last executing test programs: 8.038217994s ago: executing program 0 (id=5): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_usbip_server_init(0x1) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e2793b10d10501200004010203010902120008000000000904"], 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) write$usbip_server(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000300000001"], 0x35) r2 = fcntl$dupfd(r1, 0x0, r0) sendmsg$alg(r2, &(0x7f0000004840)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="4cd24f533034819af5c28d38c9c8371edc0b3ca18bb0e4e445f5f55a539656eebc551804e8f27df404feb2fc27743b5d185df9242a94a16fc0883e337b031b15db4cf05ec27ea827288fc108c1ed5be414811d479d73bff6c26293372d75e0db961527075dc2ed11d03f2696c6f84fd08f78b466ac64b14e136d96e7dbd3524dcd61416ac7caa59ea39021a650b0121959407030b3e8e7edf2b70a04e5", 0x9d}], 0x1, &(0x7f0000003540), 0x0, 0x20000000}, 0x0) 5.621750404s ago: executing program 0 (id=8): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000140)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f00000001c0)={{@host}, @host, 0x0, 0x6, 0x244c, 0xffffffffffffffff, 0x101, 0x0, 0xfffffffc}) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r0, 0x7a4, &(0x7f0000000000)={{@host}, 0x200000000000, 0x0, 0x0, 0xfffffffc}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) close(r0) 4.567390544s ago: executing program 3 (id=4): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x40000021, 0x0, 0xfffffffffffffffd}]}) 4.311268418s ago: executing program 1 (id=2): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x1e8}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0xfe, 0x7fff0006}]}) r5 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa8203, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r5, 0xc0184800, &(0x7f0000000080)={0x20004, r4, 0x2}) syz_ublk_add_dev(0xffffffffffffffff, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x124}}}, &(0x7f0000000280)=0x0) syz_ublk_setup_queues(r6, r7, &(0x7f0000000780)={0x0, 0x280f, 0x1000, 0x2, 0x102, 0x0, r6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe30b, 0x10000, 0x0, 0x2de, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf845, 0x80081, 0x2, 0x3c5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5432, 0x4, 0x4, 0x174}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1be3, 0x4, 0x3, 0x12f, 0x0, r6}}], 0x4, 0x0, 0x0) 4.214966489s ago: executing program 2 (id=9): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x400}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}}}, {0x18, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}, 0x1, 0x0, 0x0, 0x2000094}, 0x80) 3.857376515s ago: executing program 0 (id=10): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)={0x20, 0x16, 0x107, 0x70bd2c, 0x25dfdbfe, {0x18, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @fd=r1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x20048891}, 0x8010) 3.788842399s ago: executing program 1 (id=11): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) close(0x3) listen(r1, 0x5b) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2}}, 0x2e) 3.655016865s ago: executing program 0 (id=12): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1fe) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) newfstatat(0xffffffffffffff9c, &(0x7f0000001100)='./file0\x00', &(0x7f0000001140), 0x4000) 3.555879253s ago: executing program 2 (id=13): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0x8000000, 0xf000, 0x0, 0x2, 0x8, 0x0, 0x40, 0x2, 0x0, 0x8, 0x9, 0x10}, {0xffff1000, 0xd000, 0xc, 0x8, 0xfb, 0x9, 0x0, 0x2, 0x1, 0x7, 0x3, 0xff}, {0x6000, 0x3000, 0xc, 0x0, 0x7, 0x9, 0x40, 0x0, 0x3, 0x9, 0x0, 0xfc}, {0xeeef0000, 0xd000, 0xf, 0xff, 0x7c, 0xfe, 0xa, 0x0, 0xfe, 0x3, 0x4}, {0xdddd0000, 0xf000, 0x4, 0x0, 0xff, 0x4, 0x6, 0xb, 0x0, 0x3c}, {0xeeee8000, 0x4000, 0x0, 0x3, 0x5, 0x2, 0x2, 0x1, 0x0, 0x0, 0x80}, {0xdddd1000, 0xdddd1000, 0x0, 0x2, 0xff, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x3000, 0xe, 0x0, 0xc8, 0x1, 0x83, 0xa, 0x26, 0x96}, {0x1, 0x4}, {0x80a0000, 0xff}, 0x0, 0x0, 0xeeee8000, 0x600, 0x1, 0x5800, 0x0, [0x4000000000013, 0x0, 0x1]}) r6 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r5, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r6, 0x20, &(0x7f0000000240)="fb4149dd053be3ac2cc4a22332a77b23b8898600087bb16c94a6ab80313804d92f00000000010000045a96383369d226270080ff000000000000000000a000", 0x0, 0xffa4) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r5, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@arm64={0xa, 0x3, 0x0, '\x00', 0x3}) 3.272431966s ago: executing program 1 (id=14): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$802154_raw(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)="c1e220a11e57b46f82cfa0", 0xb}, 0x1, 0x0, 0x0, 0xc0805}, 0x400e044) recvmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, 0x0}, 0x401}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)=""/131, 0x83}], 0x1}, 0x5}], 0x2, 0x10020, 0x0) 3.155235171s ago: executing program 1 (id=15): r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0xd0, 0x44, 0x1, 0x70bd29, 0x4, {0x2}, [@nested={0x4, 0x48}, @nested={0xb8, 0x1, 0x0, 0x1, [@nested={0xb4, 0x13f, 0x0, 0x1, [@nested={0xb0, 0xf2, 0x0, 0x1, [@generic="6b8aac2e042684080c580d5b74ac728e8d10c528b58e4b609a30f543ef4b2bba6ba1d3644ee5cbdb7072b1a36a6aa464bcf1e84ac8bd874e4679a5221bb63362d04e56f6947968e799894bc460b0620c8c0cca171c9d0265b5fe0c3e23ef8c4e846efe873774dd198492214987dd63d7c4a22b51cdc61e06bd0077aaf54bcae14cace84f647b3888", @typed={0x11, 0x11b, 0x0, 0x0, @binary="0f8a6b8991d6f0d8fb0ba6600c"}, @typed={0x8, 0x1, 0x0, 0x0, @uid=r1}, @typed={0x8, 0x9f, 0x0, 0x0, @pid}]}]}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x200048d5}, 0x4008094) 3.051845392s ago: executing program 3 (id=16): r0 = syz_usb_connect$cdc_ncm(0x0, 0x8f, &(0x7f0000000580)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109027d0002010080000904000001020d0000052406000105240000000d240f0103050000fd0000000406241aff072908241c0101090000142413099f33760bf14377323063f9c8a04d113905241510000905810300020800040904010000020d00000904010102020d0000090582020002e1ad00090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000000)={0xfffffffffffffee0, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x20, 0x80, 0x1c, {0xff, 0x2070, 0x1000, 0x9, 0x4, 0x8000, 0xfffd, 0xec, 0x3906, 0xfffc, 0x3, 0xfb}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000900)={0x14, 0x0, &(0x7f00000008c0)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000e80)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e00)={0x20, 0x87, 0x2, 0xfff}, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) 3.050616332s ago: executing program 0 (id=17): r0 = socket$nl_generic(0x10, 0x3, 0x10) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r2}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r2, 0x0, &(0x7f0000000000/0x800000)=nil, 0x800000, 0x1004000}) accept$alg(0xffffffffffffffff, 0x0, 0x0) dup2(r0, r1) 2.839117896s ago: executing program 1 (id=18): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1}, 0x18) connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r0, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet6(0xa, 0x80002, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) 1.637015691s ago: executing program 2 (id=19): openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x161042, 0x0) r0 = openat$6lowpan_control(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000100), 0x218888, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 980.143432ms ago: executing program 2 (id=20): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f0000002880)=[@transaction={0x400c6314, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 768.304447ms ago: executing program 0 (id=21): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0xa, "0400"}]}}, 0x0}, 0x0) 467.968782ms ago: executing program 2 (id=22): timer_create(0x0, 0x0, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec778000) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f0000000b00)) syz_open_dev$dmmidi(&(0x7f0000000080), 0x200, 0x40002) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r2, 0x8) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 2 (id=23): r0 = syz_usb_connect(0x0, 0x29c, &(0x7f0000000580)=ANY=[@ANYBLOB="12010000841b7420da040d39bb2d0102030109028a020100000000090408f80af179fa020f24020205000d000cf67df8e6988f0724014004000009050c0340000e"], 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(r1, 0xe, &(0x7f0000000100)={0x8, 0x4b55}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x8000000001, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019340)=""/102392, 0x18ff8) r4 = getpid() syz_pidfd_open(r4, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r5 = socket$inet6(0xa, 0x2, 0x3a) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, 0x0) syz_usb_connect$uac1(0x1, 0x0, 0x0, &(0x7f0000000980)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x300, 0xd4, 0x5, 0xbd, 0x20, 0x8e}, 0x5, &(0x7f0000000480)={0x5, 0xf, 0x5}, 0x6, [{0x0, 0x0}, {0x69, &(0x7f0000000600)=@string={0x69, 0x3, "c2f03459a8d5364298fc9bdf8bc1276437bead11538f279ea60b46e81c2c72533fc3ee341377e06050dd6f024c8bc9709d18b0f0678b9cb36fd92e0305123d804656bdeb278ae707ad008a42c0a0a2d4afd3bf6405d50f35bd286f388bcc8a1b1dee0cbb516997"}}, {0xf5, &(0x7f0000000700)=@string={0xf5, 0x3, "d15cbf9d80522e0ed7ea798beb16a4d5529dd3e4fedeccc234517794ed6a3a8125572b9de61da1ec2b85443ab46b280cf99edd7ad68d8bf5247ad05b626d5ac9b835c7a148b363679e3fc47a5d62a717ba75ec5cde13d271994b56eba7ef739d737369b50d7a570bb23a3eb3f6d6ed8eae2d45bc46d7a790ec17b5d7c5dae69ad73640b92cd8926c9f508d6461cbd46b38281305787d188ecec86beb20b60934829fff7aa90fd1440fea5ecff8a087e4b4e47a5d7b44066f3f8f24caacb78dcdd8c88a0625a5fc1b0168b717c52db9e17451557b2908f394b55ff15621a3fe1c8a3a17bcbad6cd5a739493d1f69f13fc9854b5"}}, {0x2, &(0x7f0000000800)=@string={0x2}}, {0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0x447}}, {0x77, &(0x7f00000008c0)=@string={0x77, 0x3, "ef7ad05cff2104e019622de2f6c29b82b68a849d901a904ec4ca0f1e4d982150ed84bc384e5e4a40fa9dd7a9f7cedca8479d36d2c6f4dbff24ee2b99ea7a8a7dfc75b001cf99b50f3f43ac6c8252297371f76178f19c1f79e5bfc750b1ac84c301abfb3bbe2ae3a43e47fa805fcb867fd3909ab3ce"}}]}) setsockopt$inet6_int(r5, 0x29, 0x42, 0x0, 0x0) recvmsg(r5, &(0x7f00000003c0)={&(0x7f0000000140)=@l2tp6={0xa, 0x0, 0x0, @initdev}, 0x80, 0x0}, 0x40002020) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000100)=0xe) write(r6, 0x0, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000140)={0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="4005d7000000d722e9da34ba77cf4f83fd44d0fbe229adf45e33e667a2dde76e1a8dc3a3ee520017a073db75262329cfba93b655cb8b69b55e2fd042427e7511409d06bd0cff08f51c04ae6d13f3c0d45e9d2629d3238d4a04a2667f208e557d917ff6356471ff72c8ddd5d02b39b08f881dfc95b2b71ce4e727d0677dfe69e8ccb17e25ea97775297d984dc1fcb1271cb6b036039b836fe70590d6499cdb6742b65536239bf349c34da853e563d2d1a072d4238f1272d665076fe3cde30aa2338b7be14afc4875a9f44194a182f45d0e46c150eccc3be000000000000"], &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3009}}}, &(0x7f00000003c0)={0x44, &(0x7f0000000180)={0x0, 0x16, 0x3b, "76e3ad1011ff8d30bd6957271313c1abb296f1f4fb9414e118c54ec1d17f47283eecbf703bf8c4a81dda0b971d6f4f84cce7c910223766208e2d51"}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000240)={0x0, 0x8, 0x1}, &(0x7f0000000280)={0x20, 0x81, 0x1, "f0"}, &(0x7f00000002c0)={0x20, 0x82, 0x3, "009275"}, &(0x7f0000000300)={0x20, 0x83, 0x1, "10"}, &(0x7f0000000340)={0x20, 0x84, 0x3, "2e966a"}, &(0x7f0000000380)={0x20, 0x85, 0x3, "8409a4"}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.39' (ED25519) to the list of known hosts. [ 75.299842][ T5595] cgroup: Unknown subsys name 'net' [ 75.531190][ T5595] cgroup: Unknown subsys name 'cpuset' [ 75.597169][ T5595] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 77.237865][ T5595] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 79.479482][ T5607] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.482803][ T5607] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.483659][ T5607] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 79.485055][ T5607] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 79.489993][ T5607] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 79.601898][ T60] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.615791][ T60] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 79.633288][ T5619] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.640231][ T60] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.659567][ T5622] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 79.660154][ T5622] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.660542][ T5622] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 79.692141][ T5620] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 79.696302][ T5620] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 79.701360][ T5620] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 79.715133][ T5620] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 79.732986][ T5620] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 79.773434][ T4922] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 79.777749][ T4922] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 79.781061][ T4922] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 81.422291][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.423319][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.423480][ T5606] bridge_slave_0: entered allmulticast mode [ 81.425731][ T5606] bridge_slave_0: entered promiscuous mode [ 81.473218][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.473410][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.473558][ T5606] bridge_slave_1: entered allmulticast mode [ 81.475280][ T5606] bridge_slave_1: entered promiscuous mode [ 81.508880][ T5614] Bluetooth: hci0: command tx timeout [ 81.697388][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.746727][ T5614] Bluetooth: hci1: command tx timeout [ 81.772776][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.780912][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.781491][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.781711][ T5610] bridge_slave_0: entered allmulticast mode [ 81.785362][ T5610] bridge_slave_0: entered promiscuous mode [ 81.827660][ T5614] Bluetooth: hci2: command tx timeout [ 81.828059][ T4922] Bluetooth: hci3: command tx timeout [ 81.842608][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.842875][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.843154][ T5610] bridge_slave_1: entered allmulticast mode [ 81.846931][ T5610] bridge_slave_1: entered promiscuous mode [ 81.911750][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.911915][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.912224][ T5611] bridge_slave_0: entered allmulticast mode [ 81.914009][ T5611] bridge_slave_0: entered promiscuous mode [ 81.922044][ T5606] team0: Port device team_slave_0 added [ 81.923346][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.923612][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.923827][ T5612] bridge_slave_0: entered allmulticast mode [ 81.927524][ T5612] bridge_slave_0: entered promiscuous mode [ 82.022340][ T5606] team0: Port device team_slave_1 added [ 82.022674][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.022844][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.022980][ T5612] bridge_slave_1: entered allmulticast mode [ 82.024676][ T5612] bridge_slave_1: entered promiscuous mode [ 82.025825][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.025986][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.026155][ T5611] bridge_slave_1: entered allmulticast mode [ 82.031304][ T5611] bridge_slave_1: entered promiscuous mode [ 82.042856][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.108414][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.167188][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.167199][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.167213][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.173323][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.191908][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.223461][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.223475][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.223498][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.230329][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.235923][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.240802][ T5610] team0: Port device team_slave_0 added [ 82.318466][ T5610] team0: Port device team_slave_1 added [ 82.373557][ T5612] team0: Port device team_slave_0 added [ 82.383534][ T5611] team0: Port device team_slave_0 added [ 82.415517][ T5612] team0: Port device team_slave_1 added [ 82.419206][ T5611] team0: Port device team_slave_1 added [ 82.422034][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.422046][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.422069][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.484021][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.484032][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.484046][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.497704][ T5606] hsr_slave_0: entered promiscuous mode [ 82.501444][ T5606] hsr_slave_1: entered promiscuous mode [ 82.559498][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.559509][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.559522][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.561561][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.561570][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.561583][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.569783][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.569796][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.569819][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.572082][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.572094][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.572116][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.729717][ T5610] hsr_slave_0: entered promiscuous mode [ 82.731567][ T5610] hsr_slave_1: entered promiscuous mode [ 82.733392][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 82.733502][ T5610] Cannot create hsr debugfs directory [ 82.836272][ T5612] hsr_slave_0: entered promiscuous mode [ 82.838452][ T5612] hsr_slave_1: entered promiscuous mode [ 82.839889][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 82.839910][ T5612] Cannot create hsr debugfs directory [ 82.853500][ T5611] hsr_slave_0: entered promiscuous mode [ 82.855713][ T5611] hsr_slave_1: entered promiscuous mode [ 82.857813][ T5611] debugfs: 'hsr0' already exists in 'hsr' [ 82.857835][ T5611] Cannot create hsr debugfs directory [ 83.586982][ T4922] Bluetooth: hci0: command tx timeout [ 83.816624][ T5606] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 83.827544][ T4922] Bluetooth: hci1: command tx timeout [ 83.857677][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.863128][ T5606] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 83.889693][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.894709][ T5606] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.906686][ T4922] Bluetooth: hci2: command tx timeout [ 83.906709][ T4922] Bluetooth: hci3: command tx timeout [ 83.914418][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.943784][ T5606] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.973656][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.087131][ T5611] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 84.121939][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.136322][ T5611] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 84.173521][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.185211][ T5611] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 84.211672][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.240887][ T5611] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 84.281959][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.412101][ T5610] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 84.450295][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.468105][ T5610] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 84.499498][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.503209][ T5610] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 84.525704][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.555710][ T5610] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 84.580017][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.720790][ T5612] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 84.765402][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.778083][ T5612] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 84.809787][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.813383][ T5612] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 84.836068][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.850656][ T5612] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 84.891999][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.936971][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.024090][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.065204][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.079545][ T2001] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.079877][ T2001] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.137910][ T2001] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.138374][ T2001] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.203541][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.239186][ T2256] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.239706][ T2256] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.274438][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.297369][ T2256] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.297484][ T2256] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.391266][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.439738][ T794] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.439875][ T794] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.465938][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.549919][ T2256] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.550307][ T2256] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.643140][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.666620][ T5614] Bluetooth: hci0: command tx timeout [ 85.701238][ T794] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.701503][ T794] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.763341][ T794] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.763498][ T794] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.906600][ T5614] Bluetooth: hci1: command tx timeout [ 85.986771][ T5614] Bluetooth: hci3: command tx timeout [ 85.986797][ T5614] Bluetooth: hci2: command tx timeout [ 86.476650][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.703021][ T37] cfg80211: failed to load regulatory.db [ 86.833654][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.884536][ T5606] veth0_vlan: entered promiscuous mode [ 86.963085][ T5606] veth1_vlan: entered promiscuous mode [ 87.178558][ T5611] veth0_vlan: entered promiscuous mode [ 87.219313][ T5606] veth0_macvtap: entered promiscuous mode [ 87.234131][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.249126][ T5611] veth1_vlan: entered promiscuous mode [ 87.263368][ T5606] veth1_macvtap: entered promiscuous mode [ 87.289922][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.353902][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.384896][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.431487][ T5611] veth0_macvtap: entered promiscuous mode [ 87.435872][ T92] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.459929][ T92] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.479405][ T92] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.480059][ T5611] veth1_macvtap: entered promiscuous mode [ 87.497387][ T92] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.571740][ T5612] veth0_vlan: entered promiscuous mode [ 87.684429][ T5610] veth0_vlan: entered promiscuous mode [ 87.746867][ T4922] Bluetooth: hci0: command tx timeout [ 87.781965][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.785416][ T5612] veth1_vlan: entered promiscuous mode [ 87.861248][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.889897][ T5610] veth1_vlan: entered promiscuous mode [ 87.932492][ T44] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.948304][ T44] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.952929][ T44] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.959020][ T44] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.986639][ T4922] Bluetooth: hci1: command tx timeout [ 87.989551][ T44] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.989571][ T44] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.066755][ T4922] Bluetooth: hci2: command tx timeout [ 88.066786][ T4922] Bluetooth: hci3: command tx timeout [ 88.212031][ T44] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.212049][ T44] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.271399][ T5612] veth0_macvtap: entered promiscuous mode [ 88.378207][ T5612] veth1_macvtap: entered promiscuous mode [ 88.402606][ T5610] veth0_macvtap: entered promiscuous mode [ 88.454658][ T5610] veth1_macvtap: entered promiscuous mode [ 88.488906][ T44] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.488925][ T44] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.536827][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.570967][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.611428][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.679925][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.681646][ T794] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.681662][ T794] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.711957][ T3464] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.728617][ T3464] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.775090][ T3464] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.795933][ T3464] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.815249][ T3464] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.831336][ T3464] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.856305][ T3464] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.952161][ T3464] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.953621][ T5762] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 88.953643][ T5762] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 89.035238][ T5762] vhci_hcd vhci_hcd.0: Device attached [ 89.479582][ T5618] usb 33-1: new low-speed USB device number 2 using vhci_hcd [ 89.528193][ T37] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 89.903382][ T37] usb 1-1: Using ep0 maxpacket: 16 [ 89.964096][ T37] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 89.977162][ T37] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 4.00 [ 89.977190][ T37] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.977209][ T37] usb 1-1: Product: syz [ 89.977222][ T37] usb 1-1: Manufacturer: syz [ 89.977237][ T37] usb 1-1: SerialNumber: syz [ 90.202694][ T37] usb 1-1: config 0 descriptor?? [ 90.302955][ T37] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 90.348364][ T37] usb 1-1: Detected FT232B [ 90.492153][ T37] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 90.493205][ T37] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 90.515013][ T5763] usbip_core: unknown command [ 90.515026][ T5763] vhci_hcd: unknown pdu 808747418 [ 90.515047][ T5763] usbip_core: unknown command [ 90.543509][ T44] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.543527][ T44] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.578789][ T3136] vhci_hcd vhci_hcd.0: stop threads [ 90.579712][ T3136] vhci_hcd vhci_hcd.0: release socket [ 90.635709][ T37] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 90.649449][ T3136] vhci_hcd vhci_hcd.0: disconnect device [ 90.658223][ T5618] usb 33-1: device descriptor read/64, error -71 [ 90.735750][ T37] usb 1-1: USB disconnect, device number 2 [ 90.789630][ T5747] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 90.813529][ T37] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 90.828102][ T92] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.828117][ T92] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.836641][ T37] ftdi_sio 1-1:0.0: device disconnected [ 90.937830][ T5618] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 91.023957][ T3136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.023976][ T3136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.053749][ T5747] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 91.053767][ T5747] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.090185][ T5747] usb 3-1: config 0 descriptor?? [ 91.129748][ T5747] cp210x 3-1:0.0: cp210x converter detected [ 91.241838][ T44] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.241855][ T44] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.670924][ T5747] cp210x 3-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 92.023580][ T5747] usb 3-1: cp210x converter now attached to ttyUSB0 [ 92.128343][ T5747] usb 3-1: USB disconnect, device number 2 [ 92.271098][ T5747] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 92.520293][ T5747] cp210x 3-1:0.0: device disconnected [ 92.783524][ T5785] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 93.404261][ T5797] ======================================================= [ 93.404261][ T5797] WARNING: The mand mount option has been deprecated and [ 93.404261][ T5797] and is ignored by this kernel. Remove the mand [ 93.404261][ T5797] option from the mount to silence this warning. [ 93.404261][ T5797] ======================================================= [ 93.511223][ T5798] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 93.575496][ T5797] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 93.964795][ T5807] netlink: zone id is out of range [ 93.964810][ T5807] netlink: zone id is out of range [ 93.964818][ T5807] netlink: zone id is out of range [ 93.964825][ T5807] netlink: zone id is out of range [ 93.987701][ T5807] netlink: zone id is out of range [ 93.987716][ T5807] netlink: zone id is out of range [ 93.987724][ T5807] netlink: zone id is out of range [ 93.987731][ T5807] netlink: zone id is out of range [ 93.987738][ T5807] netlink: zone id is out of range [ 93.987745][ T5807] netlink: zone id is out of range [ 94.318265][ T5615] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 95.179612][ T5615] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 95.179642][ T5615] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.179661][ T5615] usb 4-1: Product: syz [ 95.179675][ T5615] usb 4-1: Manufacturer: syz [ 95.179689][ T5615] usb 4-1: SerialNumber: syz [ 95.483171][ T5812] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 95.628934][ T5339] kernel write not supported for file /bluetooth/6lowpan_control (pid: 5339 comm: kworker/1:3) [ 96.459129][ T5615] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 96.559483][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 96.766559][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 96.769554][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 96.769583][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 96.769606][ T10] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 96.769617][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.910075][ T10] usb 1-1: config 0 descriptor?? [ 96.999253][ T10] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 97.049794][ T5610] ------------[ cut here ]------------ [ 97.049804][ T5610] task_rq(p) != rq [ 97.049813][ T5610] WARNING: kernel/sched/fair.c:7656 at hrtick_start_fair+0x196/0x1f0, CPU#0: syz-executor/5610 [ 97.049850][ T5610] Modules linked in: [ 97.049876][ T5610] CPU: 0 UID: 0 PID: 5610 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 97.049892][ T5610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 97.049904][ T5610] RIP: 0010:hrtick_start_fair+0x196/0x1f0 [ 97.049924][ T5610] Code: 42 80 3c 20 00 74 08 4c 89 ff e8 85 f5 97 00 4d 39 37 0f 85 0c ff ff ff 48 89 df 5b 41 5c 41 5d 41 5e 41 5f e9 7b 64 fa ff 90 <0f> 0b 90 e9 d1 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 82 [ 97.049935][ T5610] RSP: 0018:ffffc90004d77900 EFLAGS: 00010087 [ 97.049947][ T5610] RAX: ffff8880b873ba40 RBX: ffff8880b863ba40 RCX: ffffffff8197d8ae [ 97.049958][ T5610] RDX: 0000000000000000 RSI: ffff888029a33e00 RDI: ffff8880b863ba40 [ 97.049967][ T5610] RBP: dffffc0000000000 R08: ffffffff8fcf390f R09: 1ffffffff1f9e721 [ 97.049978][ T5610] R10: dffffc0000000000 R11: fffffbfff1f9e722 R12: dffffc0000000000 [ 97.049988][ T5610] R13: 1ffff110170c78d6 R14: ffff888029a33e00 R15: ffffffff8dc257d8 [ 97.049998][ T5610] FS: 000055558dfcb500(0000) GS:ffff888125a6b000(0000) knlGS:0000000000000000 [ 97.050010][ T5610] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.050020][ T5610] CR2: 000055954b771d80 CR3: 0000000041736000 CR4: 00000000003526f0 [ 97.050032][ T5610] Call Trace: [ 97.050041][ T5610] [ 97.050049][ T5610] set_next_task_fair+0xa68/0xce0 [ 97.050071][ T5610] __schedule+0x3e03/0x5550 [ 97.050106][ T5610] ? __pfx___schedule+0x10/0x10 [ 97.050128][ T5610] ? schedule+0x90/0x360 [ 97.050152][ T5610] schedule+0x164/0x360 [ 97.050169][ T5610] do_nanosleep+0x287/0x730 [ 97.050188][ T5610] ? do_nanosleep+0x8a/0x730 [ 97.050205][ T5610] ? __pfx_do_nanosleep+0x10/0x10 [ 97.050221][ T5610] ? __asan_memset+0x22/0x50 [ 97.050241][ T5610] ? __hrtimer_setup+0x1c2/0x260 [ 97.050254][ T5610] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 97.050272][ T5610] hrtimer_nanosleep+0x217/0x450 [ 97.050288][ T5610] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 97.050307][ T5610] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 97.050329][ T5610] __se_sys_clock_nanosleep+0x35b/0x3b0 [ 97.050348][ T5610] ? __pfx___se_sys_clock_nanosleep+0x10/0x10 [ 97.050369][ T5610] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.050384][ T5610] do_syscall_64+0x174/0x580 [ 97.050403][ T5610] ? clear_bhb_loop+0x40/0x90 [ 97.050420][ T5610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.050434][ T5610] RIP: 0033:0x7fe9ae49d68e [ 97.050451][ T5610] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 97.050461][ T5610] RSP: 002b:00007fffd1dd3668 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 97.050475][ T5610] RAX: ffffffffffffffda RBX: 000055558dfcb500 RCX: 00007fe9ae49d68e [ 97.050486][ T5610] RDX: 00007fffd1dd36c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 97.050498][ T5610] RBP: 00007fffd1dd372c R08: 0000000000000000 R09: 0000000000000000 [ 97.050509][ T5610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 97.050520][ T5610] R13: 00000000000927c0 R14: 0000000000017374 R15: 00007fffd1dd3780 [ 97.050546][ T5610] [ 97.050553][ T5610] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 97.050561][ T5610] CPU: 0 UID: 0 PID: 5610 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 97.050572][ T5610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 97.050578][ T5610] Call Trace: [ 97.050582][ T5610] [ 97.050586][ T5610] vpanic+0x56c/0xa60 [ 97.050601][ T5610] ? __pfx__printk+0x10/0x10 [ 97.050612][ T5610] ? __pfx_vpanic+0x10/0x10 [ 97.050625][ T5610] ? is_bpf_text_address+0x292/0x2b0 [ 97.050641][ T5610] ? is_bpf_text_address+0x26/0x2b0 [ 97.050660][ T5610] panic+0xc5/0xd0 [ 97.050674][ T5610] ? __pfx_panic+0x10/0x10 [ 97.050696][ T5610] __warn+0x315/0x4c0 [ 97.050709][ T5610] ? hrtick_start_fair+0x196/0x1f0 [ 97.050723][ T5610] ? hrtick_start_fair+0x196/0x1f0 [ 97.050737][ T5610] __report_bug+0x339/0x540 [ 97.050753][ T5610] ? hrtick_start_fair+0x196/0x1f0 [ 97.050767][ T5610] ? __pfx___report_bug+0x10/0x10 [ 97.050779][ T5610] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 97.050797][ T5610] ? hrtick_start_fair+0x196/0x1f0 [ 97.050810][ T5610] report_bug+0x16a/0x220 [ 97.050823][ T5610] ? hrtick_start_fair+0x196/0x1f0 [ 97.050835][ T5610] ? hrtick_start_fair+0x198/0x1f0 [ 97.050848][ T5610] handle_bug+0x9c/0x200 [ 97.050863][ T5610] exc_invalid_op+0x1a/0x50 [ 97.050877][ T5610] asm_exc_invalid_op+0x1a/0x20 [ 97.050887][ T5610] RIP: 0010:hrtick_start_fair+0x196/0x1f0 [ 97.050900][ T5610] Code: 42 80 3c 20 00 74 08 4c 89 ff e8 85 f5 97 00 4d 39 37 0f 85 0c ff ff ff 48 89 df 5b 41 5c 41 5d 41 5e 41 5f e9 7b 64 fa ff 90 <0f> 0b 90 e9 d1 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 82 [ 97.050908][ T5610] RSP: 0018:ffffc90004d77900 EFLAGS: 00010087 [ 97.050916][ T5610] RAX: ffff8880b873ba40 RBX: ffff8880b863ba40 RCX: ffffffff8197d8ae [ 97.050923][ T5610] RDX: 0000000000000000 RSI: ffff888029a33e00 RDI: ffff8880b863ba40 [ 97.050930][ T5610] RBP: dffffc0000000000 R08: ffffffff8fcf390f R09: 1ffffffff1f9e721 [ 97.050937][ T5610] R10: dffffc0000000000 R11: fffffbfff1f9e722 R12: dffffc0000000000 [ 97.050944][ T5610] R13: 1ffff110170c78d6 R14: ffff888029a33e00 R15: ffffffff8dc257d8 [ 97.050955][ T5610] ? set_next_task_fair+0xa4e/0xce0 [ 97.050969][ T5610] set_next_task_fair+0xa68/0xce0 [ 97.050984][ T5610] __schedule+0x3e03/0x5550 [ 97.051007][ T5610] ? __pfx___schedule+0x10/0x10 [ 97.051022][ T5610] ? schedule+0x90/0x360 [ 97.051035][ T5610] schedule+0x164/0x360 [ 97.051047][ T5610] do_nanosleep+0x287/0x730 [ 97.051060][ T5610] ? do_nanosleep+0x8a/0x730 [ 97.051073][ T5610] ? __pfx_do_nanosleep+0x10/0x10 [ 97.051084][ T5610] ? __asan_memset+0x22/0x50 [ 97.051098][ T5610] ? __hrtimer_setup+0x1c2/0x260 [ 97.051107][ T5610] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 97.051120][ T5610] hrtimer_nanosleep+0x217/0x450 [ 97.051131][ T5610] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 97.051149][ T5610] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 97.051165][ T5610] __se_sys_clock_nanosleep+0x35b/0x3b0 [ 97.051178][ T5610] ? __pfx___se_sys_clock_nanosleep+0x10/0x10 [ 97.051192][ T5610] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.051203][ T5610] do_syscall_64+0x174/0x580 [ 97.051216][ T5610] ? clear_bhb_loop+0x40/0x90 [ 97.051228][ T5610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.051238][ T5610] RIP: 0033:0x7fe9ae49d68e [ 97.051247][ T5610] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 97.051254][ T5610] RSP: 002b:00007fffd1dd3668 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 97.051264][ T5610] RAX: ffffffffffffffda RBX: 000055558dfcb500 RCX: 00007fe9ae49d68e [ 97.051271][ T5610] RDX: 00007fffd1dd36c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 97.051277][ T5610] RBP: 00007fffd1dd372c R08: 0000000000000000 R09: 0000000000000000 [ 97.051283][ T5610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 97.051289][ T5610] R13: 00000000000927c0 R14: 0000000000017374 R15: 00007fffd1dd3780 [ 97.051304][ T5610] [ 98.123353][ T5610] Shutting down cpus with NMI [ 98.123544][ T5610] Kernel Offset: disabled