last executing test programs: 1m53.44383897s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00') symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00') symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00') symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00') symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6) nanosleep(&(0x7f00000007c0)={0x1}, 0x0) r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559}) 1m53.329958784s ago: executing program 3 (id=4): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}}, 0x0) 1m53.166544028s ago: executing program 3 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='proc\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000000)='700\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='0\x00', 0x1, 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x5f5e100}, 0x0) 1m52.637782583s ago: executing program 1 (id=2): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000740)="789cecdd4b6c5c571907f0ef5e3fc863c08e9205e90643164542b13d715c05046a8b58f0e802441754aa04563271ac8c9310bb556c8c6803128f05425dd005525558d052405814d42240583c562054894aa80822600595aaa2b6628534e88c67eca1beae9dfa712beeef275dcfb9e7cce47ce3e43ff75ee51e3b80ca1a495ff288e311319c450cf58cf547677064f5794b13cb17d29645abf5f117b3c822626662f942f7f959e7f170e7c56722e297ef8f38f1c58df3ce2d2c5e9c6a361b573bfb63f3b357c6e616164fcecc4e4d37a61b974ed56fab9f19af4f4e9edeb5f7fae71fdf7ff4f6c31ffec9f79f7dec87d7be75f16f59dc11b5ce58effbd82d2331b2f63de9d59f45dcb5db9395a4aff3ef64a0ec42b8695fb8efec97d3dfdfd188381111476228fa3aa9bfe51df7be3414d7feb2d96bfff5ab47feb99fb502bbaff5b988165049657ffe000000000000000000000000000000eb5aadccfa7fa8a8b23f7f0000000000000000000000000000808d6626962f74b7fd9af38f3fdbaf9980222fdc1911fdabf95fea6cab23fd31d27e3c10031171e8e52c3d6d4d16111fdde1dc2b77448cc4fb1e9effc43ddf495b743e8776f8c702dbf4c08311f1d6a2e37fd6ceff701c68ef1d7a39ff9ffce7e9b59dc7d47ffd75cc7dfcb994ff99eff5f6c93fec9f9de4ff6b3df97fe875cc7df21b29ff5fff516f9ffc43352cfdbaec0a80b27ce8e9b22b806a6b9fff8ff7f76f76febf1357b618ffcf5c3aff7ff1ddbd7dceffa11a1eff4cd9150065f9e90fcaae0028cb57ff507605506d2b77a6ebffa2ffffcbd7eeff8982fb7f6a11f1a91dce3df9f374fdfff6a3bd7daeff61ff74efff5bda70ffdf7afefb36b9ffefd16dced1faf7f4b1a2fe634fa5fc3f7aad7bff5fdad2fcdd7b0181bdf5c28311b714e63f5bcb7f5690ff3c2296b739c7d26fef9d2dea3f7a77caffe3f7cb3f94a3f5cd885ba338ff5da935363f7b656c6e61f1e4ccecd47463ba71e954fdb6fa99f1fae4e4e9b1f333cdc6f8ead7c239ea0f5dff7c51fff3b7a7fc0f5d977f28473afe1fda24ff5b9dffaf6c738e4f7e65f86345fda7ef49f9ffc0c46be73f7f7e30bb3b9510839d9e6b53f3f357eb1183d95d1bfb4fddec7700aaa39b916e8652fedf79e2b5afff8bceff0f46c433db9c73f1ea53df2dea7fe4b194ff6f3fe1f80fe548f93fb7c5f1bf28ffa9efafdb9ce3bd2ffdbe7079d0937f4af9fffb67e51f0000000000000000000000000000000000000000000000000000008037aa3c226a91e5a36bed3c1f1d8d381c11c7e250debc3c37ffaef397efbb742e8d450cc740defd4dff43abfb59daafb7dbebfba75eb53f11114722e24b7d07dbfba3672f37cf95fde6a1a26a11379efcf4d9c1b2eb000000000000000000000000000000d61d7ed5faff7ff4adaeff07fe7fd5226e3cfb9ba77f91daaff4955d0db09f52fe9f7865f62321ff5039f20fd525ff505df20fd525ff505df20fd525ff505df20fd525ff505df20fd5d59b7f00000000000000000000000000000000000000606f1d79dbca7359443cf09e83ed2d19ec8c0d945a19b0d7f2b20b004ae3477f4375f5975d00501ad7f840b6c5f881cd0656b67a2500000000000000000000b05b6e3d6efd3f5495f5ff505dd6ff437559ff0fd5e51a1fb0fe1f00000000000000000000def86aed2dcb473b6b816b91e7a3a3116f8e88e118c8cecf341be311f19688f85ddfc09bd27ebdeca2811da945dcf8e033c71e2ebb0e000000000000000000000000000060dddcc2e2c5a966b3715543434363ad51f62713000000000000000000000000000054cffaa2dfb22b0100000000000000000000000000000000000000000000000000000000000080f2acfffeffbd6b94fd1e010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e066fd370000ffffec7a4ffe", 0x676) ftruncate(r0, 0x100000) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./loop1\x00', 0x61ff, 0x701) mount(&(0x7f0000000400)=@filename='./loop1\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000680)='ext4\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x0, 0x0) ioctl(r2, 0x40086610, &(0x7f0000000800)="0000100000000000") 1m52.049832871s ago: executing program 0 (id=6): mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./dm_control\x00', 0x81b6, 0xaec) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./dm_control\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6) fallocate(r1, 0x0, 0x0, 0x1000000) r2 = syz_open_dev$loop(&(0x7f0000000200), 0x0, 0x0) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x42, 0x1b6) fallocate(r3, 0x0, 0x0, 0x1000000) r4 = syz_open_dev$loop(&(0x7f0000000400), 0x1, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) ioctl(r0, 0xc138fd03, &(0x7f0000001000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f6f6c00"/212) 1m51.997144861s ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/events/kmem/kmalloc/filter\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='call_site.function == vfs_read\x00', 0x1f) 1m51.83064678s ago: executing program 1 (id=7): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) (async) read$nci(r0, &(0x7f0000000200)=""/100, 0x64) write$nci(r0, &(0x7f0000000280)=@NCI_OP_CORE_RESET_RSP, 0x6) read$nci(r0, &(0x7f00000002c0)=""/100, 0x64) write$nci(r0, &(0x7f0000000340)=@NCI_OP_CORE_INIT_RSP, 0x14) read$nci(r0, &(0x7f0000000380)=""/100, 0x64) write$nci(r0, &(0x7f0000000400)=@NCI_OP_RF_DISCOVER_MAP_RSP, 0x4) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x24, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xffffffff}]}, 0x24}}, 0x0) (async) read$nci(r0, &(0x7f0000000500)=""/100, 0x64) write$nci(r0, &(0x7f0000000580)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r0, &(0x7f00000005c0)=""/100, 0x64) write$nci(r0, &(0x7f0000000640)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r0, &(0x7f0000000680)=""/100, 0x64) write$nci(r0, &(0x7f0000000700)=@NCI_OP_RF_DISCOVER_RSP, 0x4) write$nci(r0, &(0x7f0000000740)=@NCI_OP_RF_INTF_ACTIVATED_NTF={0x1, 0x0, 0x3, 0x5, 0x0, @a={0x1, 0x3, 0x4, 0x1, 0xff, 0x1, 0x4, {}, 0x0, 0x0, 0x0, 0x10, 0xf, '\x00'/15}}, 0x22) sendmsg$NFC_CMD_DEP_LINK_UP(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_COMM_MODE={0x5}]}, 0x2c}}, 0x0) (async) read$nci(r0, &(0x7f0000000840)=""/100, 0x64) write$nci(r0, &(0x7f00000008c0)=@DATA={0x0, 0x0, 0x0, 0x0, 0x2, "0100"}, 0x5) 1m51.556590535s ago: executing program 2 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/sys/kernel/printk\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='1 1 1 1', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f00000000c0)='core', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f0000000140)='disk', 0x4) (async) 1m50.600684808s ago: executing program 3 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='0000:00:03.0\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='ath9k\x00', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/pci/drivers/ath9k/bind\x00', 0x2, 0x0) write(r2, &(0x7f0000000100)='0000:00:03.0\x00', 0xd) 1m50.355754688s ago: executing program 1 (id=10): r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040120a105d0000000000010902270001010080320904000003ffffff00070581034000010705020200020007058602000200"], 0x0) syz_usb_ep_write(r0, 0x81, 0x4, &(0x7f0000000500)="01000000") syz_usb_ep_write(r0, 0x86, 0x4, &(0x7f0000000500)="01000000") syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 1m50.34529171s ago: executing program 3 (id=11): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendto(r0, &(0x7f0000000000)="30000000100001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000040)="30000000110001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000080)="30000000120001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f00000000c0)="30000000130001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000100)="30000000140001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000140)="30000000150001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000180)="30000000160001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f00000001c0)="30000000170001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000200)="30000000180001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000240)="30000000190001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000280)="300000001a0001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f00000002c0)="300000001b0001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000300)="300000001c0001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000340)="300000001d0001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000380)="300000001e0001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f00000003c0)="300000001f0001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000400)="30000000200001000100000000000000110100000a0005007664706130000000100002007664706173696d5f6e657400", 0x30, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000500)={0x1}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto(r0, &(0x7f0000000700)="1100"/36, 0x24, 0x0, 0x0, 0x0) ioctl(r1, 0x8946, &(0x7f0000000600)="65746831000000000000000000000000000700000000007f00"/40) 1m50.268921907s ago: executing program 0 (id=12): mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff) mount(&(0x7f0000000640)=@filename='proc\x00', &(0x7f0000000680)='./proc\x00', &(0x7f00000006c0)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='-2 -3 +4\n', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='tcp 2049\n', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0) write(r2, &(0x7f0000000740)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./nfsd/nfsv4leasetime\x00', 0x2, 0x0) write(r3, &(0x7f00000007c0)='1\n', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f0000000240)='1\n', 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r5, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 testdomain\n', 0x25) (async) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r6, &(0x7f0000000340)='testdomain / 2147483647 8194 0 0 0\n', 0x23) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r7, &(0x7f00000003c0)='testdomain 1 \\x00000000 2147483647 /\n', 0x25) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000440)='127.0.0.1:/\x00', &(0x7f0000000480)='./mnt\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1\x00']) openat(0xffffffffffffff9c, &(0x7f0000000540)='./mnt/file1\x00', 0x42, 0x1ff) rename(&(0x7f0000000580)='./mnt/file1\x00', &(0x7f00000005c0)='./mnt/file2\x00') 1m49.412223467s ago: executing program 0 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/vtconsole/vtcon1/bind\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='0\x00', 0x1) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) write(r1, &(0x7f0000000500)="1b5b3f356800", 0x5) 1m49.372239262s ago: executing program 3 (id=14): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/infiniband/syz0/node_desc\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='new_node_desc\x00', 0xe) 1m48.203829345s ago: executing program 0 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='proc\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) 1m47.539062556s ago: executing program 0 (id=16): syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902220001010080fa0904000000ff0000000904000101ff00000007058201000401"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x0) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x1, 0x1, 0x1}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000240)=0x1) 45.73824325s ago: executing program 32 (id=16): syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902220001010080fa0904000000ff0000000904000101ff00000007058201000401"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x0) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x1, 0x1, 0x1}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000240)=0x1) 45.5807786s ago: executing program 33 (id=10): r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040120a105d0000000000010902270001010080320904000003ffffff00070581034000010705020200020007058602000200"], 0x0) syz_usb_ep_write(r0, 0x81, 0x4, &(0x7f0000000500)="01000000") syz_usb_ep_write(r0, 0x86, 0x4, &(0x7f0000000500)="01000000") syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x4, "ffffffff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 45.260252658s ago: executing program 34 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/sys/kernel/printk\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='1 1 1 1', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f00000000c0)='core', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f0000000140)='disk', 0x4) (async) 45.029326357s ago: executing program 35 (id=14): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/infiniband/syz0/node_desc\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='new_node_desc\x00', 0xe) 17.165038317s ago: executing program 6 (id=19): r0 = syz_usb_connect(0x2, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b061000010102030109022e0001010080fa0904000004ff00000007050302400000070584024000000705880140000107050701400001"], 0x0) nanosleep(&(0x7f0000000500)={0x0, 0xbebc200}, 0x0) syz_usb_ep_write(r0, 0x84, 0x10, &(0x7f0000000100)="0000000c000000010007000101770000") r1 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x0, 0x0) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x1}) syz_usb_ep_write(r0, 0x88, 0x10, &(0x7f0000000400)='\x00'/16) 15.096644617s ago: executing program 6 (id=21): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfs_share\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfs_share\x00', &(0x7f0000000040)='tmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='nfsd 127.0.0.1 2147483647 mydomain\n', 0x23) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='mydomain ./nfs_share 2147483647 8192 0 0 0\n', 0x2b) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./nfsd/versions\x00', 0x1, 0x0) write(r2, &(0x7f0000000840)='-2 -3 +4\n', 0x9) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='tcp 2049\n', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='1\n', 0x2) close(r4) nanosleep(&(0x7f0000000380)={0x1}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/v4_end_grace\x00', 0x1, 0x0) write(r5, &(0x7f0000000640)='Y\n', 0x2) close(r5) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000440)='127.0.0.1:/\x00', &(0x7f0000000400)='./mnt\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049\x00']) r6 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/file1\x00', 0x42, 0x1ff) close(r6) linkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/file1\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./mnt/file2\x00', 0x0) 12.192367825s ago: executing program 6 (id=22): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/module/nvme_core/parameters/admin_timeout\x00', 0x2, 0x0) write(r0, &(0x7f0000000d00)='1\x00', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='wwnn=0x1111111111111111,wwpn=0x2222222222222222\x00', 0x2f) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444\x00', 0x2f) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0) write(r3, &(0x7f0000000600)='wwnn=0x3333333333333333,wwpn=0x4444444444444444,roles=32,lpwwnn=0x1111111111111111,lpwwpn=0x2222222222222222\x00', 0x6c) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/fcloop/ctl/set_cmd_drop\x00', 0x1, 0x0) write(r4, &(0x7f0000000800)='101:0:100\x00', 0xa) close(r4) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000900), 0x2, 0x0) write(r5, &(0x7f0000000a00)='transport=fc,traddr=nn-0x3333333333333333:pn-0x4444444444444444,host_traddr=nn-0x1111111111111111:pn-0x2222222222222222,nqn=nqn.2014-08.org.nvmexpress.discovery,ctrl_loss_tmo=1\x00', 0xb2) getpid() close(r5) 11.783828506s ago: executing program 6 (id=23): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) timer_create(0x0, &(0x7f0000000000)={0x0, 0x9}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000080)={{}, {0x0, 0x1000000}}, &(0x7f00000000c0)) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000280)={r0, r0, 0xc, 0x1, &(0x7f0000000340)='\x00', 0x9, 0x1, 0xc45, 0x1010, 0x9, 0x2, 0x1, 'syz1\x00'}) 11.484306819s ago: executing program 6 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./sys\x00', &(0x7f0000000340)='sysfs\x00', 0x0, 0x0) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000080), 0x2) nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0) write(r0, &(0x7f0000000100)="02fa", 0x2) write(r0, &(0x7f0000000102)="02ff", 0x2) write(r0, &(0x7f0000000104)="0247", 0x2) write(r0, &(0x7f0000000106)="0280", 0x2) nanosleep(&(0x7f0000000210)={0x0, 0x5f5e100}, 0x0) write(r0, &(0x7f0000000108)="02fa", 0x2) write(r0, &(0x7f000000010a)="02ff", 0x2) write(r0, &(0x7f000000010c)="0247", 0x2) write(r0, &(0x7f000000010e)="0280", 0x2) nanosleep(&(0x7f0000000220)={0x0, 0x5f5e100}, 0x0) write(r0, &(0x7f0000000110)="02fa", 0x2) write(r0, &(0x7f0000000112)="02ff", 0x2) write(r0, &(0x7f0000000114)="0247", 0x2) write(r0, &(0x7f0000000116)="0280", 0x2) nanosleep(&(0x7f0000000240)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/serio/devices/serio0/protocol\x00', 0x2, 0x0) write(r1, &(0x7f0000000440)='synaptics\x00', 0xa) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/bus/serio/devices/serio1/protocol\x00', 0x2, 0x0) write(r2, &(0x7f0000000440)='synaptics\x00', 0xa) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/bus/serio/devices/serio2/protocol\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='synaptics\x00', 0xa) 8.757146597s ago: executing program 5 (id=25): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./proc/net/afs/cells\x00', 0x2, 0x0) write(r0, &(0x7f0000000080)='add syz0 127.0.0.1\n\x00', 0x13) r1 = openat(0xffffffffffffff9c, &(0x7f00000000a0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r1, &(0x7f00000000c0)='syz0\n\x00', 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1ff) mount$afs(&(0x7f0000000200)=@cell={0x25, '', 'syz0', '.readonly'}, &(0x7f0000000000)='./file0\x00', &(0x7f00000000e0), 0x0, &(0x7f0000000300)={[{}]}) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/foo@sys\x00', 0x0, 0x0) 8.517721108s ago: executing program 7 (id=20): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000402000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000000000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000400000)={0x0, &(0x7f0000401000)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x1b, {0x0, "0f01c1"}}, @nested_vmlaunch={0x12f, 0x18}], 0x63}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 7.565735391s ago: executing program 5 (id=26): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001221b00090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00221b00000005010902a1010930150025643500456455006511750895018102c0"], 0x0}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 7.16410271s ago: executing program 4 (id=17): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff0000000705010200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000100)={0x40, 0x1, 0x1e, "4d61501d0100000000000000100000000000800700000000000038040000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)={0x40, 0x40}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)={0x40, 0x50, 0x10, "0102030405060708090a0b0c0d0e0f10"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000400)={0x40, 0x51}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000500)={0x40, 0x54, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000600)={0x40, 0x56, 0x7d, "00ffffffffffff0004430100000000000000010480000000010000000000000000000000000001010101010101010101010101010101000000fd00324b1e53110200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002c"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.757054647s ago: executing program 7 (id=27): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a3100000000080041007278650014003300766574683000"/56], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) nanosleep(&(0x7f0000000a00)={0x0, 0xbebc200}, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000200)={0x15, 0x110, 0xfa00, {r2, 0x3e8, 0x0, 0x10, 0x0, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}}}, 0x118) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000600)={0xc, 0x8, 0xfa00, {&(0x7f0000000700)}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000400)={0x4, 0x8, 0xfa00, {r2, 0x3e8}}, 0x10) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000800)={0xc, 0x8, 0xfa00, {&(0x7f0000000900)}}, 0x10) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000500)={0x6, 0x118, 0xfa00, {{0x6, 0xf, '\x00', 0x0, 0x40, 0x4, 0xa8, 0x3, 0xf, 0x4, 0x1}, r2}}, 0x120) 3.984268926s ago: executing program 5 (id=28): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000100)=@ethtool_pauseparam={0x13, 0x1, 0x1, 0x1}}) 3.747446954s ago: executing program 5 (id=29): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00'/40, 0x2, 0x0) write(r0, &(0x7f0000000180)='freeze\n', 0x7) 3.596121873s ago: executing program 4 (id=30): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000008000/0x1000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f000000b000)={0x0, &(0x7f000000c000)=[@code={0xa, 0x13, {"ebfe"}}], 0x13}) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000001000)={0x40, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000001000)) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000002000)={0x6, 0x0, [{0x309, 0x0, 0xffffffffffffffff}, {0x38d, 0x0, 0x3}, {0xc1, 0x0, 0xffffffffffffffff}, {0x186, 0x0, 0x5300c0}, {0x38f, 0x0, 0x100000001}, {0x390, 0x0, 0x100000001}]}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000003000)={0x2, 0x0, [{0xc0010004, 0x0, 0xffffffffffffffff}, {0xc0010000, 0x0, 0x5300c0}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.36423583s ago: executing program 5 (id=31): syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c39000101020301010902200001010080fa0904000002ffffff000705010200020007058102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000180), 0x0, 0x0) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1}) r1 = syz_open_dev$I2C(&(0x7f0000000180), 0x1, 0x0) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1}) r2 = syz_open_dev$I2C(&(0x7f0000000180), 0x2, 0x0) ioctl$I2C_RDWR(r2, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1}) r3 = syz_open_dev$I2C(&(0x7f0000000180), 0x3, 0x0) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1}) r4 = syz_open_dev$I2C(&(0x7f0000000180), 0x4, 0x0) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1}) r5 = syz_open_dev$I2C(&(0x7f0000000180), 0x5, 0x0) ioctl$I2C_RDWR(r5, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1}) 2.279953678s ago: executing program 4 (id=32): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write(r0, &(0x7f0000000100)="0101", 0x2) write(r0, &(0x7f0000000102)='\x00\x00', 0x2) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write(r0, &(0x7f0000000104)="02fa", 0x2) write(r0, &(0x7f0000000106)="02aa", 0x2) write(r0, &(0x7f0000000108)="0200", 0x2) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write(r0, &(0x7f000000010a)="02fa", 0x2) write(r0, &(0x7f000000010c)="0200", 0x2) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write(r0, &(0x7f000000010e)="02fa", 0x2) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write(r0, &(0x7f0000000110)="02fa", 0x2) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write(r0, &(0x7f0000000112)="02fa", 0x2) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write(r0, &(0x7f0000000114)="02fa", 0x2) write(r0, &(0x7f0000000116)="0273", 0x2) write(r0, &(0x7f0000000118)="0202", 0x2) write(r0, &(0x7f000000011a)="0264", 0x2) 372.7971ms ago: executing program 5 (id=33): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000080)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) 84.166818ms ago: executing program 7 (id=34): mmap(&(0x7f0000000000/0x20000)=nil, 0x20000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000011000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000013000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000015000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000017000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f0000019000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f000001b000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f000001d000/0x1000)=nil, 0x1000, 0x1) mprotect(&(0x7f000001f000/0x1000)=nil, 0x1000, 0x1) munmap(&(0x7f0000000000/0x20000)=nil, 0x20000) 0s ago: executing program 7 (id=35): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x1dcd6500}, 0x0) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00") nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00") nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00") nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000206)="0000ffffff0300fdd72b00fe00") nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000300)="0000ff00ff00") nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000306)="0000ffffff0400fcd72101000700") nanosleep(&(0x7f0000000400)={0x0, 0x1dcd6500}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000004200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0) sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000005100)={&(0x7f0000005200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006100)={&(0x7f0000006200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0) sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000007100)={&(0x7f0000007200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.33' (ED25519) to the list of known hosts. [ 74.653194][ T5580] cgroup: Unknown subsys name 'net' [ 74.894764][ T5580] cgroup: Unknown subsys name 'cpuset' [ 74.950064][ T5580] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 76.556379][ T5580] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 78.882405][ T4907] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 78.913435][ T5604] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 78.914108][ T5604] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 78.917740][ T5604] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 78.919380][ T5604] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 78.947658][ T5604] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 78.965248][ T5607] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 78.978933][ T5607] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 78.982271][ T5604] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 78.982402][ T5607] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 78.984175][ T5607] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 78.985388][ T5607] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 78.987415][ T5607] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 78.991088][ T5610] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 78.992098][ T5610] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 78.999961][ T5604] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 79.000374][ T5602] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 79.001098][ T5602] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 79.034432][ T5602] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 79.054841][ T5604] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 80.928194][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.937418][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.937607][ T5593] bridge_slave_0: entered allmulticast mode [ 80.939918][ T5593] bridge_slave_0: entered promiscuous mode [ 80.988158][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.988365][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.988690][ T5593] bridge_slave_1: entered allmulticast mode [ 80.992085][ T5593] bridge_slave_1: entered promiscuous mode [ 81.020914][ T5597] Bluetooth: hci1: command tx timeout [ 81.100613][ T5602] Bluetooth: hci3: command tx timeout [ 81.100805][ T5597] Bluetooth: hci2: command tx timeout [ 81.138458][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.138878][ T5592] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.139186][ T5592] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.140576][ T5592] bridge_slave_0: entered allmulticast mode [ 81.143779][ T5592] bridge_slave_0: entered promiscuous mode [ 81.146691][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.146994][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.147236][ T5594] bridge_slave_0: entered allmulticast mode [ 81.152940][ T5594] bridge_slave_0: entered promiscuous mode [ 81.182523][ T5597] Bluetooth: hci0: command tx timeout [ 81.188915][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.218514][ T5592] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.218703][ T5592] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.218883][ T5592] bridge_slave_1: entered allmulticast mode [ 81.224629][ T5592] bridge_slave_1: entered promiscuous mode [ 81.227034][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.227346][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.227595][ T5594] bridge_slave_1: entered allmulticast mode [ 81.234966][ T5594] bridge_slave_1: entered promiscuous mode [ 81.311249][ T5595] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.311459][ T5595] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.311603][ T5595] bridge_slave_0: entered allmulticast mode [ 81.313369][ T5595] bridge_slave_0: entered promiscuous mode [ 81.373743][ T5595] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.374059][ T5595] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.374311][ T5595] bridge_slave_1: entered allmulticast mode [ 81.376284][ T5595] bridge_slave_1: entered promiscuous mode [ 81.407615][ T5593] team0: Port device team_slave_0 added [ 81.417964][ T5592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.428231][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.450976][ T5593] team0: Port device team_slave_1 added [ 81.454126][ T5592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.457351][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.527707][ T5595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.782791][ T5595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.784459][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.784472][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.784486][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.792091][ T5592] team0: Port device team_slave_0 added [ 81.797701][ T5594] team0: Port device team_slave_0 added [ 81.826961][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.826976][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.827000][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.833042][ T5592] team0: Port device team_slave_1 added [ 81.837577][ T5594] team0: Port device team_slave_1 added [ 81.943691][ T5595] team0: Port device team_slave_0 added [ 81.988529][ T5595] team0: Port device team_slave_1 added [ 81.993129][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.993144][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.993167][ T5592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.996755][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.996767][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.996791][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.047798][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.047813][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.047838][ T5592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.051656][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.051669][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.051693][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.136302][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.136318][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.136342][ T5595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.152008][ T5593] hsr_slave_0: entered promiscuous mode [ 82.154167][ T5593] hsr_slave_1: entered promiscuous mode [ 82.168039][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.168061][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.168085][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.327393][ T5594] hsr_slave_0: entered promiscuous mode [ 82.328659][ T5594] hsr_slave_1: entered promiscuous mode [ 82.330473][ T5594] debugfs: 'hsr0' already exists in 'hsr' [ 82.330614][ T5594] Cannot create hsr debugfs directory [ 82.344182][ T5592] hsr_slave_0: entered promiscuous mode [ 82.346190][ T5592] hsr_slave_1: entered promiscuous mode [ 82.347830][ T5592] debugfs: 'hsr0' already exists in 'hsr' [ 82.347852][ T5592] Cannot create hsr debugfs directory [ 82.427846][ T5595] hsr_slave_0: entered promiscuous mode [ 82.429023][ T5595] hsr_slave_1: entered promiscuous mode [ 82.431442][ T5595] debugfs: 'hsr0' already exists in 'hsr' [ 82.431464][ T5595] Cannot create hsr debugfs directory [ 83.101887][ T5597] Bluetooth: hci1: command tx timeout [ 83.180814][ T5602] Bluetooth: hci3: command tx timeout [ 83.180907][ T5597] Bluetooth: hci2: command tx timeout [ 83.260428][ T5597] Bluetooth: hci0: command tx timeout [ 83.426028][ T5593] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 83.473814][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.481466][ T5593] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 83.505925][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.507561][ T5593] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.543017][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.562716][ T5593] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.605533][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.703706][ T5592] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 83.744342][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.767872][ T5592] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 83.796195][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.799078][ T5592] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 83.834861][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.863172][ T5592] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 83.894965][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.084907][ T5595] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 84.115034][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.124367][ T5595] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 84.153559][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.165283][ T5595] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 84.205177][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.247854][ T5595] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 84.266208][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.413463][ T5594] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 84.445817][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.455016][ T5594] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 84.485798][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.491786][ T5594] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 84.534677][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.550335][ T5594] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 84.594060][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.673777][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.772259][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.805618][ T5592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.831399][ T808] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.831720][ T808] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.895178][ T3755] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.895453][ T3755] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.961707][ T5592] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.001121][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.022456][ T1686] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.022611][ T1686] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.079089][ T1686] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.079254][ T1686] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.180458][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.189876][ T5597] Bluetooth: hci1: command tx timeout [ 85.235375][ T212] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.235969][ T212] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.260295][ T5602] Bluetooth: hci3: command tx timeout [ 85.260382][ T5597] Bluetooth: hci2: command tx timeout [ 85.273326][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.313208][ T212] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.339709][ T212] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.357270][ T5597] Bluetooth: hci0: command tx timeout [ 85.475808][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.536376][ T212] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.536638][ T212] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.598329][ T212] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.598604][ T212] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.596543][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.727265][ T5592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.765631][ T835] cfg80211: failed to load regulatory.db [ 86.915615][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.094009][ T5593] veth0_vlan: entered promiscuous mode [ 87.133793][ T5592] veth0_vlan: entered promiscuous mode [ 87.182962][ T5593] veth1_vlan: entered promiscuous mode [ 87.198765][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.224252][ T5592] veth1_vlan: entered promiscuous mode [ 87.260249][ T5597] Bluetooth: hci1: command tx timeout [ 87.278797][ T5595] veth0_vlan: entered promiscuous mode [ 87.325726][ T5595] veth1_vlan: entered promiscuous mode [ 87.342611][ T5602] Bluetooth: hci3: command tx timeout [ 87.342658][ T5597] Bluetooth: hci2: command tx timeout [ 87.393641][ T5593] veth0_macvtap: entered promiscuous mode [ 87.418710][ T5592] veth0_macvtap: entered promiscuous mode [ 87.427036][ T5593] veth1_macvtap: entered promiscuous mode [ 87.429700][ T5597] Bluetooth: hci0: command tx timeout [ 87.465226][ T5592] veth1_macvtap: entered promiscuous mode [ 87.514522][ T5594] veth0_vlan: entered promiscuous mode [ 87.552571][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.571994][ T5595] veth0_macvtap: entered promiscuous mode [ 87.587912][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.605048][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.607246][ T5594] veth1_vlan: entered promiscuous mode [ 87.626564][ T5595] veth1_macvtap: entered promiscuous mode [ 87.646528][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.674473][ T3690] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.691908][ T3690] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.698204][ T3690] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.710962][ T3690] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.721099][ T3690] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.752334][ T3690] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.811774][ T3690] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.816399][ T3690] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.828813][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.978215][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.198680][ T212] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.213073][ T5594] veth0_macvtap: entered promiscuous mode [ 88.253043][ T212] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.328843][ T212] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.329163][ T212] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.407310][ T5594] veth1_macvtap: entered promiscuous mode [ 88.507263][ T212] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.507288][ T212] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.849431][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.888067][ T3760] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.888086][ T3760] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.934655][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.946709][ T1686] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.946726][ T1686] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.015935][ T1686] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.046688][ T1686] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.048245][ T1686] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.061337][ T1686] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.094045][ T1686] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.094063][ T1686] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.418143][ T3755] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.418162][ T3755] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.837450][ T1686] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.837469][ T1686] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.931071][ T3760] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.931088][ T3760] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.388154][ T212] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.388172][ T212] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.045646][ T5757] loop1: detected capacity change from 0 to 2048 [ 91.185179][ T5759] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 91.646648][ T5690] Flush: task=udevd[5690] dev=loop1 state=2 [ 91.822392][ T5690] Teardown: task=udevd[5690] dev=loop1 state=2 syzkaller syzkaller login: [ 204.332838][ T5582] ------------[ cut here ]------------ [ 204.332848][ T5582] URB ffff888035c38500 submitted while active [ 204.332864][ T5582] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#0: kworker/0:4/5582 [ 204.332887][ T5582] Modules linked in: [ 204.332927][ T5582] CPU: 0 UID: 0 PID: 5582 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 204.332939][ T5582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 204.332946][ T5582] Workqueue: usb_hub_wq hub_event [ 204.332964][ T5582] RIP: 0010:usb_submit_urb+0x7c/0x18b0 [ 204.332980][ T5582] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 f9 92 4d fb 49 83 3e 00 74 40 e8 0e 3c e1 fa 48 8d 3d 87 f1 f8 08 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 f3 3b e1 fa eb 05 e8 ec 3b [ 204.332988][ T5582] RSP: 0018:ffffc90004b4eb40 EFLAGS: 00010283 [ 204.332997][ T5582] RAX: ffffffff86e467a2 RBX: ffff888035c38500 RCX: 0000000000100000 [ 204.333005][ T5582] RDX: ffffc900180f8000 RSI: ffff888035c38500 RDI: ffffffff8fdd5930 [ 204.333013][ T5582] RBP: dffffc0000000000 R08: ffffffff8fd0c47f R09: 1ffffffff1fa188f [ 204.333020][ T5582] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff88805ac40c58 [ 204.333027][ T5582] R13: 1ffff1100b58818b R14: ffff888035c38508 R15: 0000000000000cc0 [ 204.333035][ T5582] FS: 0000000000000000(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000 [ 204.333043][ T5582] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 204.333050][ T5582] CR2: 000000110c25272f CR3: 000000005c24a000 CR4: 00000000003526f0 [ 204.333059][ T5582] Call Trace: [ 204.333064][ T5582] [ 204.333068][ T5582] ? lockdep_hardirqs_on+0x7a/0x110 [ 204.333081][ T5582] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 204.333092][ T5582] ? mutex_lock_nested+0x152/0x1d0 [ 204.333105][ T5582] ? port100_send_cmd_async+0x6d3/0xcc0 [ 204.333121][ T5582] port100_send_cmd_async+0x84f/0xcc0 [ 204.333142][ T5582] port100_set_command_type+0x1c8/0x390 [ 204.333155][ T5582] ? pcpu_alloc+0x10/0x310 [ 204.333171][ T5582] ? __pfx_port100_set_command_type+0x10/0x10 [ 204.333191][ T5582] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 204.333204][ T5582] port100_probe+0x7b2/0xba0 [ 204.333218][ T5582] ? __pfx_port100_probe+0x10/0x10 [ 204.333232][ T5582] ? __pm_runtime_set_status+0x977/0xc40 [ 204.333250][ T5582] usb_probe_interface+0x788/0xe50 [ 204.333269][ T5582] ? __pfx_usb_probe_interface+0x10/0x10 [ 204.333285][ T5582] ? sysfs_do_create_link_sd+0xe0/0x110 [ 204.333298][ T5582] ? driver_sysfs_add+0x1fe/0x210 [ 204.333311][ T5582] ? __pfx_usb_probe_interface+0x10/0x10 [ 204.333323][ T5582] really_probe+0x254/0xae0 [ 204.333338][ T5582] __driver_probe_device+0x1e8/0x360 [ 204.333352][ T5582] driver_probe_device+0x4f/0x240 [ 204.333367][ T5582] __device_attach_driver+0x270/0x410 [ 204.333382][ T5582] bus_for_each_drv+0x25b/0x2f0 [ 204.333397][ T5582] ? __pfx___device_attach_driver+0x10/0x10 [ 204.333416][ T5582] ? __pfx_bus_for_each_drv+0x10/0x10 [ 204.333431][ T5582] ? rt_spin_unlock+0x163/0x200 [ 204.333448][ T5582] __device_attach+0x2c7/0x450 [ 204.333459][ T5582] ? rt_spin_unlock+0x157/0x200 [ 204.333473][ T5582] ? __pfx___device_attach+0x10/0x10 [ 204.333491][ T5582] device_initial_probe+0xa1/0xd0 [ 204.333504][ T5582] bus_probe_device+0x12d/0x220 [ 204.333521][ T5582] device_add+0x7d7/0xb80 [ 204.333534][ T5582] usb_set_configuration+0x1ad8/0x2180 [ 204.333562][ T5582] usb_generic_driver_probe+0x8d/0x150 [ 204.333583][ T5582] usb_probe_device+0x1c3/0x3b0 [ 204.333599][ T5582] ? __pfx_usb_probe_device+0x10/0x10 [ 204.333612][ T5582] really_probe+0x254/0xae0 [ 204.333627][ T5582] __driver_probe_device+0x1e8/0x360 [ 204.333642][ T5582] driver_probe_device+0x4f/0x240 [ 204.333657][ T5582] __device_attach_driver+0x270/0x410 [ 204.333672][ T5582] bus_for_each_drv+0x25b/0x2f0 [ 204.333688][ T5582] ? __pfx___device_attach_driver+0x10/0x10 [ 204.333701][ T5582] ? __pfx_bus_for_each_drv+0x10/0x10 [ 204.333716][ T5582] ? rt_spin_unlock+0x163/0x200 [ 204.333734][ T5582] __device_attach+0x2c7/0x450 [ 204.333747][ T5582] ? __pfx___device_attach+0x10/0x10 [ 204.333766][ T5582] device_initial_probe+0xa1/0xd0 [ 204.333779][ T5582] bus_probe_device+0x12d/0x220 [ 204.333796][ T5582] device_add+0x7d7/0xb80 [ 204.333809][ T5582] usb_new_device+0x98d/0x1610 [ 204.333818][ T5582] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 204.333832][ T5582] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 204.333846][ T5582] ? __pfx_usb_new_device+0x10/0x10 [ 204.333862][ T5582] hub_event+0x28cf/0x4cf0 [ 204.333907][ T5582] ? __pfx_hub_event+0x10/0x10 [ 204.333924][ T5582] ? rcu_is_watching+0x15/0xb0 [ 204.333938][ T5582] ? process_one_work+0x7fd/0x1480 [ 204.333950][ T5582] process_one_work+0xaaf/0x1480 [ 204.333960][ T5582] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 204.333986][ T5582] ? __pfx_process_one_work+0x10/0x10 [ 204.333996][ T5582] ? do_raw_spin_lock+0x12b/0x2f0 [ 204.334013][ T5582] ? assign_work+0x3cf/0x5d0 [ 204.334027][ T5582] worker_thread+0xb05/0x10d0 [ 204.334052][ T5582] kthread+0x388/0x470 [ 204.334067][ T5582] ? __pfx_worker_thread+0x10/0x10 [ 204.334077][ T5582] ? __pfx_kthread+0x10/0x10 [ 204.334091][ T5582] ret_from_fork+0x514/0xb70 [ 204.334124][ T5582] ? __pfx_ret_from_fork+0x10/0x10 [ 204.334138][ T5582] ? __switch_to+0xc89/0x1420 [ 204.334153][ T5582] ? __pfx_kthread+0x10/0x10 [ 204.334168][ T5582] ret_from_fork_asm+0x1a/0x30 [ 204.334193][ T5582] [ 204.334199][ T5582] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 204.334207][ T5582] CPU: 0 UID: 0 PID: 5582 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 204.334218][ T5582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 204.334224][ T5582] Workqueue: usb_hub_wq hub_event [ 204.334237][ T5582] Call Trace: [ 204.334246][ T5582] [ 204.334250][ T5582] vpanic+0x56c/0xa60 [ 204.334262][ T5582] ? __pfx__printk+0x10/0x10 [ 204.334275][ T5582] ? __pfx_vpanic+0x10/0x10 [ 204.334284][ T5582] ? is_bpf_text_address+0x292/0x2b0 [ 204.334296][ T5582] ? is_bpf_text_address+0x26/0x2b0 [ 204.334312][ T5582] panic+0xc5/0xd0 [ 204.334322][ T5582] ? __pfx_panic+0x10/0x10 [ 204.334338][ T5582] ? ret_from_fork_asm+0x1a/0x30 [ 204.334355][ T5582] __warn+0x315/0x4c0 [ 204.334365][ T5582] ? usb_submit_urb+0x79/0x18b0 [ 204.334376][ T5582] ? usb_submit_urb+0x79/0x18b0 [ 204.334386][ T5582] __report_bug+0x276/0x570 [ 204.334400][ T5582] ? usb_submit_urb+0x79/0x18b0 [ 204.334412][ T5582] ? __pfx___report_bug+0x10/0x10 [ 204.334421][ T5582] ? bus_for_each_drv+0x25b/0x2f0 [ 204.334441][ T5582] ? bus_probe_device+0x12d/0x220 [ 204.334455][ T5582] ? hub_event+0x28cf/0x4cf0 [ 204.334466][ T5582] ? process_one_work+0xaaf/0x1480 [ 204.334476][ T5582] ? worker_thread+0xb05/0x10d0 [ 204.334486][ T5582] ? kthread+0x388/0x470 [ 204.334497][ T5582] ? ret_from_fork+0x514/0xb70 [ 204.334512][ T5582] report_bug_entry+0x19a/0x290 [ 204.334523][ T5582] ? usb_submit_urb+0x7c/0x18b0 [ 204.334532][ T5582] ? usb_submit_urb+0x81/0x18b0 [ 204.334542][ T5582] handle_bug+0xce/0x200 [ 204.334554][ T5582] exc_invalid_op+0x1a/0x50 [ 204.334566][ T5582] asm_exc_invalid_op+0x1a/0x20 [ 204.334576][ T5582] RIP: 0010:usb_submit_urb+0x7c/0x18b0 [ 204.334587][ T5582] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 f9 92 4d fb 49 83 3e 00 74 40 e8 0e 3c e1 fa 48 8d 3d 87 f1 f8 08 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 f3 3b e1 fa eb 05 e8 ec 3b [ 204.334594][ T5582] RSP: 0018:ffffc90004b4eb40 EFLAGS: 00010283 [ 204.334603][ T5582] RAX: ffffffff86e467a2 RBX: ffff888035c38500 RCX: 0000000000100000 [ 204.334610][ T5582] RDX: ffffc900180f8000 RSI: ffff888035c38500 RDI: ffffffff8fdd5930 [ 204.334617][ T5582] RBP: dffffc0000000000 R08: ffffffff8fd0c47f R09: 1ffffffff1fa188f [ 204.334624][ T5582] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff88805ac40c58 [ 204.334631][ T5582] R13: 1ffff1100b58818b R14: ffff888035c38508 R15: 0000000000000cc0 [ 204.334642][ T5582] ? usb_submit_urb+0x72/0x18b0 [ 204.334656][ T5582] ? lockdep_hardirqs_on+0x7a/0x110 [ 204.334666][ T5582] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 204.334676][ T5582] ? mutex_lock_nested+0x152/0x1d0 [ 204.334689][ T5582] ? port100_send_cmd_async+0x6d3/0xcc0 [ 204.334704][ T5582] port100_send_cmd_async+0x84f/0xcc0 [ 204.334724][ T5582] port100_set_command_type+0x1c8/0x390 [ 204.334737][ T5582] ? pcpu_alloc+0x10/0x310 [ 204.334752][ T5582] ? __pfx_port100_set_command_type+0x10/0x10 [ 204.334772][ T5582] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 204.334785][ T5582] port100_probe+0x7b2/0xba0 [ 204.334799][ T5582] ? __pfx_port100_probe+0x10/0x10 [ 204.334813][ T5582] ? __pm_runtime_set_status+0x977/0xc40 [ 204.334830][ T5582] usb_probe_interface+0x788/0xe50 [ 204.334849][ T5582] ? __pfx_usb_probe_interface+0x10/0x10 [ 204.334865][ T5582] ? sysfs_do_create_link_sd+0xe0/0x110 [ 204.334877][ T5582] ? driver_sysfs_add+0x1fe/0x210 [ 204.334890][ T5582] ? __pfx_usb_probe_interface+0x10/0x10 [ 204.334908][ T5582] really_probe+0x254/0xae0 [ 204.334924][ T5582] __driver_probe_device+0x1e8/0x360 [ 204.334938][ T5582] driver_probe_device+0x4f/0x240 [ 204.334952][ T5582] __device_attach_driver+0x270/0x410 [ 204.334968][ T5582] bus_for_each_drv+0x25b/0x2f0 [ 204.334984][ T5582] ? __pfx___device_attach_driver+0x10/0x10 [ 204.334997][ T5582] ? __pfx_bus_for_each_drv+0x10/0x10 [ 204.335013][ T5582] ? rt_spin_unlock+0x163/0x200 [ 204.335031][ T5582] __device_attach+0x2c7/0x450 [ 204.335042][ T5582] ? rt_spin_unlock+0x157/0x200 [ 204.335056][ T5582] ? __pfx___device_attach+0x10/0x10 [ 204.335073][ T5582] device_initial_probe+0xa1/0xd0 [ 204.335086][ T5582] bus_probe_device+0x12d/0x220 [ 204.335103][ T5582] device_add+0x7d7/0xb80 [ 204.335116][ T5582] usb_set_configuration+0x1ad8/0x2180 [ 204.335143][ T5582] usb_generic_driver_probe+0x8d/0x150 [ 204.335158][ T5582] usb_probe_device+0x1c3/0x3b0 [ 204.335173][ T5582] ? __pfx_usb_probe_device+0x10/0x10 [ 204.335185][ T5582] really_probe+0x254/0xae0 [ 204.335211][ T5582] __driver_probe_device+0x1e8/0x360 [ 204.335236][ T5582] driver_probe_device+0x4f/0x240 [ 204.335263][ T5582] __device_attach_driver+0x270/0x410 [ 204.335289][ T5582] bus_for_each_drv+0x25b/0x2f0 [ 204.335318][ T5582] ? __pfx___device_attach_driver+0x10/0x10 [ 204.335334][ T5582] ? __pfx_bus_for_each_drv+0x10/0x10 [ 204.335349][ T5582] ? rt_spin_unlock+0x163/0x200 [ 204.335367][ T5582] __device_attach+0x2c7/0x450 [ 204.335381][ T5582] ? __pfx___device_attach+0x10/0x10 [ 204.335400][ T5582] device_initial_probe+0xa1/0xd0 [ 204.335415][ T5582] bus_probe_device+0x12d/0x220 [ 204.335432][ T5582] device_add+0x7d7/0xb80 [ 204.335445][ T5582] usb_new_device+0x98d/0x1610 [ 204.335455][ T5582] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 204.335468][ T5582] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 204.335482][ T5582] ? __pfx_usb_new_device+0x10/0x10 [ 204.335498][ T5582] hub_event+0x28cf/0x4cf0 [ 204.335537][ T5582] ? __pfx_hub_event+0x10/0x10 [ 204.335554][ T5582] ? rcu_is_watching+0x15/0xb0 [ 204.335566][ T5582] ? process_one_work+0x7fd/0x1480 [ 204.335577][ T5582] process_one_work+0xaaf/0x1480 [ 204.335587][ T5582] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 204.335612][ T5582] ? __pfx_process_one_work+0x10/0x10 [ 204.335621][ T5582] ? do_raw_spin_lock+0x12b/0x2f0 [ 204.335638][ T5582] ? assign_work+0x3cf/0x5d0 [ 204.335651][ T5582] worker_thread+0xb05/0x10d0 [ 204.335675][ T5582] kthread+0x388/0x470 [ 204.335689][ T5582] ? __pfx_worker_thread+0x10/0x10 [ 204.335699][ T5582] ? __pfx_kthread+0x10/0x10 [ 204.335713][ T5582] ret_from_fork+0x514/0xb70 [ 204.335728][ T5582] ? __pfx_ret_from_fork+0x10/0x10 [ 204.335742][ T5582] ? __switch_to+0xc89/0x1420 [ 204.335755][ T5582] ? __pfx_kthread+0x10/0x10 [ 204.335769][ T5582] ret_from_fork_asm+0x1a/0x30 [ 204.335792][ T5582] [ 204.336067][ T5582] Kernel Offset: disabled