last executing test programs: 15.315037659s ago: executing program 4 (id=857): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05000000050000000200000047"], 0x50) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c000000ffbfffff01"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r1}, 0x38) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r2, r0}, 0xc) 15.229668062s ago: executing program 4 (id=859): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000d4e97f49b5b754baebaea54b76", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0xb, 0x5, 0x3fd, 0x9, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x46, 0x0, 0x0) 14.874348673s ago: executing program 2 (id=862): openat$sequencer(0xffffff9c, 0x0, 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) prlimit64(r0, 0xc, &(0x7f0000000180)={0x8, 0x6}, &(0x7f0000000f80)) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r3, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x24, 0x4, 0x8, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x11}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8}]}, 0x24}}, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv6_newrule={0x30, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3001a}, [@FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, 0x30}}, 0x40000) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd708", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2}}}}}}}, 0x0) 11.747115279s ago: executing program 0 (id=865): r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000340)={r0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000480)="d8001c00180081064e81f7050044fd56170d12a0b9b545", 0x17}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r1}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e3, &(0x7f0000000180)={r0, r2}) 11.702816794s ago: executing program 0 (id=866): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x6, @empty}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000040)=0x400ffff, 0x4) recvmmsg(r0, &(0x7f0000002980)=[{{0x0, 0x0, 0x0}, 0x10}], 0x1, 0x2, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x4, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 11.655435603s ago: executing program 2 (id=867): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000c4}, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x24e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x0, 0xffffffff}, 0x0) syz_open_dev$vim2m(0x0, 0x3, 0x2) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x4) socket$inet6(0xa, 0x3, 0x5) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0xfffffffe) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, 0x0, 0x0) ioprio_get$uid(0x3, 0x0) r4 = syz_io_uring_setup(0x5c2, &(0x7f00000003c0)={0x0, 0x2, 0x10, 0x4, 0x219}, &(0x7f0000000180)=0x0, &(0x7f0000000580)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000004c0)=@IORING_OP_TIMEOUT={0xb, 0x49, 0x0, 0x0, 0x4, &(0x7f0000000280)={0x0, 0x989680}, 0x1, 0x40, 0x1}) io_uring_enter(r4, 0x6e2, 0x3900, 0x3, 0x0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f00000002c0)=0x8) 11.552632525s ago: executing program 4 (id=869): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12013f00000000407f04ffff0000000000010902"], 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x800}, 0x9, [0x6, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x8, 0x9, 0x80000d, 0x4, 0x1, 0x5, 0x1, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x4, 0x0, 0x91, 0x0, 0x4, 0x7, 0x2, 0x5, 0x400, 0x7ff7, 0x5, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x3, 0x1, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x6], [0x9, 0x0, 0x6, 0x5f, 0x4, 0xc66, 0xa8a9, 0x73, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x9, 0x4, 0xa, 0x1000, 0x0, 0x200b399, 0x400000, 0x0, 0xfece, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x400, 0xffff58b9, 0x0, 0x4, 0x0, 0x80000, 0x401, 0x46, 0xf1, 0x4, 0x8, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x762, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0xfffff50f, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x2, 0x2e6bf783, 0x80000001, 0xb, 0x2, 0x491, 0x9, 0x6, 0x8, 0x3ff, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x7, 0x5, 0x100, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xffe, 0x100006, 0x8000, 0x404, 0x3e55, 0xff, 0xd0, 0x8, 0x3437, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd80, 0x60a2, 0x17fc, 0x9d26, 0x0, 0x8, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0xfff, 0x9, 0x2, 0x10000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0xbfc, 0x8, 0x7c85, 0x7f, 0x56, 0x40, 0xff, 0x5, 0x7fffffff, 0x7, 0xe, 0x9, 0x81, 0x3, 0x9d86, 0xd, 0xc3c2, 0x8, 0x48f1, 0x2, 0x3, 0x6, 0x80000001, 0x7777, 0x1, 0x2, 0x4, 0xd8ce, 0x0, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000003, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x13ffd, 0x1, 0x1b18]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket(0xa, 0x5, 0x0) dup(r1) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x3, 0xfffffffffffffffe, 0x45, 0x4, 0xbdb], 0xdddd1001, 0x1c4213}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 10.757758922s ago: executing program 0 (id=870): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) close(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 10.313074942s ago: executing program 0 (id=872): close(0xffffffffffffffff) close(0xffffffffffffffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) close(0x3) 9.908226981s ago: executing program 3 (id=873): r0 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r0, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b070102000000", 0x8}], 0x1}, 0x0) socket$kcm(0xf, 0x3, 0x2) 8.93490621s ago: executing program 0 (id=875): openat$sequencer(0xffffff9c, 0x0, 0x2000, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) 8.154514555s ago: executing program 1 (id=876): r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000340)={r0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000480)="d8001c00180081064e81f7050044fd56170d12a0b9b545", 0x17}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r1}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e3, &(0x7f0000000180)={r0, r2}) 8.15413149s ago: executing program 3 (id=877): openat$sequencer(0xffffff9c, 0x0, 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) prlimit64(r0, 0xc, &(0x7f0000000180)={0x8, 0x6}, &(0x7f0000000f80)) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r3, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x24, 0x4, 0x8, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x11}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8}]}, 0x24}}, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv6_newrule={0x30, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3001a}, [@FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, 0x30}}, 0x40000) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd708", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2}}}}}}}, 0x0) 7.048532607s ago: executing program 3 (id=878): r0 = socket(0x840000000002, 0x3, 0xfa) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000005240), 0x4000095, 0x0) 6.97913441s ago: executing program 1 (id=879): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="e80000003f00070100000000fddbdf25027c0000d100378013000300717472283414d6bba91973", @ANYBLOB="82876f"], 0xe8}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f0000000300)={0x2, 0x0, @local}, 0x0, 0x80000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) close(r1) epoll_create1(0x0) socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400"], 0x48) syz_emit_ethernet(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000005580)=""/102392, 0x18ff8) clock_gettime(0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x77359400}}, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000000)=0x166, 0x4) sendmmsg$inet(r3, 0x0, 0x0, 0x4000800) recvfrom(r3, 0x0, 0x0, 0x2101, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000001680)='ns/time\x00') 6.93603986s ago: executing program 2 (id=880): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000000)=@base={0x12, 0x6, 0x8, 0x2}, 0x48) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r0, &(0x7f0000000080), &(0x7f0000000240)=@udp6=r1}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={0x0}}, 0x0) r3 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0xec25, 0x0, 0x0, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x4) fcntl$getown(r2, 0x9) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) 6.881332107s ago: executing program 4 (id=881): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) lsetxattr$security_capability(&(0x7f0000000080)='./file1\x00', &(0x7f00000000c0), 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000004080000000000000003000000000000000000000003000000000000000000000000000002000000000000000000000004"], 0x0, 0x56}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x737, '\x00', 0x0, r3, 0x0, 0x1}, 0x50) 6.136132667s ago: executing program 1 (id=882): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) close(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 5.977056568s ago: executing program 3 (id=883): syz_usb_connect(0x2, 0x0, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x5, 0x6576, 0x9}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r3, 0x100000000) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) syz_clone(0x4000, 0x0, 0x0, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa0402, 0x0) io_setup(0x1, &(0x7f0000002500)) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'team_slave_1\x00'}) sendmsg$nl_route(r4, 0x0, 0x0) 5.680408708s ago: executing program 2 (id=884): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) 4.628345643s ago: executing program 1 (id=885): close(0xffffffffffffffff) close(0xffffffffffffffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x40) close(0x3) 3.609738562s ago: executing program 2 (id=886): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000080)="aefdda9d240300005a90f57f07703aeff0f64ebbee", 0x15}], 0x1) r1 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) prlimit64(0x0, 0x7, &(0x7f0000000100)={0x4, 0x8f}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SG_IO(r1, 0x2285, 0x0) writev(r1, &(0x7f0000000400)=[{&(0x7f0000000080)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000040)="aa1d484ea0000000f7fc08fcd111fbdf23ea32db0e8f21d5bc27bd49eb067a0689fff2a41cfbf0e9d85e44", 0x2b}], 0x2) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000003005740ed0b0011"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) 3.550531016s ago: executing program 1 (id=887): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x5, 0x0) r1 = msgget$private(0x0, 0x200) msgsnd(r1, &(0x7f0000010000)={0x3}, 0x8, 0x0) 3.308844841s ago: executing program 4 (id=888): openat$sequencer(0xffffff9c, 0x0, 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) prlimit64(r0, 0xc, &(0x7f0000000180)={0x8, 0x6}, &(0x7f0000000f80)) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r3, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x24, 0x4, 0x8, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x11}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8}]}, 0x24}}, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv6_newrule={0x30, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3001a}, [@FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, 0x30}}, 0x40000) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd708", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2}}}}}}}, 0x0) 1.841762749s ago: executing program 3 (id=889): r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000340)={r0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000480)="d8001c00180081064e81f7050044fd56170d12a0b9b545", 0x17}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r1}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e3, &(0x7f0000000180)={r0, r2}) 1.475964431s ago: executing program 1 (id=890): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001800dd8d000000ba7e9698ed1fbfa80e000000000002"], 0x3c}}, 0x0) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x27}, 0x62) listen(r0, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_dev$loop(&(0x7f0000000100), 0xfd, 0x12fa80) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000280)={r3, 0x0, {0x0, 0x0, 0x0, 0x32, 0x4000000000001001, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e00", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0x3, 0x16]}}) 1.133099233s ago: executing program 3 (id=891): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0), 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000440)={r2, 0x0, 0x0, 0x0, 0x0, [0x0], [0x0, 0x3, 0x2], [0x0, 0x0, 0x3], [0x4000000, 0xc, 0x0, 0x4]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0xb5}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000005580)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x4) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000080)={r3}) 98.138057ms ago: executing program 2 (id=892): socket$inet(0x2, 0x2, 0x1) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000280)="96fa2c0bff2099297e1c1ea6d53ff4c2f69b32d385f14857ae25047e39555bbacdb216aa20b99d21a3aa5e5775e86006778ec677400377670a3422aa5184ed400cf452f14ef81d20a792091e037ed82c9ee401f0f428bd4951eab88952d04fd3c2201db3378816", 0xfffffdce) vmsplice(r3, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000100)="6bb78afd", 0x4}], 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="e80100000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c000280050001009c7e2507cc7a156f1bbb000000003c0001800c00028005000100000000002c00018014000300ff020d40f799000000000000000000011400040020010000000000000000000000000001080007400000000010000d800c000380060000004e210000080007408000000da800068004000380080002006401010124000380060001004e230000060001004e230000060001004e210000060002004e24000008000200e000000234000380060002004e230000060002004e240000060001004e200000060002004e200000060002004e230000060001004e200000140004000000000000000000000000000000000008000200ac1414aa1400050000000008000167e000000284000e8014000100"/357], 0x1e8}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) tee(r0, r2, 0xfffffffffffffffd, 0x0) close(r0) close(r1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x10, 0x25, &(0x7f0000000b00)=ANY=[@ANYBLOB="1800000081000000000000000700000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000460000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000018140000", @ANYRES32=r2, @ANYBLOB="00ff52f9ab3a1c322c1b8e0fbf0250690b0023000000c90018310000", @ANYRES16=r2, @ANYBLOB="0000000000000000b702000000000000850000008600000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095000000000000008520000002000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x24}, 0x94) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000800000000000000000", @ANYRES32=r6], 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xc, 0xc, &(0x7f00000004c0)=ANY=[@ANYRES32=0x0], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180)=r7, 0x4) socket$nl_generic(0x10, 0x3, 0x10) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_PROTOCOL(r2, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000010601010000000000000000010010040588bc05ab318566"], 0x1c}, 0x1, 0x0, 0x0, 0x8c0}, 0x4000000) sendmsg$netlink(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000020000000000000000030000000a0000000000040101620000"], 0x1c}], 0x1, 0x0, 0x0, 0x20040004}, 0x10) r9 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000006, 0x42073, 0xffffffffffffffff, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r9, 0x400442c8, &(0x7f00000000c0)=ANY=[@ANYRES64=r5]) 87.625477ms ago: executing program 4 (id=893): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socketpair$unix(0x1, 0x2, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r3, 0x2285, 0x0) fcntl$dupfd(r3, 0x0, r3) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r4, 0x0, 0x33, &(0x7f0000000000)=0x80020000, 0x4) 0s ago: executing program 0 (id=894): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, 0x0, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x78}, 0x0) sendmsg$NFC_CMD_DEV_UP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010028bd70000700000002000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x8004) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.88' (ED25519) to the list of known hosts. [ 71.425388][ T5780] cgroup: Unknown subsys name 'net' [ 71.696775][ T5780] cgroup: Unknown subsys name 'cpuset' [ 71.752587][ T5780] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 73.376777][ T5780] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 75.556107][ T5810] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 75.557179][ T5810] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 75.559464][ T5810] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 75.561899][ T5813] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 75.575159][ T5810] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 75.575303][ T5813] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 75.576316][ T5813] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 75.581254][ T5810] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 75.587118][ T5810] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 75.588213][ T5813] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 75.588488][ T5813] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 75.588608][ T5810] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 75.589874][ T5810] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 75.595061][ T5810] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 75.595456][ T5810] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 75.596478][ T5810] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 75.597160][ T5813] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 75.602492][ T5808] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 75.603465][ T5812] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 75.632153][ T5812] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 75.634832][ T5112] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 75.636423][ T5112] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 75.637765][ T5112] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 75.733400][ T5800] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 75.741369][ T5800] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.421010][ T5798] chnl_net:caif_netlink_parms(): no params data found [ 76.436433][ T5796] chnl_net:caif_netlink_parms(): no params data found [ 76.553820][ T5795] chnl_net:caif_netlink_parms(): no params data found [ 76.583356][ T5793] chnl_net:caif_netlink_parms(): no params data found [ 76.608779][ T5794] chnl_net:caif_netlink_parms(): no params data found [ 76.771075][ T5798] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.771748][ T5798] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.786666][ T5798] bridge_slave_0: entered allmulticast mode [ 76.788250][ T5798] bridge_slave_0: entered promiscuous mode [ 76.810736][ T5796] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.810827][ T5796] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.811090][ T5796] bridge_slave_0: entered allmulticast mode [ 76.823166][ T5796] bridge_slave_0: entered promiscuous mode [ 76.844943][ T5798] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.845022][ T5798] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.845291][ T5798] bridge_slave_1: entered allmulticast mode [ 76.846652][ T5798] bridge_slave_1: entered promiscuous mode [ 76.876858][ T5796] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.876976][ T5796] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.877429][ T5796] bridge_slave_1: entered allmulticast mode [ 76.880045][ T5796] bridge_slave_1: entered promiscuous mode [ 77.006484][ T5795] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.006668][ T5795] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.006865][ T5795] bridge_slave_0: entered allmulticast mode [ 77.008417][ T5795] bridge_slave_0: entered promiscuous mode [ 77.041105][ T5798] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.059634][ T5796] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.059930][ T5793] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.060018][ T5793] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.060295][ T5793] bridge_slave_0: entered allmulticast mode [ 77.061653][ T5793] bridge_slave_0: entered promiscuous mode [ 77.066805][ T5795] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.066919][ T5795] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.067062][ T5795] bridge_slave_1: entered allmulticast mode [ 77.069392][ T5795] bridge_slave_1: entered promiscuous mode [ 77.076365][ T5798] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.076681][ T5794] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.076789][ T5794] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.077222][ T5794] bridge_slave_0: entered allmulticast mode [ 77.079559][ T5794] bridge_slave_0: entered promiscuous mode [ 77.100365][ T5796] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.100606][ T5793] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.100716][ T5793] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.103660][ T5793] bridge_slave_1: entered allmulticast mode [ 77.106029][ T5793] bridge_slave_1: entered promiscuous mode [ 77.143857][ T5794] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.143973][ T5794] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.144165][ T5794] bridge_slave_1: entered allmulticast mode [ 77.146813][ T5794] bridge_slave_1: entered promiscuous mode [ 77.256117][ T5795] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.258498][ T5798] team0: Port device team_slave_0 added [ 77.277430][ T5796] team0: Port device team_slave_0 added [ 77.280396][ T5793] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.284761][ T5795] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.287355][ T5798] team0: Port device team_slave_1 added [ 77.291628][ T5794] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.296559][ T5796] team0: Port device team_slave_1 added [ 77.299679][ T5793] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.338517][ T5794] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.713556][ T5805] Bluetooth: hci2: command tx timeout [ 77.713738][ T60] Bluetooth: hci4: command tx timeout [ 77.713875][ T5800] Bluetooth: hci3: command tx timeout [ 77.792138][ T5800] Bluetooth: hci1: command tx timeout [ 77.792144][ T60] Bluetooth: hci0: command tx timeout [ 77.852419][ T5795] team0: Port device team_slave_0 added [ 77.853633][ T5798] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.853645][ T5798] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.853666][ T5798] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.868919][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.868932][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.868955][ T5796] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.875689][ T5793] team0: Port device team_slave_0 added [ 77.877969][ T5795] team0: Port device team_slave_1 added [ 77.879689][ T5798] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.879701][ T5798] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.879724][ T5798] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.881293][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.881304][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.881327][ T5796] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.885845][ T5794] team0: Port device team_slave_0 added [ 77.889330][ T5793] team0: Port device team_slave_1 added [ 77.937077][ T5794] team0: Port device team_slave_1 added [ 78.019662][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.019677][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.019700][ T5795] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.080119][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.080134][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.080157][ T5795] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.081563][ T5793] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.081575][ T5793] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.081597][ T5793] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.084813][ T5794] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.084825][ T5794] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.084848][ T5794] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.119681][ T5794] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.119696][ T5794] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.119720][ T5794] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.121288][ T5793] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.121300][ T5793] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.121329][ T5793] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.153617][ T5798] hsr_slave_0: entered promiscuous mode [ 78.154930][ T5798] hsr_slave_1: entered promiscuous mode [ 78.190931][ T5796] hsr_slave_0: entered promiscuous mode [ 78.192920][ T5796] hsr_slave_1: entered promiscuous mode [ 78.193846][ T5796] debugfs: 'hsr0' already exists in 'hsr' [ 78.193944][ T5796] Cannot create hsr debugfs directory [ 78.349535][ T5794] hsr_slave_0: entered promiscuous mode [ 78.351629][ T5794] hsr_slave_1: entered promiscuous mode [ 78.353482][ T5794] debugfs: 'hsr0' already exists in 'hsr' [ 78.353504][ T5794] Cannot create hsr debugfs directory [ 78.390593][ T5795] hsr_slave_0: entered promiscuous mode [ 78.391397][ T5795] hsr_slave_1: entered promiscuous mode [ 78.391909][ T5795] debugfs: 'hsr0' already exists in 'hsr' [ 78.391931][ T5795] Cannot create hsr debugfs directory [ 78.403577][ T5793] hsr_slave_0: entered promiscuous mode [ 78.404782][ T5793] hsr_slave_1: entered promiscuous mode [ 78.405610][ T5793] debugfs: 'hsr0' already exists in 'hsr' [ 78.405630][ T5793] Cannot create hsr debugfs directory [ 79.277384][ T5798] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 79.309413][ T5798] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 79.327131][ T5798] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 79.377270][ T5798] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 79.474954][ T5796] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 79.511484][ T5796] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 79.548038][ T5796] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 79.578003][ T5796] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 79.691480][ T5794] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 79.738572][ T5794] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 79.758266][ T5794] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 79.792115][ T60] Bluetooth: hci3: command tx timeout [ 79.792146][ T60] Bluetooth: hci4: command tx timeout [ 79.792165][ T60] Bluetooth: hci2: command tx timeout [ 79.831365][ T5794] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 79.872391][ T5800] Bluetooth: hci0: command tx timeout [ 79.882612][ T5800] Bluetooth: hci1: command tx timeout [ 79.944635][ T5795] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.994442][ T5795] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 80.042522][ T5795] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.089135][ T5795] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.206812][ T5793] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.250155][ T5798] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.255322][ T5793] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.304976][ T5793] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.342827][ T5793] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 80.423920][ T5798] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.457977][ T3497] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.458676][ T3497] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.480675][ T5796] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.506353][ T3497] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.506457][ T3497] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.569294][ T5796] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.589491][ T5794] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.606744][ T1305] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.606898][ T1305] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.639268][ T1305] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.639342][ T1305] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.683804][ T5794] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.703936][ T5795] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.716400][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.716596][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.757179][ T3497] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.757949][ T3497] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.808738][ T5795] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.836268][ T5793] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.843716][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.844972][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.877482][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.877717][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.942636][ T5793] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.999023][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.999182][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.058095][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.058254][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.218983][ T5798] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.410429][ T5796] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.515487][ T5794] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.566634][ T5798] veth0_vlan: entered promiscuous mode [ 81.614417][ T5798] veth1_vlan: entered promiscuous mode [ 81.655239][ T31] cfg80211: failed to load regulatory.db [ 81.707290][ T5795] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.797373][ T5796] veth0_vlan: entered promiscuous mode [ 81.882075][ T5800] Bluetooth: hci2: command tx timeout [ 81.882107][ T5800] Bluetooth: hci4: command tx timeout [ 81.882127][ T5800] Bluetooth: hci3: command tx timeout [ 81.890535][ T5796] veth1_vlan: entered promiscuous mode [ 81.954369][ T60] Bluetooth: hci1: command tx timeout [ 81.954385][ T5800] Bluetooth: hci0: command tx timeout [ 81.974558][ T5798] veth0_macvtap: entered promiscuous mode [ 82.006284][ T5798] veth1_macvtap: entered promiscuous mode [ 82.052587][ T5793] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.111836][ T5795] veth0_vlan: entered promiscuous mode [ 82.136455][ T5798] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.138307][ T5796] veth0_macvtap: entered promiscuous mode [ 82.175247][ T5798] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.178735][ T5796] veth1_macvtap: entered promiscuous mode [ 82.200008][ T5795] veth1_vlan: entered promiscuous mode [ 82.213683][ T1305] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.220206][ T1305] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.238296][ T1305] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.255215][ T1305] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.305442][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.374971][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.460448][ T5793] veth0_vlan: entered promiscuous mode [ 82.468334][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.476895][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.495169][ T43] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.507039][ T43] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.525527][ T5795] veth0_macvtap: entered promiscuous mode [ 82.591730][ T5794] veth0_vlan: entered promiscuous mode [ 82.596081][ T5793] veth1_vlan: entered promiscuous mode [ 82.599310][ T5795] veth1_macvtap: entered promiscuous mode [ 82.616330][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.616352][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.741762][ T5794] veth1_vlan: entered promiscuous mode [ 82.786483][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.786502][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.806266][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.851846][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.861496][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.861514][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.909787][ T1305] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.922907][ T1305] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.924781][ T43] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.925812][ T43] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.929371][ T5793] veth0_macvtap: entered promiscuous mode [ 82.995740][ T5793] veth1_macvtap: entered promiscuous mode [ 83.002711][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.002739][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.096592][ T5794] veth0_macvtap: entered promiscuous mode [ 83.225380][ T5794] veth1_macvtap: entered promiscuous mode [ 83.254813][ T5793] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.363992][ T5793] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.401502][ T5794] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.425731][ T64] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.435626][ T64] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.450833][ T64] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.469205][ T64] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.471561][ T5794] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.491311][ T1305] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.491327][ T1305] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.559947][ T64] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.569320][ T64] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.594240][ T5924] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7'. [ 83.609353][ T64] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.779617][ T5931] Zero length message leads to an empty skb [ 83.916865][ T5924] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.936277][ T5924] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.962468][ T5800] Bluetooth: hci3: command tx timeout [ 83.962501][ T5800] Bluetooth: hci4: command tx timeout [ 83.962521][ T5800] Bluetooth: hci2: command tx timeout [ 84.032917][ T5800] Bluetooth: hci0: command tx timeout [ 84.032964][ T60] Bluetooth: hci1: command tx timeout [ 84.444287][ T5924] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 84.448622][ T5924] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 85.420391][ T64] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.614276][ T64] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.703174][ T5949] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10'. [ 85.708851][ T64] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.724473][ T64] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.732849][ T64] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.737473][ T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.737496][ T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.044968][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.044987][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.200972][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.200991][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.281825][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.281843][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.415927][ T1305] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.415948][ T1305] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.013953][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 87.194690][ T5977] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.208722][ T9] usb 4-1: config 0 has no interfaces? [ 87.208758][ T9] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 87.208780][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.229587][ T5977] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.284035][ T9] usb 4-1: config 0 descriptor?? [ 87.397477][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.397496][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.541081][ T5969] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 87.723683][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 87.732022][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 87.742008][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 87.743580][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 87.752011][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 87.762000][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 87.771997][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 87.781996][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 87.792000][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 87.796953][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 88.932383][ T5809] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 89.127252][ T36] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 89.984350][ T5809] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 89.987838][ T5809] usb 1-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 89.987864][ T5809] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.987883][ T5809] usb 1-1: Product: syz [ 89.987896][ T5809] usb 1-1: Manufacturer: syz [ 89.987909][ T5809] usb 1-1: SerialNumber: syz [ 90.046819][ T5809] usb 1-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 90.115315][ T36] usb 5-1: config 128 has an invalid interface number: 148 but max is 0 [ 90.115392][ T36] usb 5-1: config 128 has no interface number 0 [ 90.115421][ T36] usb 5-1: config 128 interface 148 has no altsetting 0 [ 90.127254][ T36] usb 5-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 90.127283][ T36] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.127302][ T36] usb 5-1: Product: syz [ 90.127361][ T36] usb 5-1: Manufacturer: syz [ 90.127375][ T36] usb 5-1: SerialNumber: syz [ 90.403238][ T5809] usb 1-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 90.492456][ T36] usb 5-1: USB disconnect, device number 2 [ 90.547149][ T5809] usb 1-1: USB disconnect, device number 2 [ 90.997910][ T36] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 91.162448][ T36] usb 5-1: config 128 has an invalid interface number: 148 but max is 0 [ 91.162477][ T36] usb 5-1: config 128 has no interface number 0 [ 91.162510][ T36] usb 5-1: config 128 interface 148 has no altsetting 0 [ 91.165642][ T36] usb 5-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 91.165669][ T36] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.165689][ T36] usb 5-1: Product: syz [ 91.165703][ T36] usb 5-1: Manufacturer: syz [ 91.165717][ T36] usb 5-1: SerialNumber: syz [ 91.306984][ T5809] usb 4-1: USB disconnect, device number 2 [ 91.463973][ T36] usb 5-1: USB disconnect, device number 3 [ 93.775689][ T6054] netlink: 4 bytes leftover after parsing attributes in process `syz.4.46'. [ 95.161757][ T6060] use of bytesused == 0 is deprecated and will be removed in the future, [ 95.161772][ T6060] use the actual size instead. [ 102.640281][ T6064] netlink: 28 bytes leftover after parsing attributes in process `syz.3.49'. [ 104.393483][ T6102] netlink: 4 bytes leftover after parsing attributes in process `syz.2.63'. [ 105.579006][ T6112] tipc: Started in network mode [ 105.579037][ T6112] tipc: Node identity ce47003c321, cluster identity 4711 [ 105.579301][ T6112] tipc: Enabled bearer , priority 0 [ 105.631430][ T6116] syzkaller0: entered promiscuous mode [ 105.631454][ T6116] syzkaller0: entered allmulticast mode [ 105.747387][ T6108] netlink: 76 bytes leftover after parsing attributes in process `syz.0.61'. [ 105.790684][ T6098] tipc: Resetting bearer [ 105.958949][ T6098] tipc: Disabling bearer [ 106.672737][ T5782] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 106.802088][ T5782] usb 3-1: device descriptor read/64, error -71 [ 107.652101][ T5782] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 107.686209][ T6143] lo speed is unknown, defaulting to 1000 [ 107.687139][ T6143] lo speed is unknown, defaulting to 1000 [ 107.689003][ T6146] faux_driver vgem: [drm] Unknown color mode 181; guessing buffer size. [ 107.692976][ T6143] lo speed is unknown, defaulting to 1000 [ 107.699924][ T6143] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 107.710128][ T6143] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 107.749140][ T6143] lo speed is unknown, defaulting to 1000 [ 107.752478][ T6143] lo speed is unknown, defaulting to 1000 [ 107.755250][ T6143] lo speed is unknown, defaulting to 1000 [ 107.758074][ T6143] lo speed is unknown, defaulting to 1000 [ 107.760912][ T6143] lo speed is unknown, defaulting to 1000 [ 107.795802][ T5782] usb 3-1: device descriptor read/64, error -71 [ 107.931646][ T5782] usb usb3-port1: attempt power cycle [ 108.532369][ T5782] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 108.568008][ T5782] usb 3-1: device descriptor read/8, error -71 [ 108.671670][ T6155] netlink: 40 bytes leftover after parsing attributes in process `syz.1.80'. [ 108.827749][ T6157] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 108.827777][ T6157] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 1th superblock [ 108.828164][ T6157] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 108.828184][ T6157] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 2th superblock [ 108.962207][ T5782] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 109.067308][ T5782] usb 3-1: device descriptor read/8, error -71 [ 109.222876][ T5782] usb usb3-port1: unable to enumerate USB device [ 110.296447][ T6181] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 112.051983][ T6214] netlink: 40 bytes leftover after parsing attributes in process `syz.2.104'. [ 112.062184][ T5884] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 112.196126][ T5884] usb 4-1: device descriptor read/64, error -71 [ 112.459664][ T5884] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 113.372117][ T5884] usb 4-1: device descriptor read/64, error -71 [ 113.491676][ T5884] usb usb4-port1: attempt power cycle [ 113.608217][ T6233] siw: device registration error -23 [ 114.436858][ T6238] zonefs (nullb0) ERROR: Not a zoned block device [ 114.522106][ T5884] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 114.542773][ T5884] usb 4-1: device descriptor read/8, error -71 [ 114.866594][ T5884] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 117.465294][ T5884] usb 4-1: device descriptor read/8, error -71 [ 117.572460][ T5884] usb usb4-port1: unable to enumerate USB device [ 117.647383][ T6271] netlink: 32 bytes leftover after parsing attributes in process `syz.1.122'. [ 119.259521][ T6302] netlink: 8 bytes leftover after parsing attributes in process `syz.1.132'. [ 121.282190][ T5804] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 121.471415][ T6333] netlink: 8 bytes leftover after parsing attributes in process `syz.4.147'. [ 121.533777][ T5804] usb 1-1: config 128 has an invalid interface number: 148 but max is 0 [ 121.533805][ T5804] usb 1-1: config 128 has no interface number 0 [ 121.533937][ T5804] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 121.533960][ T5804] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 129, changing to 11 [ 121.533986][ T5804] usb 1-1: config 128 interface 148 has no altsetting 0 [ 121.539667][ T5804] usb 1-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 121.539696][ T5804] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.539715][ T5804] usb 1-1: Product: syz [ 121.539728][ T5804] usb 1-1: Manufacturer: syz [ 121.539742][ T5804] usb 1-1: SerialNumber: syz [ 121.873201][ T5804] usb 1-1: USB disconnect, device number 3 [ 122.402090][ T5804] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 122.410133][ T6352] syzkaller0: entered promiscuous mode [ 122.410157][ T6352] syzkaller0: entered allmulticast mode [ 122.562764][ T5804] usb 1-1: Using ep0 maxpacket: 8 [ 122.569031][ T5804] usb 1-1: config index 0 descriptor too short (expected 301, got 41) [ 122.569057][ T5804] usb 1-1: config 16 has an invalid descriptor of length 9, skipping remainder of the config [ 122.569101][ T5804] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 122.569121][ T5804] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 122.569143][ T5804] usb 1-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 122.569184][ T5804] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 122.569205][ T5804] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.620555][ T6358] trusted_key: encrypted_key: master key parameter 'us' is invalid [ 122.675238][ T5804] usbtmc 1-1:16.0: bulk endpoints not found [ 123.804742][ T6377] loop3: detected capacity change from 0 to 7 [ 123.828159][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 123.828226][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 123.854497][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 123.854528][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 123.861701][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 123.861733][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 123.899738][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 123.899770][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 123.900001][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 123.900025][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 123.900210][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 123.900236][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 123.900405][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 123.900429][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 123.900489][ T6377] ldm_validate_partition_table(): Disk read failed. [ 123.900627][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 123.900650][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 123.900816][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 123.900839][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 123.901044][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 123.901065][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 123.901758][ T6377] Dev loop3: unable to read RDB block 0 [ 124.006810][ T808] usb 1-1: USB disconnect, device number 4 [ 124.022096][ T6377] loop3: unable to read partition table [ 124.022304][ T6377] loop3: partition table beyond EOD, truncated [ 124.022344][ T6377] loop_reread_partitions: partition scan of loop3 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 124.611104][ T6398] siw: device registration error -23 [ 128.052661][ T5809] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 128.075540][ T6440] siw: device registration error -23 [ 129.135756][ T5809] usb 1-1: config 128 has an invalid interface number: 148 but max is 0 [ 129.135784][ T5809] usb 1-1: config 128 has no interface number 0 [ 129.135827][ T5809] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 129.135855][ T5809] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 129, changing to 11 [ 129.135881][ T5809] usb 1-1: config 128 interface 148 has no altsetting 0 [ 129.142543][ T5809] usb 1-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 129.142570][ T5809] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.142589][ T5809] usb 1-1: Product: syz [ 129.142601][ T5809] usb 1-1: Manufacturer: syz [ 129.142614][ T5809] usb 1-1: SerialNumber: syz [ 130.465643][ T6427] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.474126][ T6427] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.542556][ T5809] usb 1-1: USB disconnect, device number 5 [ 132.102641][ T9] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 132.254350][ T9] usb 4-1: config 0 has no interfaces? [ 132.254388][ T9] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 132.254411][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.261484][ T9] usb 4-1: config 0 descriptor?? [ 132.267778][ T6494] netlink: 8 bytes leftover after parsing attributes in process `syz.2.197'. [ 132.267806][ T6494] netlink: 8 bytes leftover after parsing attributes in process `syz.2.197'. [ 132.488458][ T6500] netlink: 12 bytes leftover after parsing attributes in process `syz.4.195'. [ 133.162258][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.162348][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.605256][ T6517] warning: `syz.1.202' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 136.243137][ T6548] netlink: 12 bytes leftover after parsing attributes in process `syz.4.213'. [ 136.796809][ T6566] siw: device registration error -23 [ 137.540628][ T6568] siw: device registration error -23 [ 138.280732][ T9] usb 4-1: USB disconnect, device number 7 [ 139.040839][ T6589] siw: device registration error -23 [ 140.129068][ T6598] netlink: 40 bytes leftover after parsing attributes in process `syz.3.230'. [ 140.521709][ T6603] siw: device registration error -23 [ 142.932046][ T9] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 143.106297][ T6634] siw: device registration error -23 [ 144.254106][ T9] usb 3-1: config 128 has an invalid interface number: 148 but max is 0 [ 144.254134][ T9] usb 3-1: config 128 has no interface number 0 [ 144.254178][ T9] usb 3-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 144.254202][ T9] usb 3-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 129, changing to 11 [ 144.254228][ T9] usb 3-1: config 128 interface 148 has no altsetting 0 [ 144.262920][ T9] usb 3-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 144.262948][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.262967][ T9] usb 3-1: Product: syz [ 144.262981][ T9] usb 3-1: Manufacturer: syz [ 144.262995][ T9] usb 3-1: SerialNumber: syz [ 144.572633][ T6639] netlink: 40 bytes leftover after parsing attributes in process `syz.0.243'. [ 144.582146][ T6625] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.590196][ T6625] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.684550][ T6642] capability: warning: `syz.1.244' uses deprecated v2 capabilities in a way that may be insecure [ 144.694214][ T9] usb 3-1: USB disconnect, device number 6 [ 146.722236][ T6669] siw: device registration error -23 [ 147.583537][ T6675] netlink: 40 bytes leftover after parsing attributes in process `syz.3.256'. [ 150.426671][ T6731] tipc: Started in network mode [ 150.426707][ T6731] tipc: Node identity 4acc3df44275, cluster identity 4711 [ 150.426886][ T6731] tipc: Enabled bearer , priority 0 [ 150.430355][ T6731] syzkaller0: entered promiscuous mode [ 150.430379][ T6731] syzkaller0: entered allmulticast mode [ 151.255992][ T6725] tipc: Resetting bearer [ 151.962106][ T808] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 152.144293][ T6725] tipc: Disabling bearer [ 152.153077][ T808] usb 5-1: device descriptor read/64, error -71 [ 152.594561][ T808] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 153.145398][ T808] usb 5-1: device descriptor read/64, error -71 [ 153.259113][ T808] usb usb5-port1: attempt power cycle [ 153.283527][ T5782] tipc: Node number set to 146357748 [ 153.310873][ T6760] syzkaller0: entered promiscuous mode [ 153.310898][ T6760] syzkaller0: entered allmulticast mode [ 153.392178][ T6769] netlink: 76 bytes leftover after parsing attributes in process `syz.3.269'. [ 153.602126][ T808] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 153.622871][ T808] usb 5-1: device descriptor read/8, error -71 [ 153.745745][ T6785] process 'syz.1.275' launched './file0' with NULL argv: empty string added [ 154.585869][ T808] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 154.792110][ T808] usb 5-1: device not accepting address 7, error -71 [ 154.792723][ T808] usb usb5-port1: unable to enumerate USB device [ 157.252746][ T6843] siw: device registration error -23 [ 158.469834][ T6854] netlink: 12 bytes leftover after parsing attributes in process `syz.2.287'. [ 159.433058][ T6865] siw: device registration error -23 [ 160.611703][ T36] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 162.342027][ T36] usb 4-1: device not accepting address 8, error -71 [ 166.677865][ T6927] siw: device registration error -23 [ 182.801484][ T7102] netlink: 12 bytes leftover after parsing attributes in process `syz.0.341'. [ 184.382016][ T7115] siw: device registration error -23 [ 185.713529][ T7136] siw: device registration error -23 [ 186.874928][ T7152] siw: device registration error -23 [ 190.541846][ T7175] siw: device registration error -23 [ 191.479583][ T7177] netlink: 12 bytes leftover after parsing attributes in process `syz.2.357'. [ 194.278511][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.278582][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.646559][ T7217] netlink: 408 bytes leftover after parsing attributes in process `syz.0.371'. [ 197.406992][ T7215] siw: device registration error -23 [ 201.803619][ T5112] Bluetooth: hci0: command 0x0406 tx timeout [ 201.803663][ T5112] Bluetooth: hci2: command 0x0406 tx timeout [ 201.803688][ T5112] Bluetooth: hci3: command 0x0406 tx timeout [ 201.803710][ T5112] Bluetooth: hci1: command 0x0406 tx timeout [ 202.145639][ T7281] netlink: 8 bytes leftover after parsing attributes in process `syz.1.389'. [ 202.217166][ T7286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.389'. [ 202.234014][ T7281] netlink: 8 bytes leftover after parsing attributes in process `syz.1.389'. [ 202.858307][ T7293] netlink: 68 bytes leftover after parsing attributes in process `syz.4.392'. [ 202.895300][ T7292] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 202.895328][ T7292] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 1th superblock [ 202.895475][ T7292] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 202.895493][ T7292] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 2th superblock [ 211.847916][ T7368] siw: device registration error -23 [ 214.741259][ T7379] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 219.797226][ T7419] syzkaller0: entered promiscuous mode [ 219.797254][ T7419] syzkaller0: entered allmulticast mode [ 220.202635][ T7420] netlink: 76 bytes leftover after parsing attributes in process `syz.4.431'. [ 220.556295][ T7431] loop3: detected capacity change from 0 to 7 [ 220.763249][ C1] blk_print_req_error: 10 callbacks suppressed [ 220.763267][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 220.763340][ C1] buffer_io_error: 10 callbacks suppressed [ 220.763350][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 220.872735][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 220.872762][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 220.935350][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 220.935386][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 220.947730][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 220.947763][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 220.981008][ T7435] netlink: 28 bytes leftover after parsing attributes in process `syz.2.436'. [ 220.983491][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 220.983519][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 220.993245][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 220.993274][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 220.998188][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 220.998215][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 221.000510][ T7431] ldm_validate_partition_table(): Disk read failed. [ 221.000691][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 221.000716][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 221.000989][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 221.001014][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 221.001442][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 221.001466][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 221.007220][ T7431] Dev loop3: unable to read RDB block 0 [ 221.018217][ T7431] loop3: unable to read partition table [ 221.018378][ T7431] loop3: partition table beyond EOD, truncated [ 221.018399][ T7431] loop_reread_partitions: partition scan of loop3 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 223.897304][ T7449] syz.3.439 (7449) used greatest stack depth: 18136 bytes left [ 225.989446][ T7482] netlink: 28 bytes leftover after parsing attributes in process `syz.1.451'. [ 226.326454][ T7491] siw: device registration error -23 [ 228.627446][ T7514] overlayfs: overlapping lowerdir path [ 230.597537][ T7537] siw: device registration error -23 [ 233.011073][ T7556] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode [ 233.011111][ T7556] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode [ 233.314556][ T7558] workqueue: Failed to create a rescuer kthread for wq "ceph-completion": -EINTR [ 233.699762][ T7563] netlink: 76 bytes leftover after parsing attributes in process `syz.2.474'. [ 235.126854][ T7587] siw: device registration error -23 [ 235.874873][ T60] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 235.874917][ T60] CPU: 1 UID: 0 PID: 60 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 235.874941][ T60] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 235.874955][ T60] Workqueue: hci3 hci_rx_work [ 235.875005][ T60] Call Trace: [ 235.875016][ T60] [ 235.875025][ T60] dump_stack_lvl+0xe8/0x150 [ 235.875057][ T60] sysfs_create_dir_ns+0x271/0x2a0 [ 235.875079][ T60] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 235.875101][ T60] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 235.875126][ T60] ? rt_spin_unlock+0x160/0x200 [ 235.875149][ T60] kobject_add_internal+0x631/0xd10 [ 235.875186][ T60] kobject_add+0x163/0x240 [ 235.875218][ T60] ? __pfx_kobject_add+0x10/0x10 [ 235.875253][ T60] ? get_device_parent+0x370/0x3a0 [ 235.875284][ T60] device_add+0x408/0xb80 [ 235.875316][ T60] hci_conn_add_sysfs+0xd5/0x210 [ 235.875348][ T60] le_conn_complete_evt+0xf1d/0x1430 [ 235.875381][ T60] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 235.875404][ T60] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 235.875430][ T60] ? lockdep_hardirqs_on+0x7a/0x110 [ 235.875463][ T60] ? skb_pull_data+0xfb/0x200 [ 235.875490][ T60] hci_le_enh_conn_complete_evt+0x189/0x490 [ 235.875514][ T60] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 235.875541][ T60] hci_event_packet+0x7af/0x12c0 [ 235.875574][ T60] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 235.875596][ T60] ? __pfx_hci_event_packet+0x10/0x10 [ 235.875636][ T60] ? hci_send_to_monitor+0xe2/0x590 [ 235.875663][ T60] hci_rx_work+0x3ee/0x1030 [ 235.875693][ T60] ? preempt_schedule_thunk+0x16/0x30 [ 235.875718][ T60] ? process_scheduled_works+0xa0f/0x17a0 [ 235.875743][ T60] process_scheduled_works+0xaec/0x17a0 [ 235.875796][ T60] ? __pfx_process_scheduled_works+0x10/0x10 [ 235.875825][ T60] ? assign_work+0x3d5/0x5e0 [ 235.875854][ T60] worker_thread+0xa50/0xfc0 [ 235.875906][ T60] kthread+0x388/0x470 [ 235.875933][ T60] ? __pfx_worker_thread+0x10/0x10 [ 235.875954][ T60] ? __pfx_kthread+0x10/0x10 [ 235.875981][ T60] ret_from_fork+0x51e/0xb90 [ 235.876008][ T60] ? __pfx_ret_from_fork+0x10/0x10 [ 235.876030][ T60] ? __switch_to+0xc7d/0x1400 [ 235.876055][ T60] ? __pfx_kthread+0x10/0x10 [ 235.876083][ T60] ret_from_fork_asm+0x1a/0x30 [ 235.876128][ T60] [ 235.876157][ T60] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 235.876193][ T60] Bluetooth: hci3: failed to register connection device [ 235.877884][ T5809] libceph: connect (1)[c::]:6789 error -13 [ 235.878533][ T5809] libceph: mon0 (1)[c::]:6789 connect error [ 236.583078][ T5809] libceph: connect (1)[c::]:6789 error -13 [ 236.583279][ T5809] libceph: mon0 (1)[c::]:6789 connect error [ 236.702296][ T6013] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 236.746627][ T7583] ceph: No mds server is up or the cluster is laggy [ 236.852069][ T6013] usb 4-1: Using ep0 maxpacket: 8 [ 236.854785][ T6013] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 236.854840][ T6013] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 236.854862][ T6013] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 236.854886][ T6013] usb 4-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 236.854906][ T6013] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 236.854946][ T6013] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 236.854968][ T6013] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.886457][ T6013] usbtmc 4-1:16.0: bulk endpoints not found [ 236.926137][ T5805] Bluetooth: hci1: connection err: -111 [ 238.463850][ T6013] usb 4-1: USB disconnect, device number 10 [ 238.678649][ T7631] netlink: 408 bytes leftover after parsing attributes in process `syz.3.494'. [ 239.324365][ T7634] siw: device registration error -23 [ 239.524455][ T7643] netlink: 12 bytes leftover after parsing attributes in process `syz.2.493'. [ 242.883038][ T9] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 243.162459][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 243.255705][ T9] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 243.256049][ T9] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 243.256096][ T9] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 243.256142][ T9] usb 5-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 243.256186][ T9] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 243.256363][ T9] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 243.355094][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.439103][ T9] usbtmc 5-1:16.0: bulk endpoints not found [ 244.691356][ T5805] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 244.691380][ T5805] CPU: 1 UID: 0 PID: 5805 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 244.691402][ T5805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 244.691415][ T5805] Workqueue: hci0 hci_rx_work [ 244.691456][ T5805] Call Trace: [ 244.691464][ T5805] [ 244.691472][ T5805] dump_stack_lvl+0xe8/0x150 [ 244.691501][ T5805] sysfs_create_dir_ns+0x271/0x2a0 [ 244.691522][ T5805] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 244.691543][ T5805] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 244.691564][ T5805] ? rt_spin_unlock+0x160/0x200 [ 244.691584][ T5805] kobject_add_internal+0x631/0xd10 [ 244.691617][ T5805] kobject_add+0x163/0x240 [ 244.691643][ T5805] ? __pfx_kobject_add+0x10/0x10 [ 244.691675][ T5805] ? get_device_parent+0x370/0x3a0 [ 244.691705][ T5805] device_add+0x408/0xb80 [ 244.691736][ T5805] hci_conn_add_sysfs+0xd5/0x210 [ 244.691773][ T5805] le_conn_complete_evt+0xf1d/0x1430 [ 244.691804][ T5805] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 244.691824][ T5805] ? irqentry_exit+0x59e/0x620 [ 244.691846][ T5805] ? rcu_is_watching+0x15/0xb0 [ 244.691877][ T5805] ? skb_pull_data+0xfb/0x200 [ 244.691901][ T5805] hci_le_enh_conn_complete_evt+0x189/0x490 [ 244.691922][ T5805] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 244.691950][ T5805] hci_event_packet+0x7af/0x12c0 [ 244.691981][ T5805] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 244.692003][ T5805] ? __pfx_hci_event_packet+0x10/0x10 [ 244.692029][ T5805] ? preempt_schedule_common+0x82/0xd0 [ 244.692052][ T5805] ? preempt_schedule_thunk+0x16/0x30 [ 244.692077][ T5805] ? hci_send_to_monitor+0xe2/0x590 [ 244.692102][ T5805] hci_rx_work+0x3ee/0x1030 [ 244.692130][ T5805] ? preempt_schedule_thunk+0x16/0x30 [ 244.692154][ T5805] ? process_scheduled_works+0xa0f/0x17a0 [ 244.692179][ T5805] process_scheduled_works+0xaec/0x17a0 [ 244.692231][ T5805] ? __pfx_process_scheduled_works+0x10/0x10 [ 244.692260][ T5805] ? assign_work+0x3d5/0x5e0 [ 244.692287][ T5805] worker_thread+0xa50/0xfc0 [ 244.692339][ T5805] kthread+0x388/0x470 [ 244.692365][ T5805] ? __pfx_worker_thread+0x10/0x10 [ 244.692385][ T5805] ? __pfx_kthread+0x10/0x10 [ 244.692412][ T5805] ret_from_fork+0x51e/0xb90 [ 244.692439][ T5805] ? __pfx_ret_from_fork+0x10/0x10 [ 244.692461][ T5805] ? __switch_to+0xc7d/0x1400 [ 244.692486][ T5805] ? __pfx_kthread+0x10/0x10 [ 244.692513][ T5805] ret_from_fork_asm+0x1a/0x30 [ 244.692557][ T5805] [ 244.692762][ T5805] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 244.692804][ T5805] Bluetooth: hci0: failed to register connection device [ 244.783621][ T31] libceph: connect (1)[c::]:6789 error -13 [ 244.783821][ T31] libceph: mon0 (1)[c::]:6789 connect error [ 245.018033][ T7690] ceph: No mds server is up or the cluster is laggy [ 245.054997][ T5809] libceph: connect (1)[c::]:6789 error -13 [ 245.055189][ T5809] libceph: mon0 (1)[c::]:6789 connect error [ 245.088436][ T6013] usb 5-1: USB disconnect, device number 8 [ 245.418542][ T7699] siw: device registration error -23 [ 247.391802][ T7730] loop3: detected capacity change from 0 to 7 [ 247.409389][ C0] blk_print_req_error: 10 callbacks suppressed [ 247.409407][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.409432][ C0] buffer_io_error: 10 callbacks suppressed [ 247.409442][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 247.411600][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.411628][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 247.411860][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.411884][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 247.578991][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.579028][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 247.581281][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.581318][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 247.581581][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.581605][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 247.581818][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.581841][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 247.581922][ T7730] ldm_validate_partition_table(): Disk read failed. [ 247.629168][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.629200][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 247.630078][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.630104][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 247.648780][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 247.648813][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 247.695764][ T7730] Dev loop3: unable to read RDB block 0 [ 247.743870][ T7730] loop3: unable to read partition table [ 247.746983][ T7730] loop3: partition table beyond EOD, truncated [ 247.747003][ T7730] loop_reread_partitions: partition scan of loop3 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 247.865178][ T5805] Bluetooth: hci4: link tx timeout [ 247.865353][ T5805] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 248.605334][ T5805] Bluetooth: hci4: link tx timeout [ 248.605354][ T5805] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 248.636376][ T5805] Bluetooth: hci4: link tx timeout [ 248.636395][ T5805] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 248.828408][ T5805] Bluetooth: hci4: link tx timeout [ 248.828427][ T5805] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.614261][ T5805] Bluetooth: hci4: link tx timeout [ 249.614280][ T5805] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.884998][ T5805] Bluetooth: hci4: link tx timeout [ 249.885017][ T5805] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.952072][ T5805] Bluetooth: hci4: command 0x0406 tx timeout [ 253.424919][ T60] Bluetooth: hci2: connection err: -111 [ 255.163958][ T5873] libceph: connect (1)[c::]:6789 error -13 [ 255.164152][ T5873] libceph: mon0 (1)[c::]:6789 connect error [ 255.190522][ T7834] ceph: No mds server is up or the cluster is laggy [ 256.486046][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.486115][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.069682][ T7861] netlink: 8 bytes leftover after parsing attributes in process `syz.4.540'. [ 258.559440][ T7874] fuse: Bad value for 'group_id' [ 258.559502][ T7874] fuse: Bad value for 'group_id' [ 259.106592][ T7874] netlink: 24 bytes leftover after parsing attributes in process `syz.4.542'. [ 263.226812][ T31] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 263.228740][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 263.405585][ T31] usb 1-1: device descriptor read/64, error -32 [ 263.746644][ T31] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 264.035057][ T31] usb 1-1: Using ep0 maxpacket: 8 [ 264.128791][ T31] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 264.128853][ T31] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 264.128871][ T31] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 264.128884][ T31] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 264.128896][ T31] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 264.128919][ T31] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 264.128931][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 264.454169][ T31] usb 1-1: can't set config #16, error -71 [ 264.471114][ T31] usb 1-1: USB disconnect, device number 7 [ 264.642965][ T7949] netlink: 8 bytes leftover after parsing attributes in process `syz.0.554'. [ 265.159352][ T7949] bridge0: port 2(bridge_slave_1) entered disabled state [ 265.163358][ T7949] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.282055][ T31] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 265.983599][ T31] usb 3-1: config 0 has no interfaces? [ 265.983637][ T31] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 265.983660][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.025382][ T31] usb 3-1: config 0 descriptor?? [ 266.922411][ T7949] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 266.937275][ T7949] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 268.054308][ T8016] netlink: 'syz.1.561': attribute type 4 has an invalid length. [ 269.212644][ T6722] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.214588][ T6722] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.216216][ T6722] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.216255][ T6722] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.693089][ T5873] usb 3-1: USB disconnect, device number 7 [ 275.009198][ T8075] loop3: detected capacity change from 0 to 7 [ 275.194230][ C0] blk_print_req_error: 5 callbacks suppressed [ 275.194268][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 275.194321][ C0] buffer_io_error: 5 callbacks suppressed [ 275.194331][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 275.219295][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 275.219369][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 275.317440][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 275.317483][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 275.318433][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 275.318466][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 275.319711][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 275.319737][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 275.320842][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 275.320868][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 275.324930][ T8075] ldm_validate_partition_table(): Disk read failed. [ 275.325012][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 275.325032][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 275.325412][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 275.325442][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 275.329894][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 275.329925][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 275.333222][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 275.333368][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 275.341431][ T8075] Dev loop3: unable to read RDB block 0 [ 275.438636][ T8075] loop3: unable to read partition table [ 275.438765][ T8075] loop3: partition table beyond EOD, truncated [ 275.438787][ T8075] loop_reread_partitions: partition scan of loop3 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 275.857327][ T8088] netlink: 8 bytes leftover after parsing attributes in process `syz.2.579'. [ 280.318901][ T60] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 280.318963][ T60] CPU: 0 UID: 0 PID: 60 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 280.318989][ T60] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 280.319002][ T60] Workqueue: hci1 hci_rx_work [ 280.319035][ T60] Call Trace: [ 280.319043][ T60] [ 280.319053][ T60] dump_stack_lvl+0xe8/0x150 [ 280.319085][ T60] sysfs_create_dir_ns+0x271/0x2a0 [ 280.319106][ T60] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 280.319130][ T60] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 280.319154][ T60] ? rt_spin_unlock+0x160/0x200 [ 280.319177][ T60] kobject_add_internal+0x631/0xd10 [ 280.319214][ T60] kobject_add+0x163/0x240 [ 280.319247][ T60] ? __pfx_kobject_add+0x10/0x10 [ 280.319282][ T60] ? get_device_parent+0x370/0x3a0 [ 280.319314][ T60] device_add+0x408/0xb80 [ 280.319347][ T60] hci_conn_add_sysfs+0xd5/0x210 [ 280.319377][ T60] le_conn_complete_evt+0xf1d/0x1430 [ 280.319410][ T60] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 280.319433][ T60] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 280.319458][ T60] ? lockdep_hardirqs_on+0x7a/0x110 [ 280.319485][ T60] ? skb_pull_data+0xfb/0x200 [ 280.319512][ T60] hci_le_enh_conn_complete_evt+0x189/0x490 [ 280.319535][ T60] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 280.319562][ T60] hci_event_packet+0x7af/0x12c0 [ 280.319595][ T60] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 280.319617][ T60] ? __pfx_hci_event_packet+0x10/0x10 [ 280.319642][ T60] ? rt_spin_unlock+0x14f/0x200 [ 280.319672][ T60] ? hci_send_to_monitor+0xe2/0x590 [ 280.319699][ T60] hci_rx_work+0x3ee/0x1030 [ 280.319734][ T60] ? process_scheduled_works+0xa0f/0x17a0 [ 280.319758][ T60] process_scheduled_works+0xaec/0x17a0 [ 280.319811][ T60] ? __pfx_process_scheduled_works+0x10/0x10 [ 280.319848][ T60] ? assign_work+0x3d5/0x5e0 [ 280.319876][ T60] worker_thread+0xa50/0xfc0 [ 280.319928][ T60] kthread+0x388/0x470 [ 280.319956][ T60] ? __pfx_worker_thread+0x10/0x10 [ 280.319977][ T60] ? __pfx_kthread+0x10/0x10 [ 280.320005][ T60] ret_from_fork+0x51e/0xb90 [ 280.320032][ T60] ? __pfx_ret_from_fork+0x10/0x10 [ 280.320054][ T60] ? __switch_to+0xc7d/0x1400 [ 280.320079][ T60] ? __pfx_kthread+0x10/0x10 [ 280.320107][ T60] ret_from_fork_asm+0x1a/0x30 [ 280.320152][ T60] [ 280.320246][ T60] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 280.320345][ T60] Bluetooth: hci1: failed to register connection device [ 286.134604][ T8134] siw: device registration error -23 [ 286.189354][ T8139] netlink: 8 bytes leftover after parsing attributes in process `syz.3.592'. [ 286.637439][ T8154] netlink: 'syz.1.596': attribute type 4 has an invalid length. [ 288.510762][ T5809] libceph: connect (1)[c::]:6789 error -13 [ 288.538678][ T5809] libceph: mon0 (1)[c::]:6789 connect error [ 288.547280][ T8174] ceph: No mds server is up or the cluster is laggy [ 289.351411][ T5805] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 289.351460][ T5805] CPU: 1 UID: 0 PID: 5805 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 289.351486][ T5805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 289.351500][ T5805] Workqueue: hci2 hci_rx_work [ 289.351532][ T5805] Call Trace: [ 289.351540][ T5805] [ 289.351550][ T5805] dump_stack_lvl+0xe8/0x150 [ 289.351582][ T5805] sysfs_create_dir_ns+0x271/0x2a0 [ 289.351603][ T5805] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 289.351626][ T5805] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 289.351645][ T5805] ? __rcu_read_unlock+0x83/0xe0 [ 289.351670][ T5805] ? rt_spin_unlock+0x160/0x200 [ 289.351694][ T5805] kobject_add_internal+0x631/0xd10 [ 289.351731][ T5805] kobject_add+0x163/0x240 [ 289.351758][ T5805] ? kobject_put+0x31/0x560 [ 289.351781][ T5805] ? kobject_put+0xab/0x560 [ 289.351808][ T5805] ? __pfx_kobject_add+0x10/0x10 [ 289.351842][ T5805] ? get_device_parent+0x370/0x3a0 [ 289.351874][ T5805] device_add+0x408/0xb80 [ 289.351906][ T5805] hci_conn_add_sysfs+0xd5/0x210 [ 289.351939][ T5805] le_conn_complete_evt+0xf1d/0x1430 [ 289.351969][ T5805] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 289.352000][ T5805] ? skb_pull_data+0xfb/0x200 [ 289.352028][ T5805] hci_le_enh_conn_complete_evt+0x189/0x490 [ 289.352053][ T5805] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 289.352080][ T5805] hci_event_packet+0x7af/0x12c0 [ 289.352113][ T5805] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 289.352135][ T5805] ? __pfx_hci_event_packet+0x10/0x10 [ 289.352162][ T5805] ? preempt_schedule_common+0x82/0xd0 [ 289.352185][ T5805] ? preempt_schedule_thunk+0x16/0x30 [ 289.352241][ T5805] ? hci_send_to_monitor+0xe2/0x590 [ 289.352268][ T5805] hci_rx_work+0x3ee/0x1030 [ 289.352298][ T5805] ? preempt_schedule_thunk+0x16/0x30 [ 289.352323][ T5805] ? process_scheduled_works+0xa0f/0x17a0 [ 289.352348][ T5805] process_scheduled_works+0xaec/0x17a0 [ 289.352401][ T5805] ? __pfx_process_scheduled_works+0x10/0x10 [ 289.352430][ T5805] ? assign_work+0x3d5/0x5e0 [ 289.352457][ T5805] worker_thread+0xa50/0xfc0 [ 289.352509][ T5805] kthread+0x388/0x470 [ 289.352536][ T5805] ? __pfx_worker_thread+0x10/0x10 [ 289.352556][ T5805] ? __pfx_kthread+0x10/0x10 [ 289.352584][ T5805] ret_from_fork+0x51e/0xb90 [ 289.352612][ T5805] ? __pfx_ret_from_fork+0x10/0x10 [ 289.352633][ T5805] ? __switch_to+0xc7d/0x1400 [ 289.352659][ T5805] ? __pfx_kthread+0x10/0x10 [ 289.352687][ T5805] ret_from_fork_asm+0x1a/0x30 [ 289.352731][ T5805] [ 289.353813][ T5805] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 289.354240][ T5805] Bluetooth: hci2: failed to register connection device [ 289.973539][ T5873] libceph: connect (1)[c::]:6789 error -13 [ 289.973722][ T5873] libceph: mon0 (1)[c::]:6789 connect error [ 289.986931][ T8189] ceph: No mds server is up or the cluster is laggy [ 290.217175][ T8197] loop3: detected capacity change from 0 to 7 [ 290.230577][ C0] blk_print_req_error: 10 callbacks suppressed [ 290.230636][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.230663][ C0] buffer_io_error: 10 callbacks suppressed [ 290.230673][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 290.268576][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.268609][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 290.269217][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.269244][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 290.269640][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.269684][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 290.270026][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.270089][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 290.270632][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.270656][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 290.271235][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.271278][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 290.271367][ T8197] ldm_validate_partition_table(): Disk read failed. [ 290.271638][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.271708][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 290.354701][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.354785][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 290.366868][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.366930][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 290.370445][ T8197] Dev loop3: unable to read RDB block 0 [ 290.375882][ T8197] loop3: unable to read partition table [ 290.377511][ T8197] loop3: partition table beyond EOD, truncated [ 290.377597][ T8197] loop_reread_partitions: partition scan of loop3 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 291.202434][ T8215] trusted_key: encrypted_key: keylen parameter is missing [ 291.792400][ T8208] netlink: 8 bytes leftover after parsing attributes in process `syz.1.608'. [ 293.342076][ T5884] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 294.477091][ T5884] usb 5-1: config 128 has an invalid interface number: 148 but max is 0 [ 294.477120][ T5884] usb 5-1: config 128 has no interface number 0 [ 294.477153][ T5884] usb 5-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 294.477171][ T5884] usb 5-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 129, changing to 11 [ 294.477185][ T5884] usb 5-1: config 128 interface 148 has no altsetting 0 [ 294.481767][ T5884] usb 5-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 294.481784][ T5884] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.481795][ T5884] usb 5-1: Product: syz [ 294.481802][ T5884] usb 5-1: Manufacturer: syz [ 294.481809][ T5884] usb 5-1: SerialNumber: syz [ 295.182264][ T5884] usb 5-1: USB disconnect, device number 9 [ 295.289171][ T8249] netlink: 4 bytes leftover after parsing attributes in process `syz.3.620'. [ 295.573870][ T8254] loop3: detected capacity change from 0 to 7 [ 295.591127][ C0] blk_print_req_error: 10 callbacks suppressed [ 295.591163][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.591230][ C0] buffer_io_error: 10 callbacks suppressed [ 295.591240][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 295.592210][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.592269][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 295.593803][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.593829][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 295.595847][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.595912][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 295.597321][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.597382][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 295.602151][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.602178][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 295.610502][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.610549][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 295.610636][ T8254] ldm_validate_partition_table(): Disk read failed. [ 295.620979][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.621008][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 295.637116][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.637163][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 295.651659][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.651757][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 295.664001][ T8254] Dev loop3: unable to read RDB block 0 [ 295.696554][ T8254] loop3: unable to read partition table [ 295.700285][ T8254] loop3: partition table beyond EOD, truncated [ 295.700384][ T8254] loop_reread_partitions: partition scan of loop3 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 295.815144][ T5884] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 296.277128][ T5884] usb 5-1: config 128 has an invalid interface number: 148 but max is 0 [ 296.277169][ T5884] usb 5-1: config 128 has no interface number 0 [ 296.277290][ T5884] usb 5-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 296.277341][ T5884] usb 5-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 129, changing to 11 [ 296.277395][ T5884] usb 5-1: config 128 interface 148 has no altsetting 0 [ 296.672722][ T8256] netlink: 8 bytes leftover after parsing attributes in process `syz.2.623'. [ 296.689098][ T5884] usb 5-1: string descriptor 0 read error: -71 [ 296.689252][ T5884] usb 5-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 296.689274][ T5884] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 296.846037][ T5884] usb 5-1: can't set config #128, error -71 [ 297.683600][ T5884] usb 5-1: USB disconnect, device number 10 [ 299.257540][ T60] Bluetooth: hci4: link tx timeout [ 299.257558][ T60] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 299.257882][ T5805] Bluetooth: hci4: link tx timeout [ 299.257895][ T5805] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 301.312212][ T5805] Bluetooth: hci4: command 0x0406 tx timeout [ 301.678089][ T8330] trusted_key: encrypted_key: keylen parameter is missing [ 303.063001][ T8338] netlink: 'syz.1.644': attribute type 4 has an invalid length. [ 311.313012][ T60] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 314.063183][ T8428] workqueue: Failed to create a rescuer kthread for wq "ceph-completion": -EINTR [ 317.058858][ T8478] evm: overlay not supported [ 317.159048][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.159089][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.993676][ T8498] loop3: detected capacity change from 0 to 7 [ 319.002972][ C1] blk_print_req_error: 10 callbacks suppressed [ 319.002988][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 319.003014][ C1] buffer_io_error: 10 callbacks suppressed [ 319.003024][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 319.003577][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 319.003603][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 319.027138][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 319.027196][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 319.030101][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 319.030130][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 319.030533][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 319.030586][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 319.031081][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 319.031106][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 319.031748][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 319.031790][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 319.031838][ T8498] ldm_validate_partition_table(): Disk read failed. [ 319.032649][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 319.032692][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 319.033294][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 319.033359][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 319.034138][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 319.034189][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 319.036570][ T8498] Dev loop3: unable to read RDB block 0 [ 319.041680][ T8498] loop3: unable to read partition table [ 319.051752][ T8498] loop3: partition table beyond EOD, truncated [ 319.052019][ T8498] loop_reread_partitions: partition scan of loop3 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 326.425056][ T8573] netlink: 8 bytes leftover after parsing attributes in process `syz.1.696'. [ 329.152296][ T8600] netlink: 8 bytes leftover after parsing attributes in process `syz.2.701'. [ 332.230451][ T5805] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 334.280421][ T8656] netlink: 28 bytes leftover after parsing attributes in process `syz.2.717'. [ 338.551654][ T5796] ODEBUG: Out of memory. ODEBUG disabled [ 339.844003][ T8715] netlink: 12 bytes leftover after parsing attributes in process `syz.4.728'. [ 340.112253][ T8718] netlink: 28 bytes leftover after parsing attributes in process `syz.4.729'. [ 342.232213][ T8739] loop3: detected capacity change from 0 to 7 [ 342.275974][ C1] blk_print_req_error: 10 callbacks suppressed [ 342.276005][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.276075][ C1] buffer_io_error: 10 callbacks suppressed [ 342.276086][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 342.276956][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.277004][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 342.282153][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.282218][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 342.309632][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.309726][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 342.327303][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.327362][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 342.329792][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.329853][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 342.330606][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.330661][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 342.330743][ T8739] ldm_validate_partition_table(): Disk read failed. [ 342.352050][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.352137][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 342.372108][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.372136][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 342.402141][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.402172][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 342.412464][ T8739] Dev loop3: unable to read RDB block 0 [ 342.432386][ T8739] loop3: unable to read partition table [ 342.433604][ T8739] loop3: partition table beyond EOD, truncated [ 342.433718][ T8739] loop_reread_partitions: partition scan of loop3 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 344.156573][ T8755] netlink: 28 bytes leftover after parsing attributes in process `syz.2.740'. [ 345.932682][ T8789] siw: device registration error -23 [ 350.412012][ T8822] loop3: detected capacity change from 0 to 7 [ 350.936444][ C1] blk_print_req_error: 10 callbacks suppressed [ 350.936463][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 350.936491][ C1] buffer_io_error: 10 callbacks suppressed [ 350.936501][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.974515][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 350.974546][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.974803][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 350.974828][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 351.927110][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 351.927146][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 351.927548][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 351.927591][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 351.927805][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 351.927829][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 351.928025][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 351.928049][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 351.928125][ T8822] ldm_validate_partition_table(): Disk read failed. [ 351.928239][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 351.928263][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 351.928476][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 351.928500][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 351.928804][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 351.928871][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 351.929216][ T8822] Dev loop3: unable to read RDB block 0 [ 351.932560][ T8822] loop3: unable to read partition table [ 351.932757][ T8822] loop3: partition table beyond EOD, truncated [ 351.932787][ T8822] loop_reread_partitions: partition scan of loop3 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 356.805824][ T8858] siw: device registration error -23 [ 357.042349][ T8860] netlink: 8 bytes leftover after parsing attributes in process `syz.3.770'. [ 358.432250][ T5873] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 358.590199][ T8893] loop3: detected capacity change from 0 to 7 [ 358.593020][ C1] blk_print_req_error: 10 callbacks suppressed [ 358.593036][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 358.593061][ C1] buffer_io_error: 10 callbacks suppressed [ 358.593070][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 358.596941][ T5873] usb 3-1: config 0 has no interfaces? [ 358.596961][ T5873] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 358.596974][ T5873] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 358.599253][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 358.599302][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 358.600538][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 358.600579][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 358.601854][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 358.601915][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 358.699997][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 358.700068][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 358.744283][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 358.744316][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 359.037157][ T8892] siw: device registration error -23 [ 359.059319][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 359.059459][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 359.059546][ T8893] ldm_validate_partition_table(): Disk read failed. [ 359.070293][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 359.070363][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 359.074539][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 359.074606][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 359.089220][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 359.089250][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 359.123886][ T8893] Dev loop3: unable to read RDB block 0 [ 359.189854][ T8893] loop3: unable to read partition table [ 359.191859][ T8893] loop3: partition table beyond EOD, truncated [ 359.192022][ T8893] loop_reread_partitions: partition scan of loop3 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 359.531554][ T5873] usb 3-1: config 0 descriptor?? [ 359.702976][ T8897] siw: device registration error -23 [ 362.206144][ T8914] netlink: 8 bytes leftover after parsing attributes in process `syz.3.786'. [ 362.245353][ T8913] netlink: 8 bytes leftover after parsing attributes in process `syz.3.786'. [ 363.245056][ T5809] usb 3-1: USB disconnect, device number 8 [ 365.103356][ T8945] netlink: 'syz.3.797': attribute type 4 has an invalid length. [ 365.814894][ T5884] lo speed is unknown, defaulting to 1000 [ 365.815063][ T5884] syz0: Port: 1 Link DOWN [ 365.933419][ T8947] siw: device registration error -23 [ 366.082342][ T8950] netlink: 8 bytes leftover after parsing attributes in process `syz.3.799'. [ 371.922919][ T8995] siw: device registration error -23 [ 378.801324][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.801393][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.720633][ T5873] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 380.742878][ T9054] siw: device registration error -23 [ 381.012033][ T5873] usb 4-1: Using ep0 maxpacket: 8 [ 381.252551][ T5873] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 381.252609][ T5873] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 381.252627][ T5873] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 381.252640][ T5873] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 381.252651][ T5873] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 381.252682][ T5873] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 381.252694][ T5873] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.481719][ T5873] usb 4-1: GET_CAPABILITIES returned 0 [ 381.481765][ T5873] usbtmc 4-1:16.0: can't read capabilities [ 381.841482][ T9051] usbtmc 4-1:16.0: usb_control_msg returned -71 [ 381.841621][ T9064] usbtmc 4-1:16.0: send_request_dev_dep_msg_in returned -90 [ 381.845900][ T5873] usb 4-1: USB disconnect, device number 11 [ 381.925708][ T9065] tipc: Enabling of bearer rejected, failed to enable media [ 382.102914][ T9065] syzkaller0: entered promiscuous mode [ 382.102940][ T9065] syzkaller0: entered allmulticast mode [ 385.755220][ T9071] netlink: 76 bytes leftover after parsing attributes in process `syz.4.837'. [ 386.352098][ T31] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 386.548410][ T31] usb 1-1: config 128 has an invalid interface number: 148 but max is 0 [ 386.548489][ T31] usb 1-1: config 128 has no interface number 0 [ 386.548827][ T31] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 386.548853][ T31] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 129, changing to 11 [ 386.548877][ T31] usb 1-1: config 128 interface 148 has no altsetting 0 [ 386.817144][ T31] usb 1-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 386.817174][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.817191][ T31] usb 1-1: Product: syz [ 386.817204][ T31] usb 1-1: Manufacturer: syz [ 386.817216][ T31] usb 1-1: SerialNumber: syz [ 387.175344][ T31] usb 1-1: USB disconnect, device number 8 [ 387.682181][ T31] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 387.925419][ T31] usb 1-1: config 128 has an invalid interface number: 148 but max is 0 [ 387.925448][ T31] usb 1-1: config 128 has no interface number 0 [ 387.925492][ T31] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 387.925515][ T31] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 129, changing to 11 [ 387.925542][ T31] usb 1-1: config 128 interface 148 has no altsetting 0 [ 387.929157][ T31] usb 1-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 387.929183][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.929201][ T31] usb 1-1: Product: syz [ 387.929214][ T31] usb 1-1: Manufacturer: syz [ 387.929226][ T31] usb 1-1: SerialNumber: syz [ 388.425810][ T9116] netlink: 8 bytes leftover after parsing attributes in process `syz.1.849'. [ 388.672581][ T31] usb 1-1: USB disconnect, device number 9 [ 389.801324][ T9120] netlink: 8 bytes leftover after parsing attributes in process `syz.1.851'. [ 391.027639][ T9124] netlink: 12 bytes leftover after parsing attributes in process `syz.3.852'. [ 394.165496][ T9120] bridge0: port 2(bridge_slave_1) entered disabled state [ 394.165717][ T9120] bridge0: port 1(bridge_slave_0) entered disabled state [ 394.881841][ T9160] siw: device registration error -23 [ 395.604316][ T9120] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 395.610046][ T9120] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 397.842201][ T6727] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.844267][ T6727] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.844310][ T6727] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.844343][ T6727] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.262102][ T6013] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 398.414787][ T6013] usb 5-1: config 0 has no interfaces? [ 398.414821][ T6013] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 398.414843][ T6013] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.421566][ T6013] usb 5-1: config 0 descriptor?? [ 398.909014][ T9188] netlink: 8 bytes leftover after parsing attributes in process `syz.0.870'. [ 402.552681][ T5873] usb 5-1: USB disconnect, device number 11 [ 402.624167][ T9216] netlink: 188 bytes leftover after parsing attributes in process `syz.1.879'. [ 403.492439][ T9225] netlink: 8 bytes leftover after parsing attributes in process `syz.1.882'. [ 403.855048][ T9231] siw: device registration error -23 [ 406.291513][ T9246] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 406.291513][ T9246] program syz.2.886 not setting count and/or reply_len properly [ 407.925139][ T9254] siw: device registration error -23 [ 411.558366][ C0] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000025: 0000 [#1] SMP KASAN PTI [ 411.558388][ C0] KASAN: maybe wild-memory-access in range [0xdead000000000128-0xdead00000000012f] [ 411.558413][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 411.558434][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 411.558444][ C0] RIP: 0010:detach_timer+0x120/0x2b0 [ 411.558474][ C0] Code: c1 e8 03 80 3c 28 00 74 08 4c 89 e7 e8 39 bb 78 00 4d 89 3c 24 4d 85 ff 74 46 e8 cb a0 13 00 49 83 c7 08 4c 89 f8 48 c1 e8 03 <80> 3c 28 00 74 08 4c 89 ff e8 12 bb 78 00 4d 89 27 80 7c 24 04 00 [ 411.558489][ C0] RSP: 0018:ffffc90000157af8 EFLAGS: 00010802 [ 411.558506][ C0] RAX: 1bd5a00000000025 RBX: 1ffff1100c29ebe7 RCX: ffff88801cad8000 [ 411.558519][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 [ 411.558530][ C0] RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000100 [ 411.558542][ C0] R10: dffffc0000000000 R11: fffffbfff1e9250f R12: ffffc90000157c08 [ 411.558555][ C0] R13: ffff8880614f5f40 R14: 1ffff1100c29ebe8 R15: dead00000000012a [ 411.558568][ C0] FS: 0000000000000000(0000) GS:ffff888126595000(0000) knlGS:0000000000000000 [ 411.558583][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 411.558595][ C0] CR2: 0000200001000000 CR3: 000000000d9ba000 CR4: 00000000003526f0 [ 411.558611][ C0] Call Trace: [ 411.558622][ C0] [ 411.558632][ C0] __run_timer_base+0x624/0x9f0 [ 411.558659][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 411.558681][ C0] ? __local_bh_disable_ip+0x3c/0x420 [ 411.558702][ C0] ? __local_bh_disable_ip+0x3c/0x420 [ 411.558721][ C0] run_timer_softirq+0xb7/0x170 [ 411.558742][ C0] handle_softirqs+0x1de/0x640 [ 411.558764][ C0] ? smpboot_thread_fn+0x4d/0xa50 [ 411.558784][ C0] run_ktimerd+0x69/0x100 [ 411.558805][ C0] smpboot_thread_fn+0x541/0xa50 [ 411.558826][ C0] ? smpboot_thread_fn+0x4d/0xa50 [ 411.558850][ C0] kthread+0x388/0x470 [ 411.558872][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 411.558891][ C0] ? __pfx_kthread+0x10/0x10 [ 411.558914][ C0] ret_from_fork+0x51e/0xb90 [ 411.558942][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 411.558961][ C0] ? __switch_to+0xc7d/0x1400 [ 411.558981][ C0] ? __pfx_kthread+0x10/0x10 [ 411.558998][ C0] ret_from_fork_asm+0x1a/0x30 [ 411.559021][ C0] [ 411.559029][ C0] Modules linked in: [ 411.559042][ C0] ---[ end trace 0000000000000000 ]--- [ 411.559049][ C0] RIP: 0010:detach_timer+0x120/0x2b0 [ 411.559066][ C0] Code: c1 e8 03 80 3c 28 00 74 08 4c 89 e7 e8 39 bb 78 00 4d 89 3c 24 4d 85 ff 74 46 e8 cb a0 13 00 49 83 c7 08 4c 89 f8 48 c1 e8 03 <80> 3c 28 00 74 08 4c 89 ff e8 12 bb 78 00 4d 89 27 80 7c 24 04 00 [ 411.559076][ C0] RSP: 0018:ffffc90000157af8 EFLAGS: 00010802 [ 411.559087][ C0] RAX: 1bd5a00000000025 RBX: 1ffff1100c29ebe7 RCX: ffff88801cad8000 [ 411.559097][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 [ 411.559105][ C0] RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000100 [ 411.559113][ C0] R10: dffffc0000000000 R11: fffffbfff1e9250f R12: ffffc90000157c08 [ 411.559123][ C0] R13: ffff8880614f5f40 R14: 1ffff1100c29ebe8 R15: dead00000000012a [ 411.559132][ C0] FS: 0000000000000000(0000) GS:ffff888126595000(0000) knlGS:0000000000000000 [ 411.559144][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 411.559153][ C0] CR2: 0000200001000000 CR3: 000000000d9ba000 CR4: 00000000003526f0 [ 411.559169][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 412.630509][ C0] Shutting down cpus with NMI [ 412.630914][ C0] Kernel Offset: disabled