1: config 0 descriptor?? [ 622.588514][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 622.621601][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 622.652594][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 622.673019][ T5281] HFC-S_USB 4-1:0.117: probe with driver HFC-S_USB failed with error -5 [ 622.695083][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 622.740759][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 622.799148][T16515] input: syz0 as /devices/virtual/input/input179 [ 622.815782][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 622.875417][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 622.945903][T16520] netlink: 'syz.3.2172': attribute type 3 has an invalid length. [ 622.971258][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 623.001790][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.023856][T16520] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.2172'. [ 623.043580][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 623.086517][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.176316][T16308] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 623.213330][T16521] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2174'. [ 623.349407][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 623.369215][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.470675][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 623.534389][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.568024][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 623.579733][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.635897][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 623.663949][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.673916][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 623.691563][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.761527][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 623.813700][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.823656][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 623.836330][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.851630][T16308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 623.862567][T16308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.924718][T16308] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 623.976919][T16308] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.005213][ T9] usb 4-1: USB disconnect, device number 19 [ 624.027815][T16308] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.068717][T16308] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.102818][T16308] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.300659][T16564] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2177'. [ 624.347428][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 624.377952][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 624.428936][T16567] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.438147][T16567] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.447652][T16567] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.457034][T16567] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.478313][T16567] vxlan0: entered promiscuous mode [ 624.487254][T16567] vxlan0: entered allmulticast mode [ 624.505426][T16567] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 624.514561][T16567] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 624.523871][T16567] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 624.532768][T16567] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 624.572589][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 624.580692][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 624.663977][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.670315][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.832299][T16575] bridge0: port 2(bridge_slave_1) entered disabled state [ 624.839661][T16575] bridge0: port 1(bridge_slave_0) entered disabled state [ 625.003688][ T5279] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 625.279225][T16587] binder: 16586:16587 ioctl 9201 0 returned -22 [ 625.295614][T16588] binder: 16586:16588 ioctl c0306201 20000480 returned -22 [ 625.313120][ T5279] usb 4-1: config 1 has an invalid descriptor of length 94, skipping remainder of the config [ 625.313732][ T5235] Bluetooth: hci6: Controller not accepting commands anymore: ncmd = 0 [ 625.323501][ T5279] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 625.336100][ T5235] Bluetooth: hci6: Injecting HCI hardware error event [ 625.350904][ T5235] Bluetooth: hci6: hardware error 0x00 [ 625.434409][ T5279] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 625.460189][ T5279] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.488154][ T5279] usb 4-1: Product: syz [ 625.498206][ T5279] usb 4-1: Manufacturer: syz [ 625.506589][ T5279] usb 4-1: SerialNumber: syz [ 625.607296][T16592] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.616612][T16592] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.625495][T16592] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.634390][T16592] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.645871][T16592] vxlan0: entered promiscuous mode [ 625.651026][T16592] vxlan0: entered allmulticast mode [ 625.677991][T16592] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 625.687265][T16592] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 625.696563][T16592] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 625.705650][T16592] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 625.999124][T16577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 626.052364][T16597] input: syz0 as /devices/virtual/input/input180 [ 626.074404][T16577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.110092][T16597] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2186'. [ 626.594986][T16608] vxlan0: entered allmulticast mode [ 627.352479][ T5279] usb 4-1: 0:2 : does not exist [ 627.398699][ T5279] usb 4-1: USB disconnect, device number 20 [ 627.527076][T16626] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 627.542626][T16626] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 627.543656][ T9] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 627.563077][T16626] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 627.587995][T16626] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 627.617976][ T5235] Bluetooth: hci6: Opcode 0x0c03 failed: -110 [ 627.893010][T16632] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 627.925003][T16632] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 628.086146][T16634] syz_tun: entered promiscuous mode [ 628.149122][T16634] syz_tun: left promiscuous mode [ 628.270099][T16644] input: syz1 as /devices/virtual/input/input181 [ 628.386716][T16646] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2201'. [ 628.505984][T16655] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2201'. [ 628.565447][T16656] input: syz0 as /devices/virtual/input/input182 [ 628.641269][T16661] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2202'. [ 628.720887][T16646] openvswitch: netlink: Missing key (keys=8040, expected=200000) [ 629.265647][T16677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 629.319401][T16677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 629.353796][ T52] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 629.523756][ T52] usb 4-1: Using ep0 maxpacket: 16 [ 629.543106][ T52] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 629.543141][ T52] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 629.543176][ T52] usb 4-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 629.543201][ T52] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.545259][ T52] usb 4-1: config 0 descriptor?? [ 629.629546][T16688] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 629.816250][ T7578] vlan4: left allmulticast mode [ 629.824041][ T7578] xfrm0: left allmulticast mode [ 629.828954][ T7578] vlan4: left promiscuous mode [ 629.834915][ T7578] xfrm0: left promiscuous mode [ 629.840077][ T7578] bridge0: port 4(vlan4) entered disabled state [ 629.849026][ T7578] erspan0: left allmulticast mode [ 629.854939][ T7578] erspan0: left promiscuous mode [ 629.860078][ T7578] bridge0: port 3(erspan0) entered disabled state [ 629.879202][ T7578] bridge_slave_1: left allmulticast mode [ 629.885759][ T7578] bridge_slave_1: left promiscuous mode [ 629.891955][ T7578] bridge0: port 2(bridge_slave_1) entered disabled state [ 629.911304][ T7578] bridge_slave_0: left allmulticast mode [ 629.920450][ T7578] bridge_slave_0: left promiscuous mode [ 629.926388][ T7578] bridge0: port 1(bridge_slave_0) entered disabled state [ 629.956489][T16673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 629.977690][T16673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.053572][ T5279] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 630.193800][ T5279] usb 3-1: device descriptor read/64, error -71 [ 630.209101][ T52] usb 4-1: string descriptor 0 read error: -71 [ 630.254358][ T52] usb 4-1: Max retries (5) exceeded reading string descriptor 200 [ 630.262368][ T52] letsketch 0003:6161:4D15.0015: probe with driver letsketch failed with error -32 [ 630.292848][ T52] usb 4-1: USB disconnect, device number 21 [ 630.351527][T16698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.369927][T16698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.397661][T16698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.417417][T16698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.426125][T16698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.438990][T16698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.450852][T16698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.460617][T16698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.464195][ T5279] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 630.472204][T16698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.498708][T16698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.510782][T16698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.522276][T16698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.603630][ T5279] usb 3-1: device descriptor read/64, error -71 [ 630.610575][ T7578] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 630.614518][T16703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.635409][T16703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.645539][ T7578] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 630.666585][ T7578] bond0 (unregistering): Released all slaves [ 630.714369][ T5279] usb usb3-port1: attempt power cycle [ 630.831207][T16713] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2217'. [ 630.845713][T16716] IPVS: lc: SCTP 172.20.20.187:0 - no destination available [ 630.866491][ T5284] IPVS: starting estimator thread 0... [ 630.911241][T16719] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 630.941053][ T7578] mac80211_hwsim hwsim84 wlan1 (unregistering): left allmulticast mode [ 630.974311][T16718] IPVS: using max 19 ests per chain, 45600 per kthread [ 631.011575][T16717] vxlan0: entered promiscuous mode [ 631.066087][ T5279] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 631.112409][ T5279] usb 3-1: device descriptor read/8, error -71 [ 631.113659][T16727] netlink: 176 bytes leftover after parsing attributes in process `syz.1.2222'. [ 631.240646][ T7578] hsr_slave_0: left promiscuous mode [ 631.252094][ T7578] hsr_slave_1: left promiscuous mode [ 631.270646][ T7578] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 631.278613][ T7578] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 631.288314][ T7578] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 631.298331][ T7578] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 631.334569][ T7578] veth1_macvtap: left promiscuous mode [ 631.340150][ T7578] veth0_macvtap: left promiscuous mode [ 631.346220][ T7578] veth1_vlan: left promiscuous mode [ 631.352753][ T7578] veth0_vlan: left promiscuous mode [ 631.353552][ T29] kauditd_printk_skb: 45 callbacks suppressed [ 631.353566][ T29] audit: type=1326 audit(1728244701.418:1410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16736 comm="syz.1.2225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5dbd77dff9 code=0x7ffc0000 [ 631.387285][ T5279] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 631.396452][ T29] audit: type=1326 audit(1728244701.418:1411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16736 comm="syz.1.2225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5dbd77dff9 code=0x7ffc0000 [ 631.421218][ T29] audit: type=1326 audit(1728244701.468:1412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16736 comm="syz.1.2225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f5dbd77dff9 code=0x7ffc0000 [ 631.454176][ T5279] usb 3-1: device descriptor read/8, error -71 [ 631.461925][ T29] audit: type=1326 audit(1728244701.468:1413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16736 comm="syz.1.2225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5dbd77dff9 code=0x7ffc0000 [ 631.485003][ T29] audit: type=1326 audit(1728244701.468:1414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16736 comm="syz.1.2225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5dbd77dff9 code=0x7ffc0000 [ 631.509343][ T29] audit: type=1326 audit(1728244701.468:1415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16736 comm="syz.1.2225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f5dbd77dff9 code=0x7ffc0000 [ 631.531691][ C1] vkms_vblank_simulate: vblank timer overrun [ 631.549365][ T29] audit: type=1326 audit(1728244701.468:1416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16736 comm="syz.1.2225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5dbd77dff9 code=0x7ffc0000 [ 631.583960][ T5279] usb usb3-port1: unable to enumerate USB device [ 631.599328][ T29] audit: type=1326 audit(1728244701.468:1417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16736 comm="syz.1.2225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5dbd77dff9 code=0x7ffc0000 [ 631.626825][ T29] audit: type=1326 audit(1728244701.468:1418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16736 comm="syz.1.2225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5dbd77dff9 code=0x7ffc0000 [ 631.649247][ C1] vkms_vblank_simulate: vblank timer overrun [ 631.659803][ T29] audit: type=1326 audit(1728244701.468:1419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16736 comm="syz.1.2225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f5dbd77dff9 code=0x7ffc0000 [ 631.682138][ C1] vkms_vblank_simulate: vblank timer overrun [ 631.754560][T16742] dccp_invalid_packet: invalid packet type [ 631.865081][T16745] netlink: 'syz.3.2228': attribute type 1 has an invalid length. [ 631.887634][T16745] netlink: 157116 bytes leftover after parsing attributes in process `syz.3.2228'. [ 632.519959][ T7578] team0 (unregistering): Port device team_slave_1 removed [ 632.621808][ T7578] team0 (unregistering): Port device team_slave_0 removed [ 633.605532][T16774] sctp: [Deprecated]: syz.0.2237 (pid 16774) Use of struct sctp_assoc_value in delayed_ack socket option. [ 633.605532][T16774] Use struct sctp_sack_info instead [ 633.633907][ T9] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 633.753761][ T5289] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 633.813635][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 633.838908][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 633.853934][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 633.865260][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 633.879795][ T9] usb 3-1: New USB device found, idVendor=1e7d, idProduct=31ce, bcdDevice= 0.00 [ 633.889552][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.900534][ T9] usb 3-1: config 0 descriptor?? [ 633.908182][T16781] netlink: ct family unspecified [ 633.913158][T16781] openvswitch: netlink: Actions may not be safe on all matching packets [ 633.928003][T16781] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2239'. [ 633.943229][ T5289] usb 4-1: Using ep0 maxpacket: 32 [ 633.951589][ T5289] usb 4-1: config 0 has an invalid interface number: 231 but max is 0 [ 633.960250][ T5289] usb 4-1: config 0 has no interface number 0 [ 633.968775][ T5289] usb 4-1: config 0 interface 231 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 633.968896][T16781] sch_tbf: burst 511 is lower than device veth3 mtu (1514) ! [ 633.980715][ T5289] usb 4-1: config 0 interface 231 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8 [ 634.000721][ T5289] usb 4-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 634.021261][ T5289] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.029462][ T5289] usb 4-1: Product: syz [ 634.033835][ T5289] usb 4-1: Manufacturer: syz [ 634.038471][ T5289] usb 4-1: SerialNumber: syz [ 634.084665][ T5289] usb 4-1: config 0 descriptor?? [ 634.090700][T16770] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 634.108530][T16770] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 634.129462][ T5289] plusb 4-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.3-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, c6:03:46:67:9c:da [ 634.193053][T16786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 634.214658][T16786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 634.345972][T16770] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 634.354648][ T5281] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 634.366186][ T9] ryos 0003:1E7D:31CE.0016: unknown main item tag 0x0 [ 634.373021][ T9] ryos 0003:1E7D:31CE.0016: unbalanced delimiter at end of report description [ 634.383185][ T9] ryos 0003:1E7D:31CE.0016: parse failed [ 634.389624][ T9] ryos 0003:1E7D:31CE.0016: probe with driver ryos failed with error -22 [ 634.400412][T16770] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 634.414598][ T5279] usb 4-1: USB disconnect, device number 22 [ 634.426134][ T5279] plusb 4-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.3-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 634.564632][ T5281] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 634.568216][ T5284] usb 3-1: USB disconnect, device number 12 [ 634.572232][ T5281] usb 2-1: can't read configurations, error -61 [ 634.693744][ T5281] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 634.904734][ T5281] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 634.912333][ T5281] usb 2-1: can't read configurations, error -61 [ 634.924208][T16813] input: syz0 as /devices/virtual/input/input183 [ 634.930734][ T5281] usb usb2-port1: attempt power cycle [ 635.037852][T16822] vxlan0: entered promiscuous mode [ 635.293715][ T5281] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 635.325923][ T5281] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 635.333783][ T5281] usb 2-1: can't read configurations, error -61 [ 635.473627][ T5281] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 635.540334][ T5281] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 635.588519][ T5281] usb 2-1: can't read configurations, error -61 [ 635.657833][ T5281] usb usb2-port1: unable to enumerate USB device [ 636.082391][T16835] FAULT_INJECTION: forcing a failure. [ 636.082391][T16835] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 636.123797][T16835] CPU: 1 UID: 0 PID: 16835 Comm: syz.3.2247 Not tainted 6.12.0-rc1-syzkaller-00349-g8f602276d390 #0 [ 636.134596][T16835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 636.144738][T16835] Call Trace: [ 636.148013][T16835] [ 636.150938][T16835] dump_stack_lvl+0x241/0x360 [ 636.155911][T16835] ? __pfx_dump_stack_lvl+0x10/0x10 [ 636.161114][T16835] ? __pfx__printk+0x10/0x10 [ 636.165712][T16835] ? snprintf+0xda/0x120 [ 636.169961][T16835] should_fail_ex+0x3b0/0x4e0 [ 636.174659][T16835] _copy_to_user+0x2f/0xb0 [ 636.179098][T16835] simple_read_from_buffer+0xca/0x150 [ 636.184484][T16835] proc_fail_nth_read+0x1e9/0x250 [ 636.189512][T16835] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 636.195058][T16835] ? rw_verify_area+0x55e/0x6f0 [ 636.199909][T16835] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 636.205453][T16835] vfs_read+0x201/0xbc0 [ 636.209610][T16835] ? __pfx_lock_release+0x10/0x10 [ 636.214642][T16835] ? __pfx_vfs_read+0x10/0x10 [ 636.219322][T16835] ? __fget_files+0x3f3/0x470 [ 636.224007][T16835] ? fdget_pos+0x24e/0x320 [ 636.228426][T16835] ksys_read+0x183/0x2b0 [ 636.232664][T16835] ? __pfx_ksys_read+0x10/0x10 [ 636.237420][T16835] ? do_syscall_64+0x100/0x230 [ 636.242194][T16835] ? do_syscall_64+0xb6/0x230 [ 636.246866][T16835] do_syscall_64+0xf3/0x230 [ 636.251364][T16835] ? clear_bhb_loop+0x35/0x90 [ 636.256036][T16835] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.261930][T16835] RIP: 0033:0x7fe30597ca3c [ 636.266341][T16835] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 69 8e 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 bf 8e 02 00 48 [ 636.285941][T16835] RSP: 002b:00007fe306835030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 636.294354][T16835] RAX: ffffffffffffffda RBX: 00007fe305b35f80 RCX: 00007fe30597ca3c [ 636.302314][T16835] RDX: 000000000000000f RSI: 00007fe3068350a0 RDI: 0000000000000003 [ 636.310277][T16835] RBP: 00007fe306835090 R08: 0000000000000000 R09: 0000000000000000 [ 636.318242][T16835] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 636.326209][T16835] R13: 0000000000000000 R14: 00007fe305b35f80 R15: 00007fe305c5fa28 [ 636.334187][T16835] [ 636.763641][ T5284] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 636.872325][T16858] netlink: 'syz.4.2254': attribute type 3 has an invalid length. [ 636.889154][T16858] netlink: 130984 bytes leftover after parsing attributes in process `syz.4.2254'. [ 636.933555][ T5284] usb 4-1: Using ep0 maxpacket: 8 [ 636.945417][ T5284] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 636.956955][ T5284] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.974230][ T5284] usb 4-1: Product: syz [ 636.981957][ T5284] usb 4-1: Manufacturer: syz [ 636.991193][ T5284] usb 4-1: SerialNumber: syz [ 636.992423][T16860] IPv6: NLM_F_REPLACE set, but no existing node found! [ 637.002192][ T5284] usb 4-1: config 0 descriptor?? [ 637.219039][ T5284] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 637.535201][T16876] input: syz0 as /devices/virtual/input/input184 [ 637.573820][ T5279] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 637.618961][ T5231] udevd[5231]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 637.753664][ T5279] usb 2-1: Using ep0 maxpacket: 16 [ 637.773741][ T5279] usb 2-1: config 0 interface 0 altsetting 44 endpoint 0x83 has invalid wMaxPacketSize 0 [ 637.813943][ T5279] usb 2-1: config 0 interface 0 altsetting 44 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 637.844355][ T5279] usb 2-1: config 0 interface 0 has no altsetting 0 [ 637.876329][ T5279] usb 2-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 637.886245][ T5279] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 637.894595][ T5279] usb 2-1: Product: syz [ 637.906962][ T5279] usb 2-1: Manufacturer: syz [ 637.916526][ T5279] usb 2-1: SerialNumber: syz [ 637.936386][ T5279] usb 2-1: config 0 descriptor?? [ 637.951601][ T5279] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input185 [ 638.150461][T16866] openvswitch: netlink: Missing valid actions attribute. [ 638.163667][T16866] openvswitch: netlink: Actions may not be safe on all matching packets [ 638.220825][T16866] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 638.322231][T16866] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 638.425582][ T5281] usb 2-1: USB disconnect, device number 120 [ 638.946296][T16898] binder: BINDER_SET_CONTEXT_MGR already set [ 638.959583][T16898] binder: 16897:16898 ioctl 4018620d 200002c0 returned -16 [ 639.535025][ T5281] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 639.616852][ T5284] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 639.705533][ T5281] usb 2-1: Using ep0 maxpacket: 8 [ 639.732852][ T5281] usb 2-1: unable to get BOS descriptor or descriptor too short [ 639.772819][ T5281] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 639.791756][ T5281] usb 2-1: can't read configurations, error -71 [ 639.843878][ T5284] usb 4-1: USB disconnect, device number 23 [ 640.570022][ T7582] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.870399][ T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 640.890980][ T55] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 640.902140][ T55] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 640.925454][ T55] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 640.935621][ T55] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 640.944677][ T55] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 641.071132][ T7582] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.093519][ T5281] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 641.253818][T16928] netlink: 'syz.2.2274': attribute type 5 has an invalid length. [ 641.285658][ T5281] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 641.307748][ T5281] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 641.337476][ T5281] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 641.365915][ T7582] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.393822][ T5281] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 641.431137][T16931] veth1_to_hsr: entered promiscuous mode [ 641.441154][T16921] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 641.452423][ T5281] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 641.459658][T16931] batman_adv: batadv0: Adding interface: macvlan2 [ 641.478396][T16931] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 641.515815][T16931] batman_adv: batadv0: Interface activated: macvlan2 [ 641.606120][ T7582] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.797276][ T9] usb 2-1: USB disconnect, device number 123 [ 641.961243][T16926] chnl_net:caif_netlink_parms(): no params data found [ 642.064030][ T7582] bridge_slave_1: left allmulticast mode [ 642.085390][ T7582] bridge_slave_1: left promiscuous mode [ 642.091107][ T7582] bridge0: port 2(bridge_slave_1) entered disabled state [ 642.107094][ T7582] bridge_slave_0: left allmulticast mode [ 642.112860][ T7582] bridge_slave_0: left promiscuous mode [ 642.125993][ T7582] bridge0: port 1(bridge_slave_0) entered disabled state [ 642.586046][T16953] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 642.609122][T16953] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 642.815380][ T7582] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 642.827708][ T7582] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 642.839080][ T7582] bond0 (unregistering): Released all slaves [ 642.869973][T16947] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 642.879409][T16947] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 642.888933][T16947] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 642.897974][T16947] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 642.951308][T16947] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 642.960435][T16947] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 642.969582][T16947] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 642.978619][ T5235] Bluetooth: hci1: command tx timeout [ 642.984866][T16947] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 643.026524][T16948] IPv6: syztnl0: Disabled Multicast RS [ 643.032553][T16950] netlink: 'syz.1.2280': attribute type 4 has an invalid length. [ 643.050969][T16952] netlink: 'syz.1.2280': attribute type 17 has an invalid length. [ 643.174269][T16926] bridge0: port 1(bridge_slave_0) entered blocking state [ 643.181870][T16926] bridge0: port 1(bridge_slave_0) entered disabled state [ 643.214087][T16926] bridge_slave_0: entered allmulticast mode [ 643.251009][T16926] bridge_slave_0: entered promiscuous mode [ 643.280722][T16926] bridge0: port 2(bridge_slave_1) entered blocking state [ 643.303937][T16926] bridge0: port 2(bridge_slave_1) entered disabled state [ 643.334304][T16926] bridge_slave_1: entered allmulticast mode [ 643.354036][T16926] bridge_slave_1: entered promiscuous mode [ 643.354452][ T5279] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 643.520683][ T7582] hsr_slave_0: left promiscuous mode [ 643.533766][ T5279] usb 2-1: Using ep0 maxpacket: 8 [ 643.542611][ T5279] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 643.568270][ T5279] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 643.593803][ T7582] hsr_slave_1: left promiscuous mode [ 643.604848][ T5279] usb 2-1: Product: syz [ 643.614226][ T5279] usb 2-1: Manufacturer: syz [ 643.614838][ T7582] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 643.624056][ T5279] usb 2-1: SerialNumber: syz [ 643.645828][ T7582] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 643.656315][ T5279] usb 2-1: config 0 descriptor?? [ 643.670072][ T7582] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 643.685191][T16977] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 643.702394][ T7582] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 643.712066][T16977] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 643.740272][T16978] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2285'. [ 643.759170][ T7582] veth1_macvtap: left promiscuous mode [ 643.765469][ T7582] veth0_macvtap: left promiscuous mode [ 643.773869][ T7582] veth1_vlan: left promiscuous mode [ 643.779639][ T7582] veth0_vlan: left promiscuous mode [ 643.876789][ T5279] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 645.043257][ T7582] team0 (unregistering): Port device team_slave_1 removed [ 645.054587][ T5235] Bluetooth: hci1: command tx timeout [ 645.128161][ T7582] team0 (unregistering): Port device team_slave_0 removed [ 645.427497][T16999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 645.458473][T16999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 645.480742][T16999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 645.501382][T16999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 645.518679][T16999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 645.533228][T16999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 645.552429][T16999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 645.576220][T16999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 645.588102][T16999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 645.599230][T16999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 645.657962][ T1847] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 645.825314][ T1847] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 645.841297][ T1847] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 645.877535][ T1847] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 645.911733][ T1847] usb 3-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 645.927140][ T1847] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.944236][ T1847] usb 3-1: config 0 descriptor?? [ 646.115121][T16926] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 646.127941][T16977] netpci0: renamed from team0 (while UP) [ 646.216289][T16926] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 646.272166][ T1847] usbhid 3-1:0.0: can't add hid device: -71 [ 646.281183][ T1847] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 646.298592][T16926] team0: Port device team_slave_0 added [ 646.308978][ T1847] usb 3-1: USB disconnect, device number 13 [ 646.318042][T16926] team0: Port device team_slave_1 added [ 646.399098][T16926] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 646.416801][T16926] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 646.483841][T16926] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 646.497538][T16926] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 646.505113][T16926] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 646.532437][T16926] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 646.662118][T16926] hsr_slave_0: entered promiscuous mode [ 646.711105][T16926] hsr_slave_1: entered promiscuous mode [ 646.805640][T17015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 646.879135][T17015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 646.927157][ T7582] IPVS: stop unused estimator thread 0... [ 646.975467][ T5279] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 647.133809][ T5235] Bluetooth: hci1: command tx timeout [ 647.189633][ T9] usb 2-1: USB disconnect, device number 124 [ 647.248374][ T55] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 647.260283][ T55] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 647.270331][ T7582] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 647.282288][ T55] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 647.301629][ T55] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 647.309715][ T55] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 647.317859][ T55] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 647.433949][ T5279] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 647.443359][ T7582] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 647.571573][ T7582] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 647.585177][ T5279] usb 3-1: config 147 has too many interfaces: 122, using maximum allowed: 32 [ 647.622770][ T5279] usb 3-1: config 147 has an invalid descriptor of length 35, skipping remainder of the config [ 647.633776][ T5279] usb 3-1: config 147 has 0 interfaces, different from the descriptor's value: 122 [ 647.643121][ T5279] usb 3-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.32 [ 647.661690][ T5279] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 647.777153][ T7582] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 647.928221][ T5235] Bluetooth: hci2: link tx timeout [ 647.934452][ T5235] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 647.975881][ T5279] usb 3-1: string descriptor 0 read error: -71 [ 648.020504][ T7582] bridge_slave_1: left allmulticast mode [ 648.028485][ T7582] bridge_slave_1: left promiscuous mode [ 648.031014][ T5279] usb 3-1: USB disconnect, device number 14 [ 648.042007][ T7582] bridge0: port 2(bridge_slave_1) entered disabled state [ 648.131349][ T7582] bridge_slave_0: left allmulticast mode [ 648.148828][T17040] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 648.158532][ T7582] bridge_slave_0: left promiscuous mode [ 648.164394][ T7582] bridge0: port 1(bridge_slave_0) entered disabled state [ 648.183045][T17040] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 648.207415][T13136] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 648.224724][T13136] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 648.234082][T13136] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 648.253346][T13136] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 648.261633][T13136] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 648.269521][T13136] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 648.716207][ T7582] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 648.728935][ T7582] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 648.755767][ T7582] bond0 (unregistering): Released all slaves [ 648.786661][T17047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 648.853670][T17047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 649.103294][T16926] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 649.135936][T16926] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 649.196246][T16926] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 649.209306][T17031] chnl_net:caif_netlink_parms(): no params data found [ 649.216432][T13136] Bluetooth: hci1: command tx timeout [ 649.216629][ T5279] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 649.240323][T16926] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 649.302658][ T7582] hsr_slave_0: left promiscuous mode [ 649.327923][ T7582] hsr_slave_1: left promiscuous mode [ 649.342896][ T7582] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 649.352896][ T7582] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 649.372385][ T7582] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 649.380097][T13136] Bluetooth: hci5: command tx timeout [ 649.397007][ T5279] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 649.403037][ T7582] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 649.413837][ T5279] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.422705][ T7582] batman_adv: batadv0: Interface deactivated: macvlan2 [ 649.439628][ T5279] usb 3-1: config 0 descriptor?? [ 649.448454][ T7582] batman_adv: batadv0: Removing interface: macvlan2 [ 649.453976][ T5279] cp210x 3-1:0.0: cp210x converter detected [ 649.528929][ T7582] veth1_to_hsr: left promiscuous mode [ 649.550018][ T7582] veth1_macvtap: left promiscuous mode [ 649.558548][ T7582] veth0_macvtap: left promiscuous mode [ 649.573699][ T7582] veth1_vlan: left promiscuous mode [ 649.579043][ T7582] veth0_vlan: left promiscuous mode [ 649.597433][T17069] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 649.637247][T17069] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 650.052609][T13136] Bluetooth: hci2: command 0x0406 tx timeout [ 650.343950][ T5235] Bluetooth: hci3: command tx timeout [ 650.955951][ T7582] team0 (unregistering): Port device team_slave_1 removed [ 650.990352][T17093] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 651.015168][T17093] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 651.031591][ T7582] team0 (unregistering): Port device team_slave_0 removed [ 651.456379][ T5235] Bluetooth: hci5: command tx timeout [ 651.655083][ T5279] cp210x 3-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 651.663337][ T5279] cp210x 3-1:0.0: querying part number failed [ 651.700717][ T5279] usb 3-1: cp210x converter now attached to ttyUSB0 [ 651.732824][ T5279] usb 3-1: USB disconnect, device number 15 [ 651.774674][ T5279] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 651.782796][ T5279] cp210x 3-1:0.0: device disconnected [ 651.804759][T17031] bridge0: port 1(bridge_slave_0) entered blocking state [ 651.813003][T17031] bridge0: port 1(bridge_slave_0) entered disabled state [ 651.838348][T17031] bridge_slave_0: entered allmulticast mode [ 651.848514][T17031] bridge_slave_0: entered promiscuous mode [ 651.874734][T17101] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2310'. [ 651.906725][T17102] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2310'. [ 651.921448][T17031] bridge0: port 2(bridge_slave_1) entered blocking state [ 651.943023][T17031] bridge0: port 2(bridge_slave_1) entered disabled state [ 651.971299][T17031] bridge_slave_1: entered allmulticast mode [ 651.992806][T17108] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2311'. [ 652.025419][T17031] bridge_slave_1: entered promiscuous mode [ 652.149762][T17031] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 652.207553][T17031] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 652.240113][T17117] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 652.262697][T17117] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 652.282926][T17117] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 652.300723][T17117] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 652.307625][T17042] chnl_net:caif_netlink_parms(): no params data found [ 652.339825][T17031] team0: Port device team_slave_0 added [ 652.392565][T17031] team0: Port device team_slave_1 added [ 652.414665][ T5235] Bluetooth: hci3: command tx timeout [ 652.536333][T17031] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 652.554032][T17031] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 652.584360][T17031] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 652.627629][T17031] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 652.642235][T17031] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 652.668995][T17031] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 652.747527][ T7582] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 652.869578][T17042] bridge0: port 1(bridge_slave_0) entered blocking state [ 652.885668][T17042] bridge0: port 1(bridge_slave_0) entered disabled state [ 652.912969][T17042] bridge_slave_0: entered allmulticast mode [ 652.928115][T17042] bridge_slave_0: entered promiscuous mode [ 652.937407][T17042] bridge0: port 2(bridge_slave_1) entered blocking state [ 652.944818][T17042] bridge0: port 2(bridge_slave_1) entered disabled state [ 652.952336][T17042] bridge_slave_1: entered allmulticast mode [ 652.962545][T17042] bridge_slave_1: entered promiscuous mode [ 653.010711][ T7582] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 653.066145][T16926] 8021q: adding VLAN 0 to HW filter on device bond0 [ 653.221875][ T7582] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 653.262217][T17042] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 653.285432][T17031] hsr_slave_0: entered promiscuous mode [ 653.302010][T17031] hsr_slave_1: entered promiscuous mode [ 653.329196][T17031] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 653.342769][T17031] Cannot create hsr debugfs directory [ 653.353901][T16926] 8021q: adding VLAN 0 to HW filter on device team0 [ 653.363057][T17042] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 653.406412][ T7582] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 653.416985][ T1847] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 653.461565][ T7578] bridge0: port 1(bridge_slave_0) entered blocking state [ 653.468722][ T7578] bridge0: port 1(bridge_slave_0) entered forwarding state [ 653.482980][ T7578] bridge0: port 2(bridge_slave_1) entered blocking state [ 653.490076][ T7578] bridge0: port 2(bridge_slave_1) entered forwarding state [ 653.518602][T17042] team0: Port device team_slave_0 added [ 653.533967][ T5235] Bluetooth: hci5: command tx timeout [ 653.580517][T17042] team0: Port device team_slave_1 added [ 653.595739][T17146] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 653.595774][ T1847] usb 3-1: Using ep0 maxpacket: 16 [ 653.625636][ T1847] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 653.636322][ T1847] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 653.647239][ T1847] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 653.656451][T17146] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 653.668386][ T1847] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 653.682166][ T1847] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 653.694489][ T1847] usb 3-1: Product: syz [ 653.698846][ T1847] usb 3-1: Manufacturer: syz [ 653.708659][ T1847] usb 3-1: SerialNumber: syz [ 653.750813][T17042] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 653.780991][T17042] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 653.805327][T17146] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 653.817909][T17146] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 653.841476][T17042] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 653.909632][T17042] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 653.916896][T17042] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 653.956891][T17139] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 653.959302][T17042] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 653.996243][T17139] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 654.152438][T17042] hsr_slave_0: entered promiscuous mode [ 654.166187][T17042] hsr_slave_1: entered promiscuous mode [ 654.172665][T17042] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 654.182668][T17042] Cannot create hsr debugfs directory [ 654.308475][ T1847] usb 3-1: 0:2 : does not exist [ 654.327823][ T1847] usb 3-1: 1:0: cannot get min/max values for control 4 (id 1) [ 654.380576][ T1847] usb 3-1: USB disconnect, device number 16 [ 654.411290][ T7582] bridge_slave_1: left allmulticast mode [ 654.436994][ T7582] bridge_slave_1: left promiscuous mode [ 654.442888][ T7582] bridge0: port 2(bridge_slave_1) entered disabled state [ 654.465004][ T7582] bridge_slave_0: left allmulticast mode [ 654.470694][ T7582] bridge_slave_0: left promiscuous mode [ 654.486380][ T7582] bridge0: port 1(bridge_slave_0) entered disabled state [ 654.486752][T17163] SET target dimension over the limit! [ 654.499464][ T5235] Bluetooth: hci3: command tx timeout [ 654.546342][T17163] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2318'. [ 655.031446][T17170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 655.044229][T17170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 655.064828][ T7582] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 655.081522][ T7582] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 655.092486][ T7582] bond0 (unregistering): Released all slaves [ 655.273727][ T1847] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 655.399828][T17173] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 655.418660][T17173] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 655.444392][ T1847] usb 3-1: Using ep0 maxpacket: 8 [ 655.446127][T16926] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 655.467695][ T1847] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 655.479709][ T1847] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 655.503798][ T1847] usb 3-1: Product: syz [ 655.508012][ T1847] usb 3-1: Manufacturer: syz [ 655.522778][ T1847] usb 3-1: SerialNumber: syz [ 655.540040][ T1847] usb 3-1: config 0 descriptor?? [ 655.607447][ T7582] hsr_slave_0: left promiscuous mode [ 655.624269][ T5235] Bluetooth: hci5: command tx timeout [ 655.630075][ T7582] hsr_slave_1: left promiscuous mode [ 655.642577][ T7582] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 655.665829][ T7582] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 655.674645][ T7582] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 655.682746][ T7582] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 655.734146][ T7582] veth1_macvtap: left promiscuous mode [ 655.743822][ T7582] veth0_macvtap: left promiscuous mode [ 655.754029][ T7582] veth1_vlan: left promiscuous mode [ 655.759362][ T7582] veth0_vlan: left promiscuous mode [ 655.831982][ T1847] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 656.579880][ T5235] Bluetooth: hci3: command tx timeout [ 657.203133][ T7582] team0 (unregistering): Port device team_slave_1 removed [ 657.305094][ T7582] team0 (unregistering): Port device team_slave_0 removed [ 657.794021][ T1847] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 658.029890][ T5289] usb 3-1: USB disconnect, device number 17 [ 658.201725][T17178] nlmon0: Master is either lo or non-ether device [ 658.224500][T16926] veth0_vlan: entered promiscuous mode [ 658.345356][T17031] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 658.380649][T17031] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 658.458286][T17031] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 658.467341][T17031] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 658.571973][T16926] veth1_vlan: entered promiscuous mode [ 658.597526][T16926] veth0_macvtap: entered promiscuous mode [ 658.699610][T16926] veth1_macvtap: entered promiscuous mode [ 658.792904][T16926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 658.803715][T16926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.823663][T16926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 658.844372][T16926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.855183][T16926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 658.873693][T16926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.884185][T16926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 658.895364][T16926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.905549][T16926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 658.943619][T16926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.959919][T16926] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 658.970540][T16926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 658.982658][T16926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.993000][T16926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 659.004059][T16926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 659.032289][T16926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 659.043075][T16926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 659.082927][T16926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 659.103810][T16926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 659.129231][T16926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 659.163664][T16926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 659.180997][T16926] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 659.225203][T16926] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.253643][T16926] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.298185][T16926] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.322629][T16926] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.770837][T17031] 8021q: adding VLAN 0 to HW filter on device bond0 [ 659.965163][ T7582] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 659.974148][ T7582] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 659.974352][T17031] 8021q: adding VLAN 0 to HW filter on device team0 [ 660.069010][ T7582] bridge0: port 1(bridge_slave_0) entered blocking state [ 660.076261][ T7582] bridge0: port 1(bridge_slave_0) entered forwarding state [ 660.100270][T17042] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 660.157245][ T7591] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 660.161879][T17042] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 660.193593][ T7591] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 660.255127][T17042] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 660.327108][ T7578] bridge0: port 2(bridge_slave_1) entered blocking state [ 660.334265][ T7578] bridge0: port 2(bridge_slave_1) entered forwarding state [ 660.397684][T17042] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 660.768625][T17031] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 660.830179][T17042] 8021q: adding VLAN 0 to HW filter on device bond0 [ 660.905879][T17042] 8021q: adding VLAN 0 to HW filter on device team0 [ 660.969902][ T7591] bridge0: port 1(bridge_slave_0) entered blocking state [ 660.977087][ T7591] bridge0: port 1(bridge_slave_0) entered forwarding state [ 661.039425][ T7582] bridge0: port 2(bridge_slave_1) entered blocking state [ 661.046545][ T7582] bridge0: port 2(bridge_slave_1) entered forwarding state [ 661.144776][T17031] veth0_vlan: entered promiscuous mode [ 661.259260][T17031] veth1_vlan: entered promiscuous mode [ 661.370002][T17217] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 661.409476][T17031] veth0_macvtap: entered promiscuous mode [ 661.426353][T17042] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 661.446334][T17031] veth1_macvtap: entered promiscuous mode [ 661.464712][T17217] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 661.501478][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 661.516070][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 661.546276][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 661.593603][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 661.612262][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 661.625655][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 661.636152][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 661.647515][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 661.657882][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 661.673863][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 661.698508][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 661.719314][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 661.749196][T17031] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 661.955685][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 661.966811][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 661.978484][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 661.996668][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 662.055632][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 662.083529][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 662.093384][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 662.151187][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 662.188260][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 662.206144][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 662.247828][T17031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 662.286491][T17031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 662.316857][T17031] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 662.344504][T17031] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 662.356957][T17031] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 662.392892][T17031] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 662.423557][T17031] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 662.468292][T17226] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 662.487604][T17245] binder: BINDER_SET_CONTEXT_MGR already set [ 662.498331][T17226] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 662.511317][T17244] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2327'. [ 662.523602][T17245] binder: 17236:17245 ioctl 4018620d 20000040 returned -16 [ 662.537104][T17042] veth0_vlan: entered promiscuous mode [ 662.747061][T17226] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 662.753018][T17226] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 662.777481][T17042] veth1_vlan: entered promiscuous mode [ 662.832180][T17226] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 662.857172][ T29] kauditd_printk_skb: 40 callbacks suppressed [ 662.857191][ T29] audit: type=1326 audit(1728244732.918:1460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17255 comm="syz.0.2328" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7efd2bf7dff9 code=0x0 [ 662.863720][T17226] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 662.922360][T17042] veth0_macvtap: entered promiscuous mode [ 662.951060][T17042] veth1_macvtap: entered promiscuous mode [ 663.109967][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 663.121953][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.133339][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 663.144846][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.156880][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 663.167931][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.179154][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 663.190272][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.200514][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 663.211829][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.230709][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 663.241610][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.256533][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 663.267520][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.279398][T17042] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 663.290648][T17226] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 663.303994][T17226] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 663.323250][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 663.345766][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.363052][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 663.383488][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.402427][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 663.413066][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.432290][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 663.442975][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.455488][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 663.466485][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.476736][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 663.487353][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.497900][T17042] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 663.509251][T17042] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.522668][T17226] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 663.530143][T17226] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 663.541574][T17042] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 663.568834][T17042] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 663.587260][T17042] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 663.598417][T17042] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 663.610419][T17042] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 663.640381][T17226] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 663.653801][T17226] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 664.100281][ T7578] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 664.149227][ T7578] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 664.288324][ T7584] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 664.337414][ T7591] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 664.351523][ T7584] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 664.401851][ T7591] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 664.548269][ T7584] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 664.611343][ T7584] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 665.343610][ T5281] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 665.494434][ T5281] usb 2-1: Using ep0 maxpacket: 32 [ 665.513790][ T5281] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 665.557178][ T5281] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 665.586514][ T5281] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 665.637769][ T5281] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 665.666998][ T5281] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 665.705898][ T5281] usb 2-1: config 0 descriptor?? [ 665.723928][T17322] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 665.738183][ T5281] hub 2-1:0.0: USB hub found [ 665.912028][T17358] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2341'. [ 666.242349][T17368] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 666.406141][ T5284] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 666.472744][T17381] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2346'. [ 666.508720][T17381] Cannot find map_set index 0 as target [ 666.573570][ T5284] usb 4-1: Using ep0 maxpacket: 32 [ 666.582729][ T5284] usb 4-1: config 0 has an invalid interface number: 19 but max is 0 [ 666.593088][ T5284] usb 4-1: config 0 has no interface number 0 [ 666.605543][ T5284] usb 4-1: config 0 interface 19 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 666.621995][ T5284] usb 4-1: config 0 interface 19 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 16 [ 666.641248][ T5284] usb 4-1: config 0 interface 19 altsetting 0 has an endpoint descriptor with address 0x91, changing to 0x81 [ 666.669743][ T5284] usb 4-1: config 0 interface 19 altsetting 0 endpoint 0x81 has invalid maxpacket 34106, setting to 1024 [ 666.700050][ T5284] usb 4-1: config 0 interface 19 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1024 [ 666.719156][ T5284] usb 4-1: config 0 interface 19 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 666.748021][ T5284] usb 4-1: New USB device found, idVendor=04a4, idProduct=0014, bcdDevice=c9.57 [ 666.763647][ T5284] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.772495][ T5284] usb 4-1: Product: syz [ 666.786362][ T5284] usb 4-1: Manufacturer: syz [ 666.792574][ T5284] usb 4-1: SerialNumber: syz [ 666.822268][ T5284] usb 4-1: config 0 descriptor?? [ 666.854643][T17366] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 666.867842][T17366] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 666.890586][ T5284] ipaq 4-1:0.19: PocketPC PDA converter detected [ 666.909379][ T5284] usb 4-1: active config #0 != 1 ?? [ 666.932455][T17391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 666.989093][T17391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 667.169287][T17366] bridge_slave_0: left allmulticast mode [ 667.181554][T17366] bridge_slave_0: left promiscuous mode [ 667.204249][T17366] bridge0: port 1(bridge_slave_0) entered disabled state [ 667.254999][T17366] bridge_slave_1: left allmulticast mode [ 667.283170][T17366] bridge_slave_1: left promiscuous mode [ 667.307972][T17366] bridge0: port 2(bridge_slave_1) entered disabled state [ 667.327343][T17366] bond0: (slave bond_slave_0): Releasing backup interface [ 667.348816][T17366] bond0: (slave bond_slave_1): Releasing backup interface [ 667.386869][T17366] team0: Port device team_slave_0 removed [ 667.406522][T17366] team0: Port device team_slave_1 removed [ 667.413267][T17366] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 667.421475][T17366] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 667.430598][T17366] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 667.438682][T17366] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 667.472193][T17401] team0: Port device wg2 added [ 667.506948][ T5284] usb 4-1: USB disconnect, device number 24 [ 667.525523][T17403] vxlan0: entered promiscuous mode [ 667.886999][T17408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 667.902676][T17408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 668.115259][ T52] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 668.123534][ T5281] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 668.141649][ T5281] usbhid 2-1:0.0: can't add hid device: -71 [ 668.169698][ T5281] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 668.201752][T17420] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 668.227227][T17420] macsec1: entered promiscuous mode [ 668.234492][ T5281] usb 2-1: USB disconnect, device number 125 [ 668.274230][ T52] usb 3-1: device descriptor read/64, error -71 [ 669.499243][ T52] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 669.774305][ T52] usb 3-1: device descriptor read/64, error -71 [ 669.801792][T17435] input: syz0 as /devices/virtual/input/input186 [ 669.941076][ T8] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 670.032488][ T52] usb usb3-port1: attempt power cycle [ 670.342170][ T8] usb 4-1: Using ep0 maxpacket: 16 [ 670.740563][ T2034] pvrusb2: request_firmware fatal error with code=-110 [ 670.750286][T17437] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2359'. [ 670.759603][ T2034] pvrusb2: Failure uploading firmware1 [ 670.781728][ T2034] pvrusb2: Device initialization was not successful. [ 670.809791][ T2034] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 671.217667][ T52] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 671.409313][ T2034] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 671.730413][ T52] usb 3-1: device descriptor read/8, error -71 [ 672.139583][T17442] vxlan0: entered promiscuous mode [ 678.432816][T13136] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 678.444475][T13136] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 678.454544][T13136] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 678.463211][T13136] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 678.470963][T13136] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 678.478439][T13136] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 680.573655][T13136] Bluetooth: hci7: command tx timeout [ 682.663569][T13136] Bluetooth: hci7: command tx timeout [ 683.192317][ T5235] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 683.211498][ T5235] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 683.224893][ T5235] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 683.232938][ T5235] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 683.242560][ T5235] Bluetooth: hci8: unexpected cc 0x0c25 length: 249 > 3 [ 683.250704][ T5235] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 683.411685][T13136] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 683.425248][T13136] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 683.434595][T13136] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 683.442433][T13136] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 683.450777][T13136] Bluetooth: hci9: unexpected cc 0x0c25 length: 249 > 3 [ 683.458582][T13136] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 684.644813][ T5235] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 684.655288][ T5235] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 684.669477][ T5235] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 684.677597][ T5235] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 684.697245][ T5235] Bluetooth: hci10: unexpected cc 0x0c25 length: 249 > 3 [ 684.705176][ T5235] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 684.739047][ T5235] Bluetooth: hci7: command tx timeout [ 684.838089][ T55] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 684.849002][ T55] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 684.861772][ T55] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 684.872891][ T55] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 684.884798][ T55] Bluetooth: hci11: unexpected cc 0x0c25 length: 249 > 3 [ 684.892557][ T55] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 685.293638][ T5235] Bluetooth: hci8: command tx timeout [ 685.533694][ T5235] Bluetooth: hci9: command tx timeout [ 686.109133][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.115619][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.653444][ C0] sched: DL replenish lagged too much [ 686.813732][ T55] Bluetooth: hci10: command tx timeout [ 686.823186][ T5235] Bluetooth: hci7: command tx timeout [ 686.973726][ T5235] Bluetooth: hci11: command tx timeout [ 687.375729][ T5235] Bluetooth: hci8: command tx timeout [ 687.613659][ T55] Bluetooth: hci9: command tx timeout [ 688.893656][ T55] Bluetooth: hci10: command tx timeout [ 689.053598][ T55] Bluetooth: hci11: command tx timeout [ 689.453802][ T55] Bluetooth: hci8: command tx timeout [ 689.693686][ T55] Bluetooth: hci9: command tx timeout [ 690.973705][ T55] Bluetooth: hci10: command tx timeout [ 691.133787][ T55] Bluetooth: hci11: command tx timeout [ 691.533613][ T55] Bluetooth: hci8: command tx timeout [ 691.773653][ T55] Bluetooth: hci9: command tx timeout [ 693.056658][ T55] Bluetooth: hci10: command tx timeout [ 693.213738][ T55] Bluetooth: hci11: command tx timeout [ 694.904197][ T5288] pvrusb2: Device being rendered inoperable [ 695.263986][ T8] usb 4-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 695.273083][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 695.620869][ T8] usb 4-1: Product: syz [ 696.125336][ T8] usb 4-1: Manufacturer: syz [ 714.947140][ T8] usb 4-1: config 0 descriptor?? [ 721.538532][ T8] usb 4-1: can't set config #0, error -71 [ 728.246322][ T8] usb 4-1: USB disconnect, device number 25 [ 739.498768][ T5235] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 739.508896][ T5235] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 739.517418][ T5235] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 739.527758][ T5235] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 739.541314][ T5235] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 739.549364][ T5235] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 739.878786][T17488] chnl_net:caif_netlink_parms(): no params data found [ 740.026460][T17488] bridge0: port 1(bridge_slave_0) entered blocking state [ 740.041589][T17488] bridge0: port 1(bridge_slave_0) entered disabled state [ 740.064393][T17488] bridge_slave_0: entered allmulticast mode [ 740.073223][T17488] bridge_slave_0: entered promiscuous mode [ 740.086911][T17488] bridge0: port 2(bridge_slave_1) entered blocking state [ 740.104471][T17488] bridge0: port 2(bridge_slave_1) entered disabled state [ 740.111765][T17488] bridge_slave_1: entered allmulticast mode [ 740.132700][T17488] bridge_slave_1: entered promiscuous mode [ 740.211831][T17488] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 740.230341][T17488] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 740.308879][T17488] team0: Port device team_slave_0 added [ 740.329953][T17488] team0: Port device team_slave_1 added [ 740.413865][T17488] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 740.420856][T17488] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 740.459901][T17488] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 740.489385][T17488] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 740.513643][T17488] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 740.551618][T17488] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 740.654573][T17488] hsr_slave_0: entered promiscuous mode [ 740.665581][T17488] hsr_slave_1: entered promiscuous mode [ 740.688577][T17488] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 740.705566][T17488] Cannot create hsr debugfs directory [ 740.992061][T17488] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 741.439679][T17488] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 741.594833][T17488] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 741.613974][ T55] Bluetooth: hci1: command tx timeout [ 743.703628][ T55] Bluetooth: hci1: command tx timeout [ 743.765959][ T55] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 743.779621][ T55] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 743.787833][ T55] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 743.798905][ T55] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 743.807794][ T55] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 743.828440][ T55] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 743.916197][ T5235] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 743.929526][ T5235] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 743.938760][ T5235] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 743.956660][ T5235] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 743.964886][ T5235] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 743.972226][ T5235] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 745.718617][T13136] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 745.728586][T13136] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 745.739312][T13136] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 745.748671][T13136] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 745.758925][T13136] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 745.773049][T13136] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 745.782085][T13136] Bluetooth: hci1: command tx timeout [ 745.788746][T13136] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 745.800695][T17510] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 745.808593][T17510] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 745.876082][ T55] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 745.884070][ T55] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 745.891386][ T55] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 745.933760][ T55] Bluetooth: hci2: command tx timeout [ 746.014047][ T55] Bluetooth: hci3: command tx timeout [ 747.361971][T17488] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 747.544034][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.550380][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.853782][ T55] Bluetooth: hci6: command tx timeout [ 747.860778][ T55] Bluetooth: hci1: command tx timeout [ 747.933812][ T55] Bluetooth: hci5: command tx timeout [ 748.013777][ T55] Bluetooth: hci2: command tx timeout [ 748.093734][ T55] Bluetooth: hci3: command tx timeout [ 749.933736][ T55] Bluetooth: hci6: command tx timeout [ 750.013644][ T55] Bluetooth: hci5: command tx timeout [ 750.093790][ T55] Bluetooth: hci2: command tx timeout [ 750.173861][ T55] Bluetooth: hci3: command tx timeout [ 752.013825][ T55] Bluetooth: hci6: command tx timeout [ 752.093702][ T55] Bluetooth: hci5: command tx timeout [ 752.174050][ T55] Bluetooth: hci2: command tx timeout [ 752.253818][ T55] Bluetooth: hci3: command tx timeout [ 754.093602][ T55] Bluetooth: hci6: command tx timeout [ 754.177006][ T55] Bluetooth: hci5: command tx timeout [ 800.821244][ T55] Bluetooth: hci7: command 0x0406 tx timeout [ 802.404328][ T55] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 802.420042][ T55] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 802.428467][ T55] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 802.436685][ T55] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 802.444577][ T55] Bluetooth: hci12: unexpected cc 0x0c25 length: 249 > 3 [ 802.454829][ T55] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 804.178308][T17510] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 804.191101][T17510] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 804.200055][T17510] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 804.208044][T17510] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 804.224719][T17510] Bluetooth: hci13: unexpected cc 0x0c25 length: 249 > 3 [ 804.232093][T17510] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 804.351468][ T5233] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 804.365903][ T5233] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 804.380444][ T5233] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 804.395575][ T5233] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 804.404037][ T5233] Bluetooth: hci14: unexpected cc 0x0c25 length: 249 > 3 [ 804.411434][ T5233] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 804.493841][T17510] Bluetooth: hci12: command tx timeout [ 805.943317][T17510] Bluetooth: hci8: command 0x0406 tx timeout [ 805.949747][T17510] Bluetooth: hci9: command 0x0406 tx timeout [ 806.217563][ T55] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1 [ 806.228143][ T55] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9 [ 806.242359][ T55] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9 [ 806.251508][ T55] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4 [ 806.260387][ T55] Bluetooth: hci15: unexpected cc 0x0c25 length: 249 > 3 [ 806.268352][ T55] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2 [ 806.337561][ T55] Bluetooth: hci13: command tx timeout [ 806.446753][ T5235] Bluetooth: hci16: unexpected cc 0x0c03 length: 249 > 1 [ 806.458908][ T5235] Bluetooth: hci16: unexpected cc 0x1003 length: 249 > 9 [ 806.468348][ T5235] Bluetooth: hci16: unexpected cc 0x1001 length: 249 > 9 [ 806.476820][ T5235] Bluetooth: hci16: unexpected cc 0x0c23 length: 249 > 4 [ 806.486121][ T5235] Bluetooth: hci16: unexpected cc 0x0c25 length: 249 > 3 [ 806.493791][ T5235] Bluetooth: hci14: command tx timeout [ 806.501191][ T5235] Bluetooth: hci16: unexpected cc 0x0c38 length: 249 > 2 [ 806.574321][ T5235] Bluetooth: hci12: command tx timeout [ 808.333863][ T5235] Bluetooth: hci15: command tx timeout [ 808.415160][ T5235] Bluetooth: hci13: command tx timeout [ 808.573761][ T55] Bluetooth: hci14: command tx timeout [ 808.580117][ T5235] Bluetooth: hci16: command tx timeout [ 808.653866][ T5235] Bluetooth: hci12: command tx timeout [ 808.977152][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.991718][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 810.413771][ T5235] Bluetooth: hci15: command tx timeout [ 810.493618][ T5235] Bluetooth: hci13: command tx timeout [ 810.653643][ T55] Bluetooth: hci14: command tx timeout [ 810.660462][ T5235] Bluetooth: hci16: command tx timeout [ 810.733818][ T5235] Bluetooth: hci12: command tx timeout [ 811.073570][ T5235] Bluetooth: hci11: command 0x0406 tx timeout [ 811.079745][ T5235] Bluetooth: hci10: command 0x0406 tx timeout [ 812.493714][ T55] Bluetooth: hci15: command tx timeout [ 812.573731][ T55] Bluetooth: hci13: command tx timeout [ 812.733784][ T5235] Bluetooth: hci14: command tx timeout [ 812.739350][ T55] Bluetooth: hci16: command tx timeout [ 814.573774][ T55] Bluetooth: hci15: command tx timeout [ 814.813659][ T55] Bluetooth: hci16: command tx timeout [ 862.261406][ T5235] Bluetooth: hci1: command 0x0406 tx timeout [ 863.747589][T13136] Bluetooth: hci17: unexpected cc 0x0c03 length: 249 > 1 [ 863.758108][T13136] Bluetooth: hci17: unexpected cc 0x1003 length: 249 > 9 [ 863.767150][T13136] Bluetooth: hci17: unexpected cc 0x1001 length: 249 > 9 [ 863.775838][T13136] Bluetooth: hci17: unexpected cc 0x0c23 length: 249 > 4 [ 863.784820][T13136] Bluetooth: hci17: unexpected cc 0x0c25 length: 249 > 3 [ 863.792198][T13136] Bluetooth: hci17: unexpected cc 0x0c38 length: 249 > 2 [ 865.182800][T17536] Bluetooth: hci18: unexpected cc 0x0c03 length: 249 > 1 [ 865.197033][T17536] Bluetooth: hci18: unexpected cc 0x1003 length: 249 > 9 [ 865.205487][T17536] Bluetooth: hci18: unexpected cc 0x1001 length: 249 > 9 [ 865.214256][T17536] Bluetooth: hci18: unexpected cc 0x0c23 length: 249 > 4 [ 865.225772][T17536] Bluetooth: hci18: unexpected cc 0x0c25 length: 249 > 3 [ 865.233199][T17536] Bluetooth: hci18: unexpected cc 0x0c38 length: 249 > 2 [ 865.271193][T17544] Bluetooth: hci19: unexpected cc 0x0c03 length: 249 > 1 [ 865.281171][T17544] Bluetooth: hci19: unexpected cc 0x1003 length: 249 > 9 [ 865.292571][T17544] Bluetooth: hci19: unexpected cc 0x1001 length: 249 > 9 [ 865.322624][T17546] Bluetooth: hci19: unexpected cc 0x0c23 length: 249 > 4 [ 865.335446][T17546] Bluetooth: hci19: unexpected cc 0x0c25 length: 249 > 3 [ 865.342866][T17546] Bluetooth: hci19: unexpected cc 0x0c38 length: 249 > 2 [ 867.316737][T17552] Bluetooth: hci20: unexpected cc 0x0c03 length: 249 > 1 [ 867.329382][T17552] Bluetooth: hci20: unexpected cc 0x1003 length: 249 > 9 [ 867.345742][T17552] Bluetooth: hci20: unexpected cc 0x1001 length: 249 > 9 [ 867.355085][T17552] Bluetooth: hci20: unexpected cc 0x0c23 length: 249 > 4 [ 867.362777][T17552] Bluetooth: hci20: unexpected cc 0x0c25 length: 249 > 3 [ 867.372932][T17552] Bluetooth: hci20: unexpected cc 0x0c38 length: 249 > 2 [ 867.382512][T17552] Bluetooth: hci2: command 0x0406 tx timeout [ 867.390773][T17552] Bluetooth: hci3: command 0x0406 tx timeout [ 867.514428][T13136] Bluetooth: hci21: unexpected cc 0x0c03 length: 249 > 1 [ 867.528956][T13136] Bluetooth: hci21: unexpected cc 0x1003 length: 249 > 9 [ 867.538472][T13136] Bluetooth: hci21: unexpected cc 0x1001 length: 249 > 9 [ 867.547937][T13136] Bluetooth: hci21: unexpected cc 0x0c23 length: 249 > 4 [ 867.558006][T13136] Bluetooth: hci21: unexpected cc 0x0c25 length: 249 > 3 [ 867.566802][T13136] Bluetooth: hci21: unexpected cc 0x0c38 length: 249 > 2 [ 870.415634][ T30] INFO: task kworker/u8:8:4014 blocked for more than 143 seconds. [ 870.424056][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.430363][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.523248][ T30] Not tainted 6.12.0-rc1-syzkaller-00349-g8f602276d390 #0 [ 870.594981][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 870.699429][ T30] task:kworker/u8:8 state:D stack:20440 pid:4014 tgid:4014 ppid:2 flags:0x00004000 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 870.773599][ T30] Workqueue: netns cleanup_net [ 870.778447][ T30] Call Trace: [ 870.781743][ T30] [ 870.821224][ T30] __schedule+0x1895/0x4b30 [ 870.830485][ T30] ? __pfx___schedule+0x10/0x10 [ 870.843700][ T30] ? __pfx_lock_release+0x10/0x10 [ 870.848779][ T30] ? __mutex_trylock_common+0x92/0x2e0 [ 870.875117][ T30] ? kthread_data+0x52/0xd0 [ 870.879678][ T30] ? schedule+0x90/0x320 [ 870.897324][ T30] ? wq_worker_sleeping+0x66/0x240 [ 870.902492][ T30] ? schedule+0x90/0x320 [ 870.913644][ T30] schedule+0x14b/0x320 [ 870.917862][ T30] schedule_preempt_disabled+0x13/0x30 [ 870.935659][ T30] __mutex_lock+0x6a7/0xd70 [ 870.940216][ T30] ? __mutex_lock+0x52a/0xd70 [ 870.953950][ T30] ? cleanup_net+0x6af/0xcc0 [ 870.958590][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 870.974812][ T30] ? bpf_prog_array_free+0x34/0x40 [ 870.979971][ T30] cleanup_net+0x6af/0xcc0 [ 871.001046][ T30] ? __pfx_cleanup_net+0x10/0x10 [ 871.007411][ T30] ? process_scheduled_works+0x976/0x1850 [ 871.013177][ T30] process_scheduled_works+0xa63/0x1850 [ 871.030081][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 871.042807][ T30] ? assign_work+0x364/0x3d0 [ 871.053175][ T30] worker_thread+0x870/0xd30 [ 871.073983][ T30] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 871.079935][ T30] ? __kthread_parkme+0x169/0x1d0 [ 871.095559][ T30] ? __pfx_worker_thread+0x10/0x10 [ 871.100714][ T30] kthread+0x2f0/0x390 [ 871.115099][ T30] ? __pfx_worker_thread+0x10/0x10 [ 871.120264][ T30] ? __pfx_kthread+0x10/0x10 [ 871.134038][ T30] ret_from_fork+0x4b/0x80 [ 871.138506][ T30] ? __pfx_kthread+0x10/0x10 [ 871.155063][ T30] ret_from_fork_asm+0x1a/0x30 [ 871.159896][ T30] [ 871.174590][ T30] INFO: task kworker/u8:17:7589 blocked for more than 144 seconds. [ 871.182543][ T30] Not tainted 6.12.0-rc1-syzkaller-00349-g8f602276d390 #0 [ 871.200868][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 871.213815][ T30] task:kworker/u8:17 state:D stack:21392 pid:7589 tgid:7589 ppid:2 flags:0x00004000 [ 871.233598][ T30] Workqueue: events_unbound linkwatch_event [ 871.239547][ T30] Call Trace: [ 871.254219][ T30] [ 871.257191][ T30] __schedule+0x1895/0x4b30 [ 871.261753][ T30] ? __pfx___schedule+0x10/0x10 [ 871.279905][ T30] ? __pfx_lock_release+0x10/0x10 [ 871.291822][ T30] ? __mutex_trylock_common+0x92/0x2e0 [ 871.300887][ T30] ? kthread_data+0x52/0xd0 [ 871.321906][ T30] ? schedule+0x90/0x320 [ 871.326612][ T30] ? wq_worker_sleeping+0x66/0x240 [ 871.331764][ T30] ? schedule+0x90/0x320 [ 871.348657][ T30] schedule+0x14b/0x320 [ 871.352871][ T30] schedule_preempt_disabled+0x13/0x30 [ 871.364201][ T30] __mutex_lock+0x6a7/0xd70 [ 871.368755][ T30] ? __mutex_lock+0x52a/0xd70 [ 871.384885][ T30] ? linkwatch_event+0xe/0x60 [ 871.389616][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 871.403548][ T30] ? preempt_schedule_thunk+0x1a/0x30 [ 871.408972][ T30] ? process_scheduled_works+0x976/0x1850 [ 871.425477][ T30] linkwatch_event+0xe/0x60 [ 871.430026][ T30] process_scheduled_works+0xa63/0x1850 [ 871.448190][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 871.461452][ T30] ? assign_work+0x364/0x3d0 [ 871.468718][ T30] worker_thread+0x870/0xd30 [ 871.473361][ T30] ? __kthread_parkme+0x169/0x1d0 [ 871.490691][ T30] ? __pfx_worker_thread+0x10/0x10 [ 871.496266][ T30] kthread+0x2f0/0x390 [ 871.500369][ T30] ? __pfx_worker_thread+0x10/0x10 [ 871.517060][ T30] ? __pfx_kthread+0x10/0x10 [ 871.521688][ T30] ret_from_fork+0x4b/0x80 [ 871.533995][ T30] ? __pfx_kthread+0x10/0x10 [ 871.542412][ T30] ret_from_fork_asm+0x1a/0x30 [ 871.550368][ T30] [ 871.562178][ T30] INFO: task syz.0.2094:16075 blocked for more than 144 seconds. [ 871.572462][ T30] Not tainted 6.12.0-rc1-syzkaller-00349-g8f602276d390 #0 [ 871.590999][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 871.602269][ T30] task:syz.0.2094 state:D stack:23616 pid:16075 tgid:16074 ppid:15813 flags:0x00004006 [ 871.623537][ T30] Call Trace: [ 871.626850][ T30] [ 871.629802][ T30] __schedule+0x1895/0x4b30 [ 871.643976][ T30] ? __pfx___schedule+0x10/0x10 [ 871.648878][ T30] ? __pfx_lock_release+0x10/0x10 [ 871.664957][ T30] ? __mutex_trylock_common+0x92/0x2e0 [ 871.670471][ T30] ? schedule+0x90/0x320 [ 871.686141][ T30] schedule+0x14b/0x320 [ 871.690344][ T30] schedule_preempt_disabled+0x13/0x30 [ 871.711431][ T30] __mutex_lock+0x6a7/0xd70 [ 871.719764][ T30] ? __mutex_lock+0x52a/0xd70 [ 871.732494][ T30] ? netdev_run_todo+0x7b2/0x1000 [ 871.741320][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 871.754000][ T30] ? msleep+0xc6/0xe0 [ 871.758027][ T30] netdev_run_todo+0x7b2/0x1000 [ 871.762904][ T30] ? __pfx_netdev_run_todo+0x10/0x10 [ 871.779895][ T30] rtnetlink_rcv_msg+0x748/0xcf0 [ 871.789556][ T30] ? rtnetlink_rcv_msg+0x1a7/0xcf0 [ 871.800518][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 871.824613][ T30] ? ref_tracker_free+0x643/0x7e0 [ 871.829685][ T30] netlink_rcv_skb+0x1e3/0x430 [ 871.843521][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 871.851748][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 871.869704][ T30] ? netlink_deliver_tap+0x2e/0x1b0 [ 871.882020][ T30] netlink_unicast+0x7f6/0x990 [ 871.891592][ T30] ? __pfx_netlink_unicast+0x10/0x10 [ 871.902981][ T30] ? __virt_addr_valid+0x183/0x530 [ 871.914231][ T30] ? __check_object_size+0x48e/0x900 [ 871.919559][ T30] netlink_sendmsg+0x8e4/0xcb0 [ 871.934322][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 871.939657][ T30] ? aa_sock_msg_perm+0x91/0x160 [ 871.958034][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 871.967847][ T30] __sock_sendmsg+0x221/0x270 [ 871.972566][ T30] ____sys_sendmsg+0x52a/0x7e0 [ 871.989364][ T30] ? __pfx_____sys_sendmsg+0x10/0x10 [ 871.998409][ T30] __sys_sendmsg+0x292/0x380 [ 872.003040][ T30] ? __pfx___sys_sendmsg+0x10/0x10 [ 872.013773][ T30] ? __secure_computing+0x125/0x370 [ 872.019019][ T30] do_syscall_64+0xf3/0x230 [ 872.033918][ T30] ? clear_bhb_loop+0x35/0x90 [ 872.038640][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.056497][ T30] RIP: 0033:0x7ffb56b7dff9 [ 872.060951][ T30] RSP: 002b:00007ffb578d8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 872.080084][ T30] RAX: ffffffffffffffda RBX: 00007ffb56d35f80 RCX: 00007ffb56b7dff9 [ 872.093725][ T30] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005 [ 872.101732][ T30] RBP: 00007ffb56bf0296 R08: 0000000000000000 R09: 0000000000000000 [ 872.121424][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 872.133174][ T30] R13: 0000000000000000 R14: 00007ffb56d35f80 R15: 00007ffb56e5fa28 [ 872.152456][ T30] [ 872.156038][ T30] INFO: task syz.3.2361:17442 blocked for more than 145 seconds. [ 872.182960][ T30] Not tainted 6.12.0-rc1-syzkaller-00349-g8f602276d390 #0 [ 872.201385][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 872.212646][ T30] task:syz.3.2361 state:D stack:23456 pid:17442 tgid:17439 ppid:16926 flags:0x00004002 [ 872.233569][ T30] Call Trace: [ 872.236907][ T30] [ 872.239862][ T30] __schedule+0x1895/0x4b30 [ 872.256201][ T30] ? __pfx___schedule+0x10/0x10 [ 872.261148][ T30] ? __pfx_lock_release+0x10/0x10 [ 872.277111][ T30] ? __mutex_trylock_common+0x92/0x2e0 [ 872.282621][ T30] ? schedule+0x90/0x320 [ 872.293601][ T30] schedule+0x14b/0x320 [ 872.297811][ T30] schedule_preempt_disabled+0x13/0x30 [ 872.303299][ T30] __mutex_lock+0x6a7/0xd70 [ 872.318988][ T30] ? __mutex_lock+0x52a/0xd70 [ 872.329781][ T30] ? tun_chr_close+0x3b/0x1b0 [ 872.342427][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 872.354328][ T30] ? __pfx_call_rcu+0x10/0x10 [ 872.369968][ T30] tun_chr_close+0x3b/0x1b0 [ 872.378164][ T30] ? __pfx_tun_chr_close+0x10/0x10 [ 872.383309][ T30] __fput+0x23f/0x880 [ 872.398181][ T30] task_work_run+0x24f/0x310 [ 872.402809][ T30] ? kasan_quarantine_put+0xdc/0x230 [ 872.414035][ T30] ? __pfx_task_work_run+0x10/0x10 [ 872.419181][ T30] ? do_exit+0xa2a/0x28e0 [ 872.433655][ T30] ? kmem_cache_free+0x1a2/0x420 [ 872.438637][ T30] ? do_exit+0xa2a/0x28e0 [ 872.442994][ T30] do_exit+0xa2f/0x28e0 [ 872.453593][ T30] ? __pfx_do_exit+0x10/0x10 [ 872.458232][ T30] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 872.475318][ T30] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 872.481699][ T30] ? cgroup_freezing+0x2a8/0x350 [ 872.496468][ T30] do_group_exit+0x207/0x2c0 [ 872.501105][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 872.513552][ T30] ? lockdep_hardirqs_on+0x99/0x150 [ 872.518797][ T30] get_signal+0x16a3/0x1740 [ 872.523339][ T30] ? __pfx_get_signal+0x10/0x10 [ 872.539050][ T30] arch_do_signal_or_restart+0x96/0x860 [ 872.550955][ T30] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 872.562014][ T30] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 872.574226][ T30] ? syscall_exit_to_user_mode+0xa3/0x370 [ 872.579999][ T30] syscall_exit_to_user_mode+0xc9/0x370 [ 872.595696][ T30] do_syscall_64+0x100/0x230 [ 872.600321][ T30] ? clear_bhb_loop+0x35/0x90 [ 872.613077][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.622105][ T30] RIP: 0033:0x7f3b67d7dff9 [ 872.633983][ T30] RSP: 002b:00007f3b68c4b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 872.642441][ T30] RAX: 000000000000003c RBX: 00007f3b67f35f80 RCX: 00007f3b67d7dff9 [ 872.662643][ T30] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003 [ 872.677499][ T30] RBP: 00007f3b67df0296 R08: 0000000000000000 R09: 0000000000000000 [ 872.693384][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 872.703615][ T30] R13: 0000000000000000 R14: 00007f3b67f35f80 R15: 00007f3b6805fa28 [ 872.711636][ T30] [ 872.725160][ T30] INFO: task syz-executor:17462 blocked for more than 145 seconds. [ 872.733081][ T30] Not tainted 6.12.0-rc1-syzkaller-00349-g8f602276d390 #0 [ 872.753066][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 872.763174][ T30] task:syz-executor state:D stack:26080 pid:17462 tgid:17462 ppid:1 flags:0x00004006 [ 872.783499][ T30] Call Trace: [ 872.786817][ T30] [ 872.789772][ T30] __schedule+0x1895/0x4b30 [ 872.804370][ T30] ? __pfx___schedule+0x10/0x10 [ 872.810132][ T30] ? __pfx_lock_release+0x10/0x10 [ 872.824668][ T30] ? __mutex_trylock_common+0x92/0x2e0 [ 872.830175][ T30] ? schedule+0x90/0x320 [ 872.843464][ T30] schedule+0x14b/0x320 [ 872.847665][ T30] schedule_preempt_disabled+0x13/0x30 [ 872.853144][ T30] __mutex_lock+0x6a7/0xd70 [ 872.869444][ T30] ? __mutex_lock+0x52a/0xd70 [ 872.880181][ T30] ? ip_tunnel_init_net+0x20e/0x720 [ 872.890700][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 872.896053][T17559] Bluetooth: hci6: command 0x0406 tx timeout [ 872.902258][T17559] Bluetooth: hci5: command 0x0406 tx timeout [ 872.920378][ T30] ? read_word_at_a_time+0xe/0x20 [ 872.925799][ T30] ? sized_strscpy+0x8d/0x220 [ 872.930509][ T30] ip_tunnel_init_net+0x20e/0x720 [ 872.946140][ T30] ? __pfx_ip_tunnel_init_net+0x10/0x10 [ 872.951830][ T30] ? ops_init+0x75/0x590 [ 872.964013][ T30] ops_init+0x31e/0x590 [ 872.968261][ T30] ? lockdep_init_map_type+0xa1/0x910 [ 872.991429][ T30] setup_net+0x287/0x9e0 [ 872.996307][ T30] ? __pfx_down_read_killable+0x10/0x10 [ 873.001893][ T30] ? __pfx_setup_net+0x10/0x10 [ 873.018215][ T30] copy_net_ns+0x33f/0x570 [ 873.022700][ T30] create_new_namespaces+0x425/0x7b0 [ 873.039150][ T30] unshare_nsproxy_namespaces+0x124/0x180 [ 873.049637][ T30] ksys_unshare+0x57d/0xa70 [ 873.063656][ T30] ? __pfx_ksys_unshare+0x10/0x10 [ 873.068727][ T30] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 873.085235][ T30] ? do_syscall_64+0x100/0x230 [ 873.092478][ T30] __x64_sys_unshare+0x38/0x40 [ 873.103683][ T30] do_syscall_64+0xf3/0x230 [ 873.108238][ T30] ? clear_bhb_loop+0x35/0x90 [ 873.112941][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.129460][ T30] RIP: 0033:0x7fadf917f7f7 [ 873.140448][ T30] RSP: 002b:00007fadf945ffa8 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 [ 873.153642][ T30] RAX: ffffffffffffffda RBX: 00007fadf91f1a85 RCX: 00007fadf917f7f7 [ 873.161650][ T30] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 873.180079][ T30] RBP: 0000000000000000 R08: 00007fadf9e67d60 R09: 0000000000000000 [ 873.200389][ T30] R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000000c [ 873.213207][ T30] R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 [ 873.233496][ T30] [ 873.236694][ T30] INFO: task syz-executor:17470 blocked for more than 146 seconds. [ 873.253541][ T30] Not tainted 6.12.0-rc1-syzkaller-00349-g8f602276d390 #0 [ 873.261205][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 873.281253][ T30] task:syz-executor state:D stack:25368 pid:17470 tgid:17470 ppid:1 flags:0x00004006 [ 873.303928][ T30] Call Trace: [ 873.307242][ T30] [ 873.310193][ T30] __schedule+0x1895/0x4b30 [ 873.324488][ T30] ? __pfx___schedule+0x10/0x10 [ 873.329391][ T30] ? __pfx_lock_release+0x10/0x10 [ 873.343793][ T30] ? __mutex_trylock_common+0x92/0x2e0 [ 873.349309][ T30] ? schedule+0x90/0x320 [ 873.363465][ T30] schedule+0x14b/0x320 [ 873.367673][ T30] schedule_preempt_disabled+0x13/0x30 [ 873.373153][ T30] __mutex_lock+0x6a7/0xd70 [ 873.390233][ T30] ? __mutex_lock+0x52a/0xd70 [ 873.399905][ T30] ? ip_tunnel_init_net+0x20e/0x720 [ 873.412641][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 873.433847][ T30] ? read_word_at_a_time+0xe/0x20 [ 873.438925][ T30] ? sized_strscpy+0x8d/0x220 [ 873.453729][ T30] ip_tunnel_init_net+0x20e/0x720 [ 873.458818][ T30] ? __pfx_ip_tunnel_init_net+0x10/0x10 [ 873.473617][ T30] vti_init_net+0x2e/0xf0 [ 873.478004][ T30] ops_init+0x31e/0x590 [ 873.482192][ T30] ? lockdep_init_map_type+0xa1/0x910 [ 873.500142][ T30] setup_net+0x287/0x9e0 [ 873.509091][ T30] ? __pfx_down_read_killable+0x10/0x10 [ 873.520904][ T30] ? __pfx_setup_net+0x10/0x10 [ 873.531543][ T30] copy_net_ns+0x33f/0x570 [ 873.542502][ T30] create_new_namespaces+0x425/0x7b0 [ 873.552801][ T30] unshare_nsproxy_namespaces+0x124/0x180 [ 873.564798][ T30] ksys_unshare+0x57d/0xa70 [ 873.569352][ T30] ? __pfx_ksys_unshare+0x10/0x10 [ 873.583846][ T30] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 873.592404][ T30] ? do_syscall_64+0x100/0x230 [ 873.603562][ T30] __x64_sys_unshare+0x38/0x40 [ 873.608373][ T30] do_syscall_64+0xf3/0x230 [ 873.612895][ T30] ? clear_bhb_loop+0x35/0x90 [ 873.630426][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.641457][ T30] RIP: 0033:0x7f0bc857f7f7 [ 873.651647][ T30] RSP: 002b:00007f0bc885ffa8 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 [ 873.670476][ T30] RAX: ffffffffffffffda RBX: 00007f0bc85f1a85 RCX: 00007f0bc857f7f7 [ 873.682290][ T30] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 873.703304][ T30] RBP: 0000000000000000 R08: 00007f0bc9267d60 R09: 0000000000000000 [ 873.713055][ T30] R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000000c [ 873.723700][ T30] R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 [ 873.731725][ T30] [ 873.745801][ T30] INFO: task syz-executor:17474 blocked for more than 146 seconds. [ 873.764123][ T30] Not tainted 6.12.0-rc1-syzkaller-00349-g8f602276d390 #0 [ 873.771790][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 873.792193][ T30] task:syz-executor state:D stack:26080 pid:17474 tgid:17474 ppid:1 flags:0x00004006 [ 873.814914][ T30] Call Trace: [ 873.818231][ T30] [ 873.821185][ T30] __schedule+0x1895/0x4b30 [ 873.833615][ T30] ? __pfx___schedule+0x10/0x10 [ 873.838516][ T30] ? __pfx_lock_release+0x10/0x10 [ 873.855616][ T30] ? __mutex_trylock_common+0x92/0x2e0 [ 873.861131][ T30] ? schedule+0x90/0x320 [ 873.874608][ T30] schedule+0x14b/0x320 [ 873.878810][ T30] schedule_preempt_disabled+0x13/0x30 [ 873.895786][ T30] __mutex_lock+0x6a7/0xd70 [ 873.900334][ T30] ? __mutex_lock+0x52a/0xd70 [ 873.913501][ T30] ? ip_tunnel_init_net+0x20e/0x720 [ 873.918750][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 873.935428][ T30] ip_tunnel_init_net+0x20e/0x720 [ 873.940510][ T30] ? __pfx_ip_tunnel_init_net+0x10/0x10 [ 873.953911][ T30] ? ops_init+0x75/0x590 [ 873.958208][ T30] ops_init+0x31e/0x590 [ 873.962395][ T30] ? lockdep_init_map_type+0xa1/0x910 [ 873.979130][ T30] setup_net+0x287/0x9e0 [ 873.989312][ T30] ? __pfx_down_read_killable+0x10/0x10 [ 874.000501][ T30] ? __pfx_setup_net+0x10/0x10 [ 874.012415][ T30] copy_net_ns+0x33f/0x570 [ 874.023674][ T30] create_new_namespaces+0x425/0x7b0 [ 874.029015][ T30] unshare_nsproxy_namespaces+0x124/0x180 [ 874.045109][ T30] ksys_unshare+0x57d/0xa70 [ 874.049660][ T30] ? __pfx_ksys_unshare+0x10/0x10 [ 874.064317][ T30] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 874.070689][ T30] ? do_syscall_64+0x100/0x230 [ 874.086432][ T30] __x64_sys_unshare+0x38/0x40 [ 874.091237][ T30] do_syscall_64+0xf3/0x230 [ 874.104838][ T30] ? clear_bhb_loop+0x35/0x90 [ 874.119581][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 874.129820][ T30] RIP: 0033:0x7f25e877f7f7 [ 874.141254][ T30] RSP: 002b:00007f25e8a5ffa8 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 [ 874.153697][ T30] RAX: ffffffffffffffda RBX: 00007f25e87f1a85 RCX: 00007f25e877f7f7 [ 874.161706][ T30] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 874.182689][ T30] RBP: 0000000000000000 R08: 00007f25e9467d60 R09: 0000000000000000 [ 874.193885][ T30] R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000000c [ 874.213601][ T30] R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 [ 874.221628][ T30] [ 874.234319][ T30] [ 874.234319][ T30] Showing all locks held in the system: [ 874.242085][ T30] 3 locks held by kworker/0:0/8: [ 874.264465][ T30] 1 lock held by khungtaskd/30: [ 874.269372][ T30] #0: ffffffff8e937de0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 [ 874.295396][ T30] 3 locks held by kworker/1:1/52: [ 874.300463][ T30] #0: ffff88801ac80948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 874.316942][ T30] #1: ffffc90000bc7d00 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 874.339011][ T30] #2: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xe/0x20 [ 874.361573][ T30] 5 locks held by kworker/u9:0/55: [ 874.367188][ T30] #0: ffff888069095948 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 874.389697][ T30] #1: ffffc9000120fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 874.413707][ T30] #2: ffff8880248d0d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 [ 874.433487][ T30] #3: ffff8880248d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 [ 874.445085][ T30] #4: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x15d/0x300 [ 874.465368][ T30] 6 locks held by kworker/0:2/938: [ 874.470535][ T30] 4 locks held by kworker/u8:8/4014: [ 874.483608][ T30] #0: ffff88801baed948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 874.503725][ T30] #1: ffffc9000c447d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 874.526206][ T30] #2: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x16a/0xcc0 [ 874.542598][ T30] #3: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: cleanup_net+0x6af/0xcc0 [ 874.562972][ T30] 2 locks held by getty/4982: [ 874.567801][ T30] #0: ffff8880332d20a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 874.592305][ T30] #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6a6/0x1e00 [ 874.602906][ T30] 5 locks held by kworker/u9:4/5233: [ 874.613543][ T30] #0: ffff888045f78148 ((wq_completion)hci11){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 874.635659][ T30] #1: ffffc90003b0fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 874.653635][ T30] #2: ffff8880673b8d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 [ 874.673287][ T30] #3: ffff8880673b8078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 [ 874.684765][ T30] #4: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x15d/0x300 [ 874.703505][ T30] 4 locks held by kworker/u9:5/5235: [ 874.708817][ T30] #0: ffff888166cef948 ((wq_completion)hci17#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 874.736417][ T30] #1: ffffc90003b2fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 874.753521][ T30] #2: ffff888051870078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0xaa0 [ 874.772953][ T30] #3: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x473/0xaa0 [ 874.793516][ T30] 5 locks held by kworker/0:6/5288: [ 874.798756][ T30] 3 locks held by kworker/0:7/5289: [ 874.816083][ T30] 3 locks held by kworker/u8:10/7578: [ 874.821493][ T30] #0: ffff88814b585148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 874.844128][ T30] #1: ffffc9000334fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 874.868404][ T30] #2: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xd0/0x16f0 [ 874.882822][ T30] 3 locks held by kworker/u8:17/7589: [ 874.895724][ T30] #0: ffff88801ac89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 874.920014][ T30] #1: ffffc9000312fd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 874.942534][ T30] #2: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 [ 874.963515][ T30] 5 locks held by kworker/u9:1/13136: [ 874.968925][ T30] #0: ffff888063dfe948 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 874.990611][ T30] #1: ffffc90004c1fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 875.007083][ T30] #2: ffff88806aae4d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 [ 875.024249][ T30] #3: ffff88806aae4078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 [ 875.043632][ T30] #4: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x15d/0x300 [ 875.064000][ T30] 1 lock held by syz.0.2094/16075: [ 875.069142][ T30] #0: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: netdev_run_todo+0x7b2/0x1000 [ 875.090897][ T30] 2 locks held by syz.0.2350/17407: [ 875.100796][ T30] 1 lock held by syz.3.2361/17442: [ 875.111778][ T30] #0: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3b/0x1b0 [ 875.132100][ T30] 2 locks held by syz-executor/17462: [ 875.139938][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.163172][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: ip_tunnel_init_net+0x20e/0x720 [ 875.183629][ T30] 2 locks held by syz-executor/17468: [ 875.189043][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.209146][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: wg_netns_pre_exit+0x1f/0x1e0 [ 875.224603][ T30] 2 locks held by syz-executor/17470: [ 875.230015][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.252811][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: ip_tunnel_init_net+0x20e/0x720 [ 875.273470][ T30] 2 locks held by syz-executor/17474: [ 875.278882][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.303694][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: ip_tunnel_init_net+0x20e/0x720 [ 875.313269][ T30] 2 locks held by syz-executor/17476: [ 875.331316][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.346787][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: wg_netns_pre_exit+0x1f/0x1e0 [ 875.363791][ T30] 7 locks held by syz-executor/17488: [ 875.369194][ T30] #0: ffff8880335d2420 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x224/0xc90 [ 875.392211][ T30] #1: ffff88807e217488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1ea/0x500 [ 875.414044][ T30] #2: ffff888143bd0968 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x20e/0x500 [ 875.429272][ T30] #3: ffffffff8f56fda8 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xfc/0x480 [ 875.450931][ T30] #4: ffff8880750220e8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 [ 875.473617][ T30] #5: ffff888074498250 (&devlink->lock_key#50){+.+.}-{3:3}, at: nsim_drv_remove+0x50/0x160 [ 875.493627][ T30] #6: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: unregister_netdevice_notifier_net+0x89/0x3a0 [ 875.514988][ T30] 2 locks held by syz-executor/17504: [ 875.520391][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.553486][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 875.579380][ T30] 2 locks held by syz-executor/17505: [ 875.590940][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.603665][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 875.625404][ T30] 6 locks held by kworker/u9:2/17510: [ 875.630817][ T30] #0: ffff888067204148 ((wq_completion)hci10){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 875.653098][ T30] #1: ffffc9000489fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 875.673484][ T30] #2: ffff888075ef4d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 [ 875.683397][ T30] #3: ffff888075ef4078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 [ 875.713481][ T30] #4: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x15d/0x300 [ 875.723305][ T30] #5: ffffffff8e93d378 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 [ 875.747200][ T30] 2 locks held by syz-executor/17511: [ 875.752601][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.773633][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 875.794197][ T30] 2 locks held by syz-executor/17512: [ 875.799691][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.822665][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 875.838837][ T30] 2 locks held by syz-executor/17517: [ 875.850191][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.871619][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 875.891884][ T30] 2 locks held by syz-executor/17521: [ 875.898927][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.919248][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 875.934134][ T30] 2 locks held by syz-executor/17523: [ 875.939538][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 875.961050][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 875.982448][ T30] 2 locks held by syz-executor/17528: [ 875.987962][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 876.008755][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 876.032629][ T30] 2 locks held by syz-executor/17530: [ 876.038256][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 876.058101][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 876.079053][ T30] 1 lock held by dhcpcd/17532: [ 876.089509][ T30] #0: ffff88809ebf4258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcb0 [ 876.103553][ T30] 1 lock held by dhcpcd/17533: [ 876.108350][ T30] #0: ffff88807bb48258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcb0 [ 876.129894][ T30] 4 locks held by kworker/u9:3/17536: [ 876.142376][ T30] #0: ffff8880860cb148 ((wq_completion)hci18#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 876.159448][ T30] #1: ffffc900031dfd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 876.178423][ T30] #2: ffff8880601f4078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0xaa0 [ 876.205803][ T30] #3: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x473/0xaa0 [ 876.223610][ T30] 2 locks held by syz-executor/17538: [ 876.229102][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 876.251686][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 876.274380][ T30] 5 locks held by kworker/u9:6/17541: [ 876.279792][ T30] #0: ffff888049bd6948 ((wq_completion)hci2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 876.301636][ T30] #1: ffffc90009697d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 876.324437][ T30] #2: ffff888032c90d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 [ 876.346927][ T30] #3: ffff888032c90078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 [ 876.367900][ T30] #4: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x15d/0x300 [ 876.383590][ T30] 5 locks held by kworker/u9:7/17544: [ 876.388995][ T30] #0: ffff888064403148 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 876.411382][ T30] #1: ffffc9000322fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 876.433749][ T30] #2: ffff888073f1cd80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 [ 876.455299][ T30] #3: ffff888073f1c078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 [ 876.475911][ T30] #4: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x15d/0x300 [ 876.493680][ T30] 4 locks held by kworker/u9:8/17545: [ 876.499088][ T30] #0: ffff8880b27c5148 ((wq_completion)hci21#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 876.522877][ T30] #1: ffffc9000324fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 876.543466][ T30] #2: ffff888097ecc078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0xaa0 [ 876.564159][ T30] #3: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x473/0xaa0 [ 876.585295][ T30] 4 locks held by kworker/u9:9/17546: [ 876.590697][ T30] #0: ffff8880860cc948 ((wq_completion)hci19#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 876.613395][ T30] #1: ffffc9000325fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 876.633618][ T30] #2: ffff888033c28078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0xaa0 [ 876.655286][ T30] #3: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x473/0xaa0 [ 876.683049][ T30] 2 locks held by syz-executor/17547: [ 876.691265][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 876.710935][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 876.732584][ T30] 2 locks held by syz-executor/17548: [ 876.738554][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 876.760411][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 876.780880][ T30] 1 lock held by dhcpcd/17551: [ 876.789956][ T30] #0: ffff88814bfd4258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcb0 [ 876.803495][ T30] 5 locks held by kworker/u9:10/17552: [ 876.808980][ T30] #0: ffff8880818a3148 ((wq_completion)hci6){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 876.833352][ T30] #1: ffffc90003297d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 876.854023][ T30] #2: ffff888028540d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 [ 876.875016][ T30] #3: ffff888028540078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 [ 876.894340][ T30] #4: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x15d/0x300 [ 876.915569][ T30] 4 locks held by kworker/u9:11/17554: [ 876.921066][ T30] #0: ffff88809a5ae948 ((wq_completion)hci20#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 876.943506][ T30] #1: ffffc900032dfd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 876.967732][ T30] #2: ffff88808c5ec078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0xaa0 [ 876.989277][ T30] #3: ffffffff8fe3e568 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x473/0xaa0 [ 877.011587][ T30] 2 locks held by syz-executor/17555: [ 877.019633][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 877.040504][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 877.053114][ T30] 2 locks held by syz-executor/17557: [ 877.067600][ T30] #0: ffffffff8fcc51d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 877.087734][ T30] #1: ffffffff8fcd1cc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 877.103522][ T30] 1 lock held by dhcpcd/17560: [ 877.108313][ T30] #0: ffff8880829e6258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcb0 [ 877.129887][ T30] [ 877.132253][ T30] ============================================= [ 877.132253][ T30] [ 877.154093][ T30] NMI backtrace for cpu 1 [ 877.158458][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-rc1-syzkaller-00349-g8f602276d390 #0 [ 877.168977][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 877.179050][ T30] Call Trace: [ 877.182345][ T30] [ 877.185293][ T30] dump_stack_lvl+0x241/0x360 [ 877.189999][ T30] ? __pfx_dump_stack_lvl+0x10/0x10 [ 877.195217][ T30] ? __pfx__printk+0x10/0x10 [ 877.199840][ T30] nmi_cpu_backtrace+0x49c/0x4d0 [ 877.204890][ T30] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 877.210368][ T30] ? _printk+0xd5/0x120 [ 877.214550][ T30] ? __pfx__printk+0x10/0x10 [ 877.219165][ T30] ? __wake_up_klogd+0xcc/0x110 [ 877.224039][ T30] ? __pfx__printk+0x10/0x10 [ 877.228657][ T30] ? __rcu_read_unlock+0xa1/0x110 [ 877.233707][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 877.239712][ T30] nmi_trigger_cpumask_backtrace+0x198/0x320 [ 877.245720][ T30] watchdog+0xff4/0x1040 [ 877.249984][ T30] ? watchdog+0x1ea/0x1040 [ 877.254427][ T30] ? __pfx_watchdog+0x10/0x10 [ 877.259133][ T30] kthread+0x2f0/0x390 [ 877.263220][ T30] ? __pfx_watchdog+0x10/0x10 [ 877.267919][ T30] ? __pfx_kthread+0x10/0x10 [ 877.272530][ T30] ret_from_fork+0x4b/0x80 [ 877.276973][ T30] ? __pfx_kthread+0x10/0x10 [ 877.281581][ T30] ret_from_fork_asm+0x1a/0x30 [ 877.286383][ T30] [ 877.290168][ T30] Sending NMI from CPU 1 to CPUs 0: [ 877.295815][ C0] NMI backtrace for cpu 0 [ 877.295829][ C0] CPU: 0 UID: 0 PID: 938 Comm: kworker/0:2 Not tainted 6.12.0-rc1-syzkaller-00349-g8f602276d390 #0 [ 877.295849][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 877.295860][ C0] Workqueue: events nsim_dev_trap_report_work [ 877.295881][ C0] RIP: 0010:check_preemption_disabled+0x2/0x120 [ 877.295902][ C0] Code: fb 60 8c 48 c7 c6 80 fb 60 8c eb 1c 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 57 <41> 56 41 54 53 48 83 ec 10 65 48 8b 04 25 28 00 00 00 48 89 44 24 [ 877.295917][ C0] RSP: 0018:ffffc90000006bc0 EFLAGS: 00000046 [ 877.295931][ C0] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000080000102 [ 877.295943][ C0] RDX: ffff888025c59e00 RSI: ffffffff8c0adc40 RDI: ffffffff8c60fba0 [ 877.295956][ C0] RBP: 0000000000000004 R08: ffffffff8a1eb81f R09: ffffffff8a1eb4c9 [ 877.295968][ C0] R10: 0000000000000003 R11: ffff888025c59e00 R12: 0000000000000246 [ 877.295979][ C0] R13: ffff888025c59e00 R14: 00000000ffffffff R15: ffffffff8e937de0 [ 877.295993][ C0] FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 [ 877.296007][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 877.296019][ C0] CR2: 0000000020139000 CR3: 000000000e734000 CR4: 00000000003526f0 [ 877.296034][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 877.296044][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 877.296056][ C0] Call Trace: [ 877.296062][ C0] [ 877.296069][ C0] ? nmi_cpu_backtrace+0x3c2/0x4d0 [ 877.296088][ C0] ? __pfx_lock_acquire+0x10/0x10 [ 877.296111][ C0] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 877.296135][ C0] ? nmi_cpu_backtrace_handler+0xc/0x20 [ 877.296154][ C0] ? nmi_handle+0x14f/0x5a0 [ 877.296171][ C0] ? nmi_handle+0x2a/0x5a0 [ 877.296187][ C0] ? check_preemption_disabled+0x2/0x120 [ 877.296203][ C0] ? default_do_nmi+0x63/0x160 [ 877.296222][ C0] ? exc_nmi+0x123/0x1f0 [ 877.296239][ C0] ? end_repeat_nmi+0xf/0x53 [ 877.296256][ C0] ? ip_route_output_key_hash_rcu+0xef9/0x2390 [ 877.296277][ C0] ? ip_route_output_key_hash_rcu+0x124f/0x2390 [ 877.296298][ C0] ? check_preemption_disabled+0x2/0x120 [ 877.296315][ C0] ? check_preemption_disabled+0x2/0x120 [ 877.296331][ C0] ? check_preemption_disabled+0x2/0x120 [ 877.296363][ C0] [ 877.296369][ C0] [ 877.296375][ C0] lock_is_held_type+0x101/0x190 [ 877.296397][ C0] ip_route_output_key_hash_rcu+0x1258/0x2390 [ 877.296423][ C0] ip_route_output_key_hash+0x193/0x2b0 [ 877.296443][ C0] ? ip_route_output_key_hash+0xdf/0x2b0 [ 877.296463][ C0] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 877.296485][ C0] ? __pfx_lock_release+0x10/0x10 [ 877.296505][ C0] ? kthread+0x2f0/0x390 [ 877.296523][ C0] ip_route_output_flow+0x29/0x140 [ 877.296548][ C0] ip_route_me_harder+0x80d/0x1300 [ 877.296571][ C0] ? __pfx_ip_route_me_harder+0x10/0x10 [ 877.296590][ C0] ? trace_kmalloc+0x1f/0xd0 [ 877.296608][ C0] ? __kmalloc_node_track_caller_noprof+0x242/0x440 [ 877.296636][ C0] synproxy_send_tcp+0x356/0x6c0 [ 877.296659][ C0] synproxy_send_client_synack+0x8b8/0xf30 [ 877.296683][ C0] ? __pfx_synproxy_send_client_synack+0x10/0x10 [ 877.296704][ C0] ? synproxy_pernet+0x45/0x270 [ 877.296725][ C0] nft_synproxy_eval_v4+0x3ca/0x610 [ 877.296747][ C0] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 877.296769][ C0] ? nf_ip_checksum+0x13a/0x500 [ 877.296791][ C0] nft_synproxy_do_eval+0x362/0xa60 [ 877.296813][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 877.296836][ C0] ? __pfx_validate_chain+0x10/0x10 [ 877.296856][ C0] nft_do_chain+0x4ad/0x1da0 [ 877.296881][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 877.296901][ C0] ? __local_bh_enable_ip+0x168/0x200 [ 877.296929][ C0] ? __pfx_nf_nat_inet_fn+0x10/0x10 [ 877.296947][ C0] nft_do_chain_inet+0x418/0x6b0 [ 877.296969][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 877.296988][ C0] ? ipt_do_table+0x312/0x1860 [ 877.297014][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 877.297033][ C0] nf_hook_slow+0xc3/0x220 [ 877.297052][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 877.297069][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 877.297087][ C0] NF_HOOK+0x29e/0x450 [ 877.297104][ C0] ? NF_HOOK+0x9a/0x450 [ 877.297119][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 877.297137][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 877.297156][ C0] ? ip_rcv_finish+0x406/0x560 [ 877.297173][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 877.297189][ C0] NF_HOOK+0x3a4/0x450 [ 877.297205][ C0] ? __lock_acquire+0x1384/0x2050 [ 877.297226][ C0] ? NF_HOOK+0x9a/0x450 [ 877.297242][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 877.297257][ C0] ? ip_rcv_core+0x801/0xd10 [ 877.297274][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 877.297293][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 877.297309][ C0] __netif_receive_skb+0x2bf/0x650 [ 877.297329][ C0] ? __pfx_lock_acquire+0x10/0x10 [ 877.297349][ C0] ? __pfx___netif_receive_skb+0x10/0x10 [ 877.297367][ C0] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 877.297388][ C0] ? __pfx_lock_release+0x10/0x10 [ 877.297408][ C0] ? _raw_spin_lock_irq+0xdf/0x120 [ 877.297432][ C0] process_backlog+0x662/0x15b0 [ 877.297452][ C0] ? process_backlog+0x33b/0x15b0 [ 877.297473][ C0] ? __pfx_process_backlog+0x10/0x10 [ 877.297492][ C0] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 877.297513][ C0] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 877.297539][ C0] __napi_poll+0xcb/0x490 [ 877.297558][ C0] net_rx_action+0x89b/0x1240 [ 877.297584][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 877.297610][ C0] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 877.297634][ C0] handle_softirqs+0x2c5/0x980 [ 877.297655][ C0] ? do_softirq+0x11b/0x1e0 [ 877.297674][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 877.297694][ C0] ? rcu_is_watching+0x15/0xb0 [ 877.297713][ C0] do_softirq+0x11b/0x1e0 [ 877.297730][ C0] [ 877.297736][ C0] [ 877.297742][ C0] ? __pfx_do_softirq+0x10/0x10 [ 877.297761][ C0] ? __pfx_lockdep_softirqs_on+0x10/0x10 [ 877.297782][ C0] ? rcu_is_watching+0x15/0xb0 [ 877.297800][ C0] __local_bh_enable_ip+0x1bb/0x200 [ 877.297819][ C0] ? nsim_dev_trap_report_work+0x75d/0xaa0 [ 877.297836][ C0] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 877.297856][ C0] ? do_raw_spin_unlock+0x13c/0x8b0 [ 877.297875][ C0] ? nsim_dev_trap_report_work+0x6a7/0xaa0 [ 877.297894][ C0] nsim_dev_trap_report_work+0x75d/0xaa0 [ 877.297916][ C0] ? process_scheduled_works+0x976/0x1850 [ 877.297936][ C0] process_scheduled_works+0xa63/0x1850 [ 877.297964][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 877.297987][ C0] ? assign_work+0x364/0x3d0 [ 877.298007][ C0] worker_thread+0x870/0xd30 [ 877.298031][ C0] ? __kthread_parkme+0x169/0x1d0 [ 877.298052][ C0] ? __pfx_worker_thread+0x10/0x10 [ 877.298072][ C0] kthread+0x2f0/0x390 [ 877.298087][ C0] ? __pfx_worker_thread+0x10/0x10 [ 877.298105][ C0] ? __pfx_kthread+0x10/0x10 [ 877.298121][ C0] ret_from_fork+0x4b/0x80 [ 877.298141][ C0] ? __pfx_kthread+0x10/0x10 [ 877.298156][ C0] ret_from_fork_asm+0x1a/0x30 [ 877.298180][ C0] [ 878.058959][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 878.065848][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-rc1-syzkaller-00349-g8f602276d390 #0 [ 878.076369][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 878.086451][ T30] Call Trace: [ 878.089749][ T30] [ 878.092699][ T30] dump_stack_lvl+0x241/0x360 [ 878.097408][ T30] ? __pfx_dump_stack_lvl+0x10/0x10 [ 878.102641][ T30] ? __pfx__printk+0x10/0x10 [ 878.107258][ T30] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 878.113269][ T30] ? vscnprintf+0x5d/0x90 [ 878.117620][ T30] panic+0x349/0x880 [ 878.121558][ T30] ? nmi_trigger_cpumask_backtrace+0x244/0x320 [ 878.127735][ T30] ? __pfx_panic+0x10/0x10 [ 878.132170][ T30] ? tick_nohz_tick_stopped+0x82/0xb0 [ 878.137566][ T30] ? __irq_work_queue_local+0x137/0x410 [ 878.143132][ T30] ? preempt_schedule_thunk+0x1a/0x30 [ 878.148529][ T30] ? nmi_trigger_cpumask_backtrace+0x244/0x320 [ 878.154745][ T30] ? nmi_trigger_cpumask_backtrace+0x2d4/0x320 [ 878.160920][ T30] ? nmi_trigger_cpumask_backtrace+0x2d9/0x320 [ 878.167096][ T30] watchdog+0x1033/0x1040 [ 878.171445][ T30] ? watchdog+0x1ea/0x1040 [ 878.175887][ T30] ? __pfx_watchdog+0x10/0x10 [ 878.180585][ T30] kthread+0x2f0/0x390 [ 878.184671][ T30] ? __pfx_watchdog+0x10/0x10 [ 878.189365][ T30] ? __pfx_kthread+0x10/0x10 [ 878.193970][ T30] ret_from_fork+0x4b/0x80 [ 878.198410][ T30] ? __pfx_kthread+0x10/0x10 [ 878.203022][ T30] ret_from_fork_asm+0x1a/0x30 [ 878.207820][ T30] [ 878.211088][ T30] Kernel Offset: disabled [ 878.215407][ T30] Rebooting in 86400 seconds..