last executing test programs: 17.359986156s ago: executing program 2 (id=78): socket$inet6(0xa, 0x5, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2400c110, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @loopback}, 0x1c) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10}) io_uring_enter(0xffffffffffffffff, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x2, 0x5001) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, 0x0, 0x0) add_key$keyring(&(0x7f0000000100), &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, &(0x7f00000002c0)="0000000000000002ff690000000000010000001800000002000200861f", 0x1d, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r4, 0x0, {0x0, 0xff, 0x1}, 0x2}, 0x18) sendmsg$can_j1939(r3, &(0x7f0000000180)={0x0, 0x61, &(0x7f00000005c0)={&(0x7f0000000300)='.', 0x1a000}}, 0x0) 17.152236777s ago: executing program 1 (id=79): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f00000004c0)="d328", 0xfffffefd}], 0x1) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x5) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, 0x0, 0x40) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4342, 0x0) dup(r1) 15.503897178s ago: executing program 4 (id=82): r0 = io_uring_setup(0x650b, &(0x7f0000000180)={0x0, 0x2c3f, 0x0, 0x21, 0xab}) socket(0x28, 0x5, 0x0) socket(0x28, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) bind$inet6(r1, 0x0, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x31, &(0x7f0000000280)="b74560dc", 0x4) sendmmsg$inet6(r1, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1}}], 0x1, 0x20080058) close_range(r0, 0xffffffffffffffff, 0x0) 15.415297893s ago: executing program 2 (id=83): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000640)={0x34, &(0x7f0000000400)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 15.102164674s ago: executing program 0 (id=84): r0 = syz_open_dev$dri(&(0x7f0000000100), 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f00000004c0)={0x0, 0x0, 0x4, 0x0, 0x2, [], [0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0xfffffffc], [0x1]}) mmap(&(0x7f0000002000/0x3000)=nil, 0x3020, 0x1000004, 0x13, r0, 0x100000000) 15.005046769s ago: executing program 4 (id=85): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000001680)) r3 = eventfd2(0x1, 0x80001) ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f00000001c0)={0x0, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001d00)=""/176, 0x0, 0xffff1000}) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x0, r3}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f0000000140)={@my=0x1}) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) 14.908696868s ago: executing program 1 (id=86): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) 14.864404303s ago: executing program 0 (id=87): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000002080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000000)=0x400000001, 0x4) 14.776085507s ago: executing program 1 (id=88): syz_open_dev$video(0x0, 0x80000000000004, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x2a5c0, 0x113) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x4008855}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a44000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000018000480140003"], 0x6c}, 0x1, 0x0, 0x0, 0x20040845}, 0x802) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1/file3\x00', 0x1c2) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x1) fcntl$lock(r3, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0xc369d000) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 14.436196887s ago: executing program 3 (id=89): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="12010000e3ddef20501da1604fa101"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000780)={0x1c, &(0x7f0000000000)=ANY=[], 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, &(0x7f0000000580)={0x14, 0x0, 0x0}, &(0x7f0000000800)={0x34, &(0x7f0000000840)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000240)={0x1c, &(0x7f0000000140)=ANY=[], 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000480)={0x44, &(0x7f0000000280), 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x82, 0x1, 'I'}, 0x0, 0x0, 0x0}) 12.290313217s ago: executing program 0 (id=90): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000002080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) 12.131356781s ago: executing program 2 (id=91): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000040154220a9055015bbe4010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000e40)={0x84, &(0x7f00000009c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000580)={0x34, &(0x7f0000000180)={0x0, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002840)={0x84, &(0x7f00000023c0)={0x20, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000240)={0x40, 0x17, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000009c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)={0x20, 0x84, 0x2, "e6df"}, 0x0}) 9.840644698s ago: executing program 0 (id=92): socket$inet6(0xa, 0x5, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2400c110, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @loopback}, 0x1c) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10}) io_uring_enter(0xffffffffffffffff, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x2, 0x5001) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, 0x0, 0x0) add_key$keyring(&(0x7f0000000100), &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, &(0x7f00000002c0)="0000000000000002ff690000000000010000001800000002000200861f", 0x1d, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) connect$can_j1939(r3, &(0x7f0000000080)={0x1d, r4, 0x0, {0x0, 0xff, 0x2}, 0xfe}, 0x18) sendmsg$can_j1939(r3, &(0x7f0000000180)={0x0, 0x61, &(0x7f00000005c0)={&(0x7f0000000300)='.', 0x1a000}}, 0x0) 9.638616839s ago: executing program 4 (id=93): socket$inet6(0xa, 0x5, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2400c110, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @loopback}, 0x1c) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10}) io_uring_enter(0xffffffffffffffff, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x2, 0x5001) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, 0x0, 0x0) add_key$keyring(&(0x7f0000000100), &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, &(0x7f00000002c0)="0000000000000002ff690000000000010000001800000002000200861f", 0x1d, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r4, 0x0, {0x0, 0xff, 0x1}, 0x2}, 0x18) sendmsg$can_j1939(r3, &(0x7f0000000180)={0x0, 0x61, &(0x7f00000005c0)={&(0x7f0000000300)='.', 0x1a000}}, 0x0) 8.823490376s ago: executing program 1 (id=94): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000780)={'pim6reg0\x00', 0x400}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="02c90010000c00050017c0080007002c0f00208100d69e24882991d688c8a636adf013f8b84d95b12aaf9539cc1b1633412e9513cde0317f597a0ceb210d950972a4c0d01c1d1a50cc0b412af62cd8181303adc3ec9d73afbf94a8778d1d307ac4d09f6faa698dce87ee5e8cbf3b72fb572f487c444eb0bf1f1bc181e8b2ff5fcc6f84ae399312a183078388e7b3ab8d345a5f0e115f8b9377cc70fdb2d79465cce85f0d90"], 0x15) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)=[{0x0}], 0x1}, 0x40044) socket$inet_tcp(0x2, 0x1, 0x0) waitid$P_PIDFD(0x3, 0xffffffffffffffff, 0x0, 0xa000000c, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000200)='uid_map\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000400)={0x2, @vbi={0x3, 0x7, 0x1, 0x30314752, [0x9, 0x3], [0x4a0, 0xa], 0x1}}) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000640), 0x0, 0x20004803) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r5, 0x200, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x76, 0x4b}}}}, [@NL80211_ATTR_MESH_SETUP={0x8, 0x70, [@NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000880}, 0x800) 8.724081383s ago: executing program 3 (id=95): r0 = io_uring_setup(0x650b, &(0x7f0000000180)={0x0, 0x2c3f, 0x0, 0x21, 0xab}) socket(0x28, 0x5, 0x0) socket(0x28, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) bind$inet6(r1, 0x0, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x31, &(0x7f0000000280)="b74560dc", 0x4) sendmmsg$inet6(r1, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1}}], 0x1, 0x20080058) close_range(r0, 0xffffffffffffffff, 0x0) 8.596172083s ago: executing program 4 (id=96): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000040), 0x100000000009, 0x80000) ioctl$VIDIOC_SUBDEV_S_FMT(r1, 0xc0585605, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7040000000080b8785d960001810600000000000000000000000000000000000000000000000c00", "2809e8dbe101000000224ad54afac11d875397bdb7819e02177d3d458dd4992861ac00000000ae00ffff00", "9001001c551265406c7f306003d8a0f4bd0000000300", [0x0, 0x10000000]}}) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r2, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) r3 = gettid() ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f0000000540)={"2370491d", 0x0, 0x5, 0x2, 0x8, 0x5, "000064640000001503fe00", '\x00', '\x00', "64bdac32", ["e86621d9cc668c391f77c506", "3549ffffffffffffff010800", "2fc7977386afe0374831c1f9", "cf6cce2296b3f853e224c4e0"]}) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r2, 0xc0045009, &(0x7f0000000040)=0x2dff) socket(0xa, 0x3, 0x3a) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000000300)=""/102400, 0x19000) 7.37575666s ago: executing program 3 (id=97): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f00000004c0)="d328", 0xfffffefd}], 0x1) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x5) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, 0x0, 0x40) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4342, 0x0) dup(r1) 7.360125253s ago: executing program 0 (id=98): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_usb_ep_write(r0, 0x81, 0x4, &(0x7f0000000080)="00012c61") r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000300)={0x40, 0x31, 0x4, "22dc7c42"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$char_usb(r1, 0x0, 0x5c) 6.796473784s ago: executing program 2 (id=99): r0 = syz_usb_connect(0x5, 0x35, &(0x7f0000000500)=ANY=[@ANYBLOB="120100004aaf36207205a5580a2701020301090223000100"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000001dc0)={0x1c, &(0x7f0000001840)=ANY=[@ANYBLOB="200f5b000000c12b"], 0x0, 0x0}) 6.002949927s ago: executing program 1 (id=100): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002640)=[{{&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0}}], 0x1, 0x4008804) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) 5.620519184s ago: executing program 4 (id=101): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d01"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000640)={0x34, &(0x7f0000000400)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 5.401242945s ago: executing program 3 (id=102): socket$inet6(0xa, 0x5, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2400c110, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @loopback}, 0x1c) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10}) io_uring_enter(0xffffffffffffffff, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x2, 0x5001) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, 0x0, 0x0) add_key$keyring(&(0x7f0000000100), &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, &(0x7f00000002c0)="0000000000000002ff690000000000010000001800000002000200861f", 0x1d, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000280)={'vcan0\x00'}) sendmsg$can_j1939(r3, &(0x7f0000000180)={0x0, 0x61, &(0x7f00000005c0)={&(0x7f0000000300)='.', 0x1a000}}, 0x0) 4.503010541s ago: executing program 3 (id=103): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000002080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) 4.122900885s ago: executing program 1 (id=104): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1e2) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='hugetlbfs\x00', 0x16, 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x1084020, &(0x7f0000000340)=ANY=[@ANYBLOB]) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) ptrace$ARCH_SET_CPUID(0x1e, r0, 0x0, 0x1012) semctl$SEM_STAT(0x0, 0x4, 0x12, &(0x7f00000000c0)=""/99) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r3, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.628560399s ago: executing program 3 (id=105): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="12010000e3ddef20501da1604fa10102030109021200"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000780)={0x1c, &(0x7f0000000000)=ANY=[], 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, &(0x7f0000000580)={0x14, 0x0, 0x0}, &(0x7f0000000800)={0x34, &(0x7f0000000840)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000240)={0x1c, &(0x7f0000000140)=ANY=[], 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000480)={0x44, &(0x7f0000000280), 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x82, 0x1, 'I'}, 0x0, 0x0, 0x0}) 273.098116ms ago: executing program 4 (id=106): socket$inet6(0xa, 0x5, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2400c110, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @loopback}, 0x1c) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10}) io_uring_enter(0xffffffffffffffff, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x2, 0x5001) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, 0x0, 0x0) add_key$keyring(&(0x7f0000000100), &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, &(0x7f00000002c0)="0000000000000002ff690000000000010000001800000002000200861f", 0x1d, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r4, 0x0, {0x0, 0xff, 0x1}, 0x2}, 0x18) sendmsg$can_j1939(r3, &(0x7f0000000180)={0x0, 0x61, &(0x7f00000005c0)={&(0x7f0000000300)='.', 0x1a000}}, 0x0) 265.642095ms ago: executing program 0 (id=107): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_pts(0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000940)=@base={0x7, 0x4, 0x100, 0x1, 0x28, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, &(0x7f00000001c0)=""/257, 0x0, 0x101, 0x6}, 0x28) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102384, 0x18ff0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) 239.391945ms ago: executing program 2 (id=108): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x404c2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r4, 0x0, 0x0}, 0x10) setsockopt$packet_drop_memb(r3, 0x107, 0x2, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) umount2(&(0x7f0000000380)='./file1/file0\x00', 0x0) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) socket(0x1e, 0x4, 0x0) 0s ago: executing program 2 (id=109): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000040154220a9055015bbe4010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000e40)={0x84, &(0x7f00000009c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000580)={0x34, &(0x7f0000000180)={0x0, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002840)={0x84, &(0x7f00000023c0)={0x20, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000240)={0x40, 0x17, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000009c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)={0x20, 0x84, 0x2, "e6df"}, 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.175' (ED25519) to the list of known hosts. [ 89.465175][ T5585] cgroup: Unknown subsys name 'net' [ 89.727501][ T5585] cgroup: Unknown subsys name 'cpuset' [ 89.790684][ T5585] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 91.847484][ T5585] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 92.044475][ T31] cfg80211: failed to load regulatory.db [ 95.950989][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 95.983495][ T5609] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 95.994476][ T59] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 95.996366][ T59] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 95.998437][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 96.007616][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 96.025793][ T59] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 96.047209][ T59] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 96.066130][ T4913] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 96.073821][ T4913] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 96.155183][ T5609] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 96.202756][ T5609] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 96.212364][ T5607] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 96.247051][ T5601] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 96.273216][ T59] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 96.293125][ T59] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 96.341733][ T5601] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 96.362058][ T5601] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 96.366136][ T5601] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 96.369889][ T5601] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 96.390871][ T5601] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 96.402006][ T59] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 96.404551][ T5609] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 96.419268][ T5609] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 96.424256][ T5609] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 98.271723][ T5607] Bluetooth: hci0: command tx timeout [ 98.272013][ T5609] Bluetooth: hci1: command tx timeout [ 98.350017][ T5609] Bluetooth: hci2: command tx timeout [ 98.510080][ T5607] Bluetooth: hci4: command tx timeout [ 98.510336][ T5609] Bluetooth: hci3: command tx timeout [ 99.315141][ T5598] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.315951][ T5598] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.316730][ T5598] bridge_slave_0: entered allmulticast mode [ 99.318868][ T5598] bridge_slave_0: entered promiscuous mode [ 99.364171][ T5602] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.364269][ T5602] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.364397][ T5602] bridge_slave_0: entered allmulticast mode [ 99.366272][ T5602] bridge_slave_0: entered promiscuous mode [ 99.428176][ T5598] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.428272][ T5598] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.428431][ T5598] bridge_slave_1: entered allmulticast mode [ 99.432824][ T5598] bridge_slave_1: entered promiscuous mode [ 99.474224][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.474351][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.475211][ T5602] bridge_slave_1: entered allmulticast mode [ 99.477199][ T5602] bridge_slave_1: entered promiscuous mode [ 99.478241][ T5603] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.478364][ T5603] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.478488][ T5603] bridge_slave_0: entered allmulticast mode [ 99.486827][ T5603] bridge_slave_0: entered promiscuous mode [ 99.540666][ T5604] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.540797][ T5604] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.541008][ T5604] bridge_slave_0: entered allmulticast mode [ 99.545211][ T5604] bridge_slave_0: entered promiscuous mode [ 99.591430][ T5599] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.591558][ T5599] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.591700][ T5599] bridge_slave_0: entered allmulticast mode [ 99.593639][ T5599] bridge_slave_0: entered promiscuous mode [ 99.632554][ T5603] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.632640][ T5603] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.632766][ T5603] bridge_slave_1: entered allmulticast mode [ 99.634605][ T5603] bridge_slave_1: entered promiscuous mode [ 99.636142][ T5604] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.636306][ T5604] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.636429][ T5604] bridge_slave_1: entered allmulticast mode [ 99.638320][ T5604] bridge_slave_1: entered promiscuous mode [ 99.702807][ T5599] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.702958][ T5599] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.703132][ T5599] bridge_slave_1: entered allmulticast mode [ 99.705326][ T5599] bridge_slave_1: entered promiscuous mode [ 99.780879][ T5598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.806750][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.849411][ T5598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.877679][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.883224][ T5603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.904050][ T5604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.929269][ T5599] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.955190][ T5603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.957706][ T5604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.000215][ T5599] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.058032][ T5598] team0: Port device team_slave_0 added [ 100.081725][ T5602] team0: Port device team_slave_0 added [ 100.120977][ T5598] team0: Port device team_slave_1 added [ 100.150564][ T5602] team0: Port device team_slave_1 added [ 100.152870][ T5603] team0: Port device team_slave_0 added [ 100.155166][ T5604] team0: Port device team_slave_0 added [ 100.191502][ T5599] team0: Port device team_slave_0 added [ 100.217593][ T5603] team0: Port device team_slave_1 added [ 100.219670][ T5604] team0: Port device team_slave_1 added [ 100.248623][ T5599] team0: Port device team_slave_1 added [ 100.303757][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.303770][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.303789][ T5598] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.350509][ T5607] Bluetooth: hci0: command tx timeout [ 100.350787][ T5609] Bluetooth: hci1: command tx timeout [ 100.363569][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.363612][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.363699][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.430037][ T5609] Bluetooth: hci2: command tx timeout [ 100.431525][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.431541][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.431570][ T5598] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.482709][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.482773][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.482851][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.511869][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.511929][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.512006][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.518874][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.518926][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.519001][ T5604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.590775][ T5607] Bluetooth: hci4: command tx timeout [ 100.591590][ T5609] Bluetooth: hci3: command tx timeout [ 100.633227][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.633240][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.633260][ T5599] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.689823][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.689836][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.689855][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.702918][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.702970][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.703047][ T5604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.735563][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.735615][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.735691][ T5599] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.374476][ T5598] hsr_slave_0: entered promiscuous mode [ 101.375793][ T5598] hsr_slave_1: entered promiscuous mode [ 101.408294][ T5602] hsr_slave_0: entered promiscuous mode [ 101.409258][ T5602] hsr_slave_1: entered promiscuous mode [ 101.416570][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 101.416927][ T5602] Cannot create hsr debugfs directory [ 101.487965][ T5604] hsr_slave_0: entered promiscuous mode [ 101.489162][ T5604] hsr_slave_1: entered promiscuous mode [ 101.489833][ T5604] debugfs: 'hsr0' already exists in 'hsr' [ 101.489851][ T5604] Cannot create hsr debugfs directory [ 101.517558][ T5603] hsr_slave_0: entered promiscuous mode [ 101.518583][ T5603] hsr_slave_1: entered promiscuous mode [ 101.519253][ T5603] debugfs: 'hsr0' already exists in 'hsr' [ 101.519271][ T5603] Cannot create hsr debugfs directory [ 101.545343][ T5599] hsr_slave_0: entered promiscuous mode [ 101.546553][ T5599] hsr_slave_1: entered promiscuous mode [ 101.547313][ T5599] debugfs: 'hsr0' already exists in 'hsr' [ 101.547331][ T5599] Cannot create hsr debugfs directory [ 102.430278][ T5607] Bluetooth: hci0: command tx timeout [ 102.430447][ T5609] Bluetooth: hci1: command tx timeout [ 102.510557][ T5609] Bluetooth: hci2: command tx timeout [ 102.670203][ T5607] Bluetooth: hci4: command tx timeout [ 102.670356][ T5609] Bluetooth: hci3: command tx timeout [ 102.699766][ T5598] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 102.757008][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.777412][ T5598] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 102.805251][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.820685][ T5598] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 102.857672][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.889481][ T5598] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 102.918047][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.036129][ T5604] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 103.069296][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.082290][ T5604] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 103.123836][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.126003][ T5604] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 103.178758][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.211148][ T5604] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 103.254990][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.417118][ T5603] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 103.448985][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.468859][ T5603] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 103.495626][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.499593][ T5603] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 103.546382][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.585184][ T5603] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 103.617757][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.806460][ T5599] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 103.833619][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.842242][ T5599] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 103.878459][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.894836][ T5599] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 103.913358][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.944955][ T5599] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 103.985724][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.151817][ T5598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.188446][ T5602] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 104.228902][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.242632][ T5602] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 104.292130][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.316559][ T5602] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 104.354243][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.371680][ T5602] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 104.413468][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.479045][ T5598] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.508934][ T5604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.510369][ T5607] Bluetooth: hci0: command tx timeout [ 104.510416][ T5609] Bluetooth: hci1: command tx timeout [ 104.558674][ T1226] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.558857][ T1226] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.590427][ T5609] Bluetooth: hci2: command tx timeout [ 104.630155][ T1226] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.630264][ T1226] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.708327][ T5604] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.750728][ T5607] Bluetooth: hci4: command tx timeout [ 104.750773][ T5609] Bluetooth: hci3: command tx timeout [ 104.755568][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.784622][ T1158] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.784776][ T1158] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.868583][ T1158] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.868893][ T1158] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.961912][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.018320][ T1390] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.018497][ T1390] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.086583][ T5599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.111365][ T1390] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.112327][ T1390] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.302813][ T5599] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.418698][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.433463][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.461775][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.505886][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.506093][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.712435][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.785939][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.786075][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.897470][ T1226] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.897678][ T1226] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.578441][ T5598] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.738872][ T5604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.077107][ T5598] veth0_vlan: entered promiscuous mode [ 107.116979][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.216770][ T5598] veth1_vlan: entered promiscuous mode [ 107.295560][ T5604] veth0_vlan: entered promiscuous mode [ 107.394790][ T5604] veth1_vlan: entered promiscuous mode [ 107.434841][ T5599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.491505][ T5598] veth0_macvtap: entered promiscuous mode [ 107.545051][ T5598] veth1_macvtap: entered promiscuous mode [ 107.581689][ T5603] veth0_vlan: entered promiscuous mode [ 107.605325][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.659479][ T5604] veth0_macvtap: entered promiscuous mode [ 107.690675][ T5603] veth1_vlan: entered promiscuous mode [ 107.699621][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.758539][ T5604] veth1_macvtap: entered promiscuous mode [ 107.804196][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.908774][ T1129] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.941654][ T1129] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.944608][ T5599] veth0_vlan: entered promiscuous mode [ 107.945262][ T1129] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.977612][ T1129] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.996311][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.077947][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.170974][ T5599] veth1_vlan: entered promiscuous mode [ 108.205887][ T5603] veth0_macvtap: entered promiscuous mode [ 108.214139][ T66] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.278757][ T66] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.336494][ T66] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.375466][ T66] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.399669][ T5603] veth1_macvtap: entered promiscuous mode [ 108.770939][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.770971][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.776926][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.024975][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.077892][ T5599] veth0_macvtap: entered promiscuous mode [ 109.155537][ T5599] veth1_macvtap: entered promiscuous mode [ 109.167281][ T66] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.167302][ T66] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.214740][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.214960][ T5602] veth0_vlan: entered promiscuous mode [ 109.235271][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.260344][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.286286][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.324868][ T1226] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.324889][ T1226] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.495670][ T5602] veth1_vlan: entered promiscuous mode [ 109.520258][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.723836][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.806173][ T3373] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.806193][ T3373] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.916194][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.949051][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.106793][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.220660][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.260882][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.260907][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.628800][ T5602] veth0_macvtap: entered promiscuous mode [ 111.673765][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.673789][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.782786][ T5602] veth1_macvtap: entered promiscuous mode [ 111.911986][ T5804] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 112.410764][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.438172][ T3373] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.438194][ T3373] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.500721][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.639294][ T1129] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.654553][ T1129] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.656195][ T1129] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.656622][ T1129] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.676855][ T66] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.676925][ T66] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.984513][ T5814] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10'. [ 113.713641][ T5819] kAFS: unable to lookup cell '' [ 113.768077][ T1284] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.768100][ T1284] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.203961][ T821] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 115.269847][ T3373] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.272935][ T3373] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.396574][ T821] usb 1-1: Using ep0 maxpacket: 32 [ 115.559655][ T821] usb 1-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 115.559740][ T821] usb 1-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 115.559770][ T821] usb 1-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 115.559799][ T821] usb 1-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 115.641838][ T821] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 115.641868][ T821] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.641887][ T821] usb 1-1: Product: syz [ 115.641901][ T821] usb 1-1: Manufacturer: syz [ 115.641916][ T821] usb 1-1: SerialNumber: syz [ 117.437574][ C1] imon 1-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 117.810595][ T821] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/input/input5 [ 118.435598][ T821] imon:send_packet: packet tx failed (-71) [ 118.465205][ T821] imon 1-1:155.0: panel buttons/knobs setup failed [ 118.465228][ T821] imon 1-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 118.465242][ T821] (id 0x00) [ 120.530717][ T821] rc_core: IR keymap rc-imon-pad not found [ 120.530741][ T821] Registered IR keymap rc-empty [ 120.611797][ T821] imon 1-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 120.611824][ T821] imon 1-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 120.615815][ T821] imon:send_packet: packet tx failed (-71) [ 120.642335][ T821] imon 1-1:155.0: remote input dev register failed [ 120.642519][ T821] imon 1-1:155.0: imon_init_intf0: rc device setup failed [ 120.925303][ T5865] Zero length message leads to an empty skb [ 123.130848][ T5888] capability: warning: `syz.0.26' uses deprecated v2 capabilities in a way that may be insecure [ 123.319018][ T821] imon 1-1:155.0: unable to initialize intf0, err 0 [ 123.319042][ T821] imon:imon_probe: failed to initialize context! [ 123.319055][ T821] imon 1-1:155.0: unable to register, err -19 [ 124.526444][ T821] usb 1-1: USB disconnect, device number 2 [ 125.304017][ T5888] program syz.0.26 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 125.754615][ T37] audit: type=1326 audit(1783940889.889:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5900 comm="syz.3.32" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6491b6de59 code=0x7ffc0000 [ 125.754685][ T37] audit: type=1326 audit(1783940889.899:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5900 comm="syz.3.32" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6491b6de59 code=0x7ffc0000 [ 125.874332][ T37] audit: type=1326 audit(1783940890.019:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5900 comm="syz.3.32" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6491b6de59 code=0x7ffc0000 [ 125.874392][ T37] audit: type=1326 audit(1783940890.019:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5900 comm="syz.3.32" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6491b6de59 code=0x7ffc0000 [ 125.874438][ T37] audit: type=1326 audit(1783940890.019:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5900 comm="syz.3.32" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f6491b6de59 code=0x7ffc0000 [ 125.874483][ T37] audit: type=1326 audit(1783940890.019:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5900 comm="syz.3.32" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6491b6de59 code=0x7ffc0000 [ 125.879034][ T37] audit: type=1326 audit(1783940890.019:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5900 comm="syz.3.32" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f6491b6de59 code=0x7ffc0000 [ 125.879092][ T37] audit: type=1326 audit(1783940890.019:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5900 comm="syz.3.32" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6491b6de59 code=0x7ffc0000 [ 125.879137][ T37] audit: type=1326 audit(1783940890.019:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5900 comm="syz.3.32" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6491b6de59 code=0x7ffc0000 [ 125.879182][ T37] audit: type=1326 audit(1783940890.019:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5900 comm="syz.3.32" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6491b6de59 code=0x7ffc0000 [ 125.909994][ T5783] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 126.150074][ T5783] usb 3-1: device descriptor read/64, error -71 [ 126.449131][ T5783] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 126.609997][ T5783] usb 3-1: device descriptor read/64, error -71 [ 126.720475][ T5783] usb usb3-port1: attempt power cycle [ 127.170137][ T5783] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 127.190827][ T5783] usb 3-1: device descriptor read/8, error -71 [ 127.641848][ T5783] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 127.969558][ T5783] usb 3-1: device descriptor read/8, error -71 [ 128.506954][ T5783] usb usb3-port1: unable to enumerate USB device [ 128.822344][ T10] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 129.002923][ T10] usb 2-1: not running at top speed; connect to a high speed hub [ 129.026090][ T10] usb 2-1: New USB device found, idVendor=086a, idProduct=0001, bcdDevice= 0.40 [ 129.026123][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.026146][ T10] usb 2-1: Product: 䃤ꧽ輥遨՛兊ﱂ䒟㴃ⵢ׀塗럭闙땙벨晦꧀폿蠡卐ኜῐ帮柪貂瘴壺皕ᣃ൛䬀핅㶮ᒋ깃腇䶅캨砅鸟詽啅蝖﬚竻挊䷬ൻ鷽嘕ᖩ싓摚淨넜엶ᙹ芴쪴뮢৖࢔鬧؛埵샃̪ꛛ硴麶苚쏦汷ᵊ躙៾쾯裉逐ﻼ剂 [ 129.026179][ T10] usb 2-1: Manufacturer: Ы [ 129.026195][ T10] usb 2-1: SerialNumber: 瑃娅﯏╀⒇헙睝䆮Đꭼ⿼ࣉ폆ᛩ洪錫䅹⠭妇蒾ߣ㠜⼡渇ǻ귟្䥾ݷ笚猫ቚꐾ퉞ẩᰂ祥朻祭攔뼚➮批 [ 130.458167][ T5938] Bluetooth: MGMT ver 1.23 [ 131.439616][ T10] usb 2-1: USB disconnect, device number 2 [ 131.519439][ T5613] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 131.591600][ T5726] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 131.670144][ T5613] usb 3-1: Using ep0 maxpacket: 16 [ 131.791633][ T5726] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 131.791666][ T5726] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.791686][ T5726] usb 1-1: Product: syz [ 131.791701][ T5726] usb 1-1: Manufacturer: syz [ 131.791715][ T5726] usb 1-1: SerialNumber: syz [ 131.797835][ T5613] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0xD has invalid maxpacket 49212, setting to 1024 [ 131.797863][ T5613] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 1024 [ 131.797882][ T5613] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 131.799653][ T5613] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0xF has invalid maxpacket 1023 [ 131.847589][ T5613] usb 3-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 131.847655][ T5613] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.847720][ T5613] usb 3-1: Product: syz [ 131.847762][ T5613] usb 3-1: Manufacturer: syz [ 131.847804][ T5613] usb 3-1: SerialNumber: syz [ 132.084299][ T5726] usb 1-1: config 0 descriptor?? [ 132.487267][ T5938] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 132.487515][ T5938] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 132.557710][ T5726] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 133.040347][ T1337] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.049626][ T1337] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.973408][ T5726] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 134.072111][ T5726] usb 1-1: USB disconnect, device number 3 [ 134.092525][ T5613] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 134.124936][ T5613] usb 3-1: MIDIStreaming interface descriptor not found [ 135.221700][ T198] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 135.425520][ T198] usb 1-1: Using ep0 maxpacket: 32 [ 135.450136][ T198] usb 1-1: no configurations [ 135.450174][ T198] usb 1-1: can't read configurations, error -22 [ 135.593107][ T198] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 135.658295][ T5969] netlink: 'syz.3.52': attribute type 3 has an invalid length. [ 135.658843][ T5969] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 135.686896][ T5969] netlink: 'syz.3.52': attribute type 4 has an invalid length. [ 135.740072][ T198] usb 1-1: Using ep0 maxpacket: 32 [ 135.740738][ T198] usb 1-1: no configurations [ 135.740749][ T198] usb 1-1: can't read configurations, error -22 [ 135.771409][ T198] usb usb1-port1: attempt power cycle [ 136.170481][ T198] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 136.216513][ T198] usb 1-1: Using ep0 maxpacket: 32 [ 136.218647][ T198] usb 1-1: no configurations [ 136.218671][ T198] usb 1-1: can't read configurations, error -22 [ 136.352981][ T198] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 136.371434][ T198] usb 1-1: Using ep0 maxpacket: 32 [ 136.373208][ T198] usb 1-1: no configurations [ 136.373227][ T198] usb 1-1: can't read configurations, error -22 [ 136.374129][ T198] usb usb1-port1: unable to enumerate USB device [ 136.642755][ T5613] usb 3-1: USB disconnect, device number 6 [ 141.282948][ T6018] 9p: Bad value for 'wfdno' [ 142.263763][ T198] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 142.444450][ T198] usb 2-1: Using ep0 maxpacket: 32 [ 142.445268][ T198] usb 2-1: no configurations [ 142.445285][ T198] usb 2-1: can't read configurations, error -22 [ 142.573166][ T198] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 142.730346][ T198] usb 2-1: Using ep0 maxpacket: 32 [ 142.731771][ T198] usb 2-1: no configurations [ 142.731789][ T198] usb 2-1: can't read configurations, error -22 [ 142.732202][ T198] usb usb2-port1: attempt power cycle [ 142.948197][ T5733] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 143.090074][ T5733] usb 4-1: Using ep0 maxpacket: 32 [ 143.099398][ T5733] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 143.099431][ T5733] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.099452][ T5733] usb 4-1: Product: syz [ 143.099468][ T5733] usb 4-1: Manufacturer: syz [ 143.099483][ T5733] usb 4-1: SerialNumber: syz [ 143.130134][ T198] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 144.944781][ T5948] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 145.177904][ T5733] usb 4-1: config 0 descriptor?? [ 145.226237][ T198] usb 2-1: device descriptor read/8, error -71 [ 145.332928][ T5733] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 146.631277][ T5733] gspca_ov534_9: reg_w failed -110 [ 146.832000][ T5948] usb 5-1: device descriptor read/all, error -71 [ 147.030036][ T5733] gspca_ov534_9: Unknown sensor 0000 [ 147.030144][ T5733] ov534_9 4-1:0.0: probe with driver ov534_9 failed with error -22 [ 147.222001][ T5733] usb 4-1: USB disconnect, device number 2 [ 147.591333][ T5945] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 147.730088][ T5945] usb 3-1: device descriptor read/64, error -71 [ 148.020182][ T5945] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 150.198859][ T5945] usb 3-1: device descriptor read/64, error -71 [ 150.314300][ T5945] usb usb3-port1: attempt power cycle [ 150.550040][ T5733] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 152.582624][ T5733] usb 4-1: Using ep0 maxpacket: 32 [ 152.607463][ T5733] usb 4-1: no configurations [ 152.607485][ T5733] usb 4-1: can't read configurations, error -22 [ 152.640027][ T5945] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 152.666584][ T5945] usb 3-1: Using ep0 maxpacket: 32 [ 152.718893][ T5945] usb 3-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 152.718925][ T5945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.718946][ T5945] usb 3-1: Product: syz [ 152.718961][ T5945] usb 3-1: Manufacturer: syz [ 152.718976][ T5945] usb 3-1: SerialNumber: syz [ 152.740035][ T5733] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 152.797075][ T5945] usb 3-1: config 0 descriptor?? [ 152.843266][ T5945] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 152.910902][ T5733] usb 4-1: Using ep0 maxpacket: 32 [ 152.912248][ T5733] usb 4-1: no configurations [ 152.912267][ T5733] usb 4-1: can't read configurations, error -22 [ 152.912807][ T5733] usb usb4-port1: attempt power cycle [ 155.617460][ T5945] gspca_ov534_9: reg_r err -71 [ 155.760059][ T5733] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 155.870110][ T5945] gspca_ov534_9: Unknown sensor 0000 [ 155.870215][ T5945] ov534_9 3-1:0.0: probe with driver ov534_9 failed with error -22 [ 155.896578][ T5945] usb 3-1: USB disconnect, device number 9 [ 155.922412][ T5733] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 155.922444][ T5733] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 155.922464][ T5733] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 155.922517][ T5733] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 155.922545][ T5733] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 155.928680][ T5733] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 155.928791][ T5733] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 155.928811][ T5733] usb 1-1: Product: syz [ 155.928827][ T5733] usb 1-1: Manufacturer: syz [ 156.094211][ T5733] cdc_wdm 1-1:1.0: skipping garbage [ 156.094227][ T5733] cdc_wdm 1-1:1.0: skipping garbage [ 156.167586][ T5733] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 156.167626][ T5733] cdc_wdm 1-1:1.0: Unknown control protocol [ 156.460115][ T5945] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 156.548207][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 4 bytes [ 156.609984][ T5945] usb 3-1: Using ep0 maxpacket: 32 [ 156.638739][ T5945] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 156.638766][ T5945] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 156.731785][ T5945] usb 3-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 156.731818][ T5945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.731841][ T5945] usb 3-1: Product: syz [ 156.731857][ T5945] usb 3-1: Manufacturer: syz [ 156.731873][ T5945] usb 3-1: SerialNumber: syz [ 156.779504][ T5945] usb 3-1: config 0 descriptor?? [ 157.012268][ T5945] usb 3-1: USB disconnect, device number 10 [ 157.274408][ T5733] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 157.954749][ T5733] usb 5-1: Using ep0 maxpacket: 16 [ 157.968439][ T5733] usb 5-1: no configurations [ 157.968459][ T5733] usb 5-1: can't read configurations, error -22 [ 158.090030][ T5733] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 158.140016][ T5945] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 158.300125][ T5945] usb 3-1: Using ep0 maxpacket: 32 [ 158.300257][ T5733] usb 5-1: Using ep0 maxpacket: 16 [ 158.301434][ T5733] usb 5-1: no configurations [ 158.301452][ T5733] usb 5-1: can't read configurations, error -22 [ 158.302419][ T5733] usb usb5-port1: attempt power cycle [ 158.344632][ T5945] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 158.344661][ T5945] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 159.007213][ T5945] usb 3-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 159.007248][ T5945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.007270][ T5945] usb 3-1: Product: syz [ 159.007286][ T5945] usb 3-1: Manufacturer: syz [ 159.007301][ T5945] usb 3-1: SerialNumber: syz [ 161.955317][ T5733] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 161.970253][ C0] raw-gadget.2 gadget.4: ignoring, device is not running [ 161.970391][ T5733] usb 5-1: device descriptor read/8, error -32 [ 162.041900][ T5945] usb 3-1: config 0 descriptor?? [ 162.045767][ T5945] usb 3-1: can't set config #0, error -71 [ 162.082621][ T5927] usb 1-1: USB disconnect, device number 8 [ 162.144849][ T5945] usb 3-1: USB disconnect, device number 11 [ 162.538322][ T5948] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 162.538341][ T5948] #PF: supervisor read access in kernel mode [ 162.538350][ T5948] #PF: error_code(0x0000) - not-present page [ 162.538360][ T5948] PGD 0 P4D 0 [ 162.538381][ T5948] Oops: Oops: 0000 [#1] SMP KASAN PTI [ 162.538411][ T5948] CPU: 0 UID: 0 PID: 5948 Comm: kworker/0:9 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 162.538431][ T5948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 162.538442][ T5948] Workqueue: usb_hub_wq hub_event [ 162.538486][ T5948] RIP: 0010:kcov_remote_start+0x287/0x6f0 [ 162.538515][ T5948] Code: b3 8d 4c 8b b8 b8 02 9e 92 bd 00 00 04 00 eb 4f 41 8b ae a4 00 00 00 49 c7 c7 00 0f 22 8e 4d 8b 3f 49 81 ff 00 0f 22 8e 74 4c <41> 39 6f 10 75 ee 4c 89 ff e8 5b f9 07 03 84 c0 74 0e 49 8b 07 49 [ 162.538530][ T5948] RSP: 0018:ffffc9000600f7e8 EFLAGS: 00010207 [ 162.538544][ T5948] RAX: 0000000000000000 RBX: ffff888031e28000 RCX: 0000000000000000 [ 162.538556][ T5948] RDX: 000000002ecd5c34 RSI: 0000000000000001 RDI: ffffffff8bca6220 [ 162.538567][ T5948] RBP: 0000000000100000 R08: ffffffff8b4459a0 R09: 0000000000000000 [ 162.538577][ T5948] R10: 0000000000000000 R11: ffffffff8e1c3000 R12: 0000000000000002 [ 162.538588][ T5948] R13: 0000000000000001 R14: ffff888031e54b00 R15: 0000000000000000 [ 162.538599][ T5948] FS: 0000000000000000(0000) GS:ffff888125c49000(0000) knlGS:0000000000000000 [ 162.538613][ T5948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 162.538624][ T5948] CR2: 0000000000000010 CR3: 000000000dfb0000 CR4: 00000000003526f0 [ 162.538642][ T5948] Call Trace: [ 162.538649][ T5948] [ 162.538658][ T5948] hub_event+0x15d/0x4cf0 [ 162.538688][ T5948] ? rt_spin_unlock+0x163/0x200 [ 162.538712][ T5948] ? __lock_acquire+0x683/0x2ce0 [ 162.538729][ T5948] ? register_lock_class+0x31/0x2e0 [ 162.538746][ T5948] ? __lock_acquire+0x683/0x2ce0 [ 162.538766][ T5948] ? do_raw_spin_lock+0x12b/0x2f0 [ 162.538790][ T5948] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 162.538817][ T5948] ? __pfx_hub_event+0x10/0x10 [ 162.538844][ T5948] ? process_scheduled_works+0xa20/0x14e0 [ 162.538866][ T5948] ? rcu_is_watching+0x15/0xb0 [ 162.538892][ T5948] ? process_scheduled_works+0xa20/0x14e0 [ 162.538914][ T5948] process_scheduled_works+0xa8e/0x14e0 [ 162.538950][ T5948] ? __pfx_process_scheduled_works+0x10/0x10 [ 162.538975][ T5948] ? assign_work+0x3cf/0x5d0 [ 162.538998][ T5948] worker_thread+0xa47/0xfb0 [ 162.539029][ T5948] ? __kthread_parkme+0x71/0x1f0 [ 162.539060][ T5948] kthread+0x388/0x470 [ 162.539090][ T5948] ? __pfx_worker_thread+0x10/0x10 [ 162.539114][ T5948] ? __pfx_kthread+0x10/0x10 [ 162.539156][ T5948] ret_from_fork+0x514/0xb70 [ 162.539191][ T5948] ? __pfx_ret_from_fork+0x10/0x10 [ 162.539223][ T5948] ? __switch_to+0xc89/0x1420 [ 162.539250][ T5948] ? __pfx_kthread+0x10/0x10 [ 162.539280][ T5948] ret_from_fork_asm+0x1a/0x30 [ 162.539309][ T5948] [ 162.539317][ T5948] Modules linked in: [ 162.539348][ T5948] CR2: 0000000000000010 [ 162.539363][ T5948] ---[ end trace 0000000000000000 ]--- [ 162.539381][ T5948] RIP: 0010:kcov_remote_start+0x287/0x6f0 [ 162.539416][ T5948] Code: b3 8d 4c 8b b8 b8 02 9e 92 bd 00 00 04 00 eb 4f 41 8b ae a4 00 00 00 49 c7 c7 00 0f 22 8e 4d 8b 3f 49 81 ff 00 0f 22 8e 74 4c <41> 39 6f 10 75 ee 4c 89 ff e8 5b f9 07 03 84 c0 74 0e 49 8b 07 49 [ 162.539438][ T5948] RSP: 0018:ffffc9000600f7e8 EFLAGS: 00010207 [ 162.539457][ T5948] RAX: 0000000000000000 RBX: ffff888031e28000 RCX: 0000000000000000 [ 162.539471][ T5948] RDX: 000000002ecd5c34 RSI: 0000000000000001 RDI: ffffffff8bca6220 [ 162.539486][ T5948] RBP: 0000000000100000 R08: ffffffff8b4459a0 R09: 0000000000000000 [ 162.539500][ T5948] R10: 0000000000000000 R11: ffffffff8e1c3000 R12: 0000000000000002 [ 162.539514][ T5948] R13: 0000000000000001 R14: ffff888031e54b00 R15: 0000000000000000 [ 162.539527][ T5948] FS: 0000000000000000(0000) GS:ffff888125c49000(0000) knlGS:0000000000000000 [ 162.539544][ T5948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 162.539559][ T5948] CR2: 0000000000000010 CR3: 000000000dfb0000 CR4: 00000000003526f0 [ 162.539579][ T5948] Kernel panic - not syncing: Fatal exception [ 162.540194][ T5948] Kernel Offset: disabled