last executing test programs: 13.153348234s ago: executing program 1 (id=577): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x90000000000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f0000000280)="0f01cf66f30f52af0060000066baf80cb808de698aef66bafc0c66b8000066efdbd5b9b50800000f32c4e2aaf5620ff3660f32c4e1fd6f4ed466b8da008ec866baf80cb86481d389ef66bafc0cb8d4600000ef", 0x53}], 0x1, 0x43, 0x0, 0x0) 11.98411779s ago: executing program 1 (id=580): r0 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000040)={'\be \x00', 0x8b, 0x5, 0x2, 0x0, 0x8, "00000000020000000000002100", '\x00', "0052008f", '\x00', ["fdfeffbf84a438dfc5d5c010", "0000000000000400", "0000effdf6ffff0000ff00", "000003cefd70f14003556000"]}) 11.785552087s ago: executing program 1 (id=583): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x1) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x6, &(0x7f0000000200)={0x12, {{0x29, 0x0, 0x3b000000, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x5}}}, 0x88) r2 = socket$netlink(0x10, 0x3, 0x0) syz_open_dev$MSR(&(0x7f0000000180), 0x8, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x11}, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000090000003c0003"], 0x50}}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80800, 0x0) ppoll(&(0x7f00000004c0)=[{r5, 0x80}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDCTL_TMR_SOURCE(r5, 0xc0045406) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fdc01a40f30c74933bbc0000000109021b0001000000000904000001a7a00f00090582020002"], 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'tunl0\x00', &(0x7f00000000c0)={'syztnl1\x00', 0x0, 0x49, 0x8, 0x10, 0x0, {{0x16, 0x4, 0x2, 0x5, 0x58, 0x68, 0x0, 0x7, 0x29, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x29}, {[@generic={0x7, 0x5, "79c56a"}, @timestamp={0x44, 0x10, 0xe4, 0x0, 0x7, [0x5742, 0x2, 0x7]}, @end, @rr={0x7, 0xf, 0x2b, [@multicast2, @rand_addr=0x64010102, @multicast1]}, @timestamp_addr={0x44, 0x14, 0x6a, 0x1, 0x4, [{@local}, {@local, 0x2}]}, @generic={0x83, 0xb, "3dfc733b7c7b15a2d2"}]}}}}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000840), r4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) sendmsg$TIPC_NL_LINK_RESET_STATS(r4, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000040)={&(0x7f0000000a00)=ANY=[@ANYBLOB="0c0500c476c755f4a1d91dc57d00", @ANYRES16, @ANYBLOB="000228bd7000fbdbdf250a000000580104800900010073797a310000000034000780080001001a000000080002005a9d000008000200000000000800020003000000000003000000010008000300030000001300010062726f6164636173742d6c696e6b00001c000780080001000e0000000800040054ffffff08000400400000000c000780080003000400000044000780080004001000000008000300030000000800040006000000080003000900000008000400710f000008000200a21000000800020001000000080002005089000044000780080003000100000008000200f9ffffff08000400000000000800020001000000080004000004000008000400ff010000080003000600000008000400000200000900010073797a30000000004400078008000100130000000800020007000000080002000e0000000800040000000000080004000000000008000200ff03000008000300040000000800020004000000200001800800030002000000130001006574683a69703665727370616e3000002400038008000100030010000800020002000000080002000100000008000300000000002000028008000100080000000800020000ebd93d0800010002000000040004000402068002010300b55d16929b4242caeeafd9cbbc00b4d97b4185e3e2c82f7853395ff477af7c118eeb5d6c7bf18f99f71d9c86c9aa52b46c75a8248571c40c0732d16a632267a303c8bf5e804a137a941cfc1950b26d257c61a4c2624ab8451f4260e5b43cb2c90c032be723115911ae8257b0e9f8cfec572a637eed5ad55c6ca2036bde87e359bdc9a99d174e64123656b2bdc1c0ee17170876ad0935f56486905ae31403387ececcd24c46132b6211ff9ded89dabcc3e3ba82c472a9eafe1e4128f0ea6dffb0919c71a973d603d699abaabd0f0c90c412f8f836e7fd8d8f79fb2050b2f86a8597fa2ac688f3c6e0bc9ee4219517972bbc9c1ad509c4274a4c5722a48b1b0000f300030082b8df4a135cf3d9f799bd27a5cc9d7ab929a9a28795ec3a7f56d80b4f91617458aa6020c4405f073715554aa0f238f6d02824c017a44239c3efb4971bd7403d7edd352aee71b6be44a242c46a400154a54811f82446d6a1782b8a967e275683291c75d51182147431c2b9ebdf6d9b4a7c554bc87afeeca59ec384b5af555be2cc08f2f24cdf41e80c1578ba2219da4d8dfa463d7f28f89b1763b5a0257ec8fd6fb16f0b76aa9fb6bebb5544bbb7ee4bba879d6924d0a8cd95390032b13460c1fc142dfc1cfe5d389b3bf9674d9429c65c754102a3d73f5a1d73630402ea2802447d4e1060d7f511dd80d30ffdb191000800060006000000680005800c00028008000400b40a00001400028007000100696200003c0002800800030009000000080001001b0000000800020017ccffff0800030006000000080002000c0000000800030001000000080004006ea7000004000480b80005803c00028008000200040000000800020001000000080001001e0000000800010016000000080002000800000008000400feffffff0800040008000000040002800c000280080002007f0000002c0002800800040006000000080003000008000008000300df080000080003000500000008000100150000000800010065746800140002800800020009000000080002007f00000007000100696200000800010065746800070001006962000007000100696200003200028004000400040004000800020009000000"], 0x50c}, 0x1, 0x0, 0x0, 0x811}, 0x4000004) mount(&(0x7f0000000080)=@nullb, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000040)='f2fs\x00', 0x0, &(0x7f0000000000)='discard') 11.715233369s ago: executing program 4 (id=584): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) setsockopt$nfc_llcp_NFC_LLCP_RW(r0, 0x118, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) 11.382997719s ago: executing program 3 (id=589): socket$nl_route(0x10, 0x3, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f00000021c0)='devtmpfs\x00', 0x22008d0, 0x0) r0 = getpid() r1 = fsopen(&(0x7f0000000040)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsmount(r1, 0x1, 0x4) pread64(0xffffffffffffffff, 0x0, 0x0, 0x88) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r4, &(0x7f0000000400)=""/4096, 0x1000) 8.74210064s ago: executing program 3 (id=591): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) mknodat$null(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x103) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount$9p_fd(0x0, 0x0, 0x0, 0x200c01, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup3(0xffffffffffffffff, r1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newtaction={0x48, 0x30, 0x871a15abc695fa3d, 0x70bd27, 0x0, {}, [{0x34, 0x1, [@m_pedit={0x30, 0x1, 0x0, 0x0, {{0xa}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r5 = syz_ublk_setup_io_uring(0x31d, &(0x7f00000000c0)={0x0, 0x1073, 0x8, 0x2, 0x152}, 0x0, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_register$IORING_REGISTER_FILE_ALLOC_RANGE(r5, 0x19, &(0x7f0000000200)={0x4, 0x8c9, 0x4}, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000a40)=[@enter_looper], 0x0, 0x0, 0x0}) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000004000/0x3000)=nil) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') read$FUSE(r6, &(0x7f00000102c0)={0x2020}, 0x2020) 7.381175513s ago: executing program 3 (id=594): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) dup(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000300)={0xc9, 0x0, 0xc}) ioctl$KVM_RUN(r2, 0xae80, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000900)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x400a005}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.220315247s ago: executing program 2 (id=596): ioctl$COMEDI_UNLOCK(0xffffffffffffffff, 0x6406) r0 = syz_open_dev$video4linux(&(0x7f0000000200), 0x4, 0x42100) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1f) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0xc, &(0x7f0000000380)=@raw=[@map_fd={0x18, 0x7}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7f}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x25104000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000000)={0x0, 'erspan0\x00', {0x4}, 0x40}) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x12, 0xb, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r4 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) io_uring_enter(r4, 0x2219, 0x34d3, 0x16, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) socket(0x10, 0x803, 0x0) 6.201807319s ago: executing program 2 (id=601): socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102384, 0x18ff0) openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0x88002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000140)="580000001400192340834b80040d8c560a11820fffff5bab4e210000000058000b4824ca945f6400940f6a0325010ebc000000000000008007f0fffeffe809005300fff5dd00000010000100080c100000000000224e0000", 0x58}], 0x1) 5.813380951s ago: executing program 3 (id=603): socket$alg(0x26, 0x5, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xd1, &(0x7f0000000640)=0x3, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x4f}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x7d}, @exit={0x95, 0x0, 0x33}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8000000}, 0x70) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0xa100) ioctl$DVB_DEMUX_DMX_SET_FILTER(r1, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) bind$alg(0xffffffffffffffff, 0x0, 0x0) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f0000000000)={0x4, 0x0, 0x2, 0x11}) read(r1, &(0x7f0000000100)=""/125, 0x7d) preadv(r1, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x2, 0xd) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @hyper}, 0x10) getsockname$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14) r3 = memfd_secret(0x80000) r4 = fsmount(0xffffffffffffffff, 0x1, 0x4) r5 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) fchmodat(r6, &(0x7f00000004c0)='.\x00', 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x17, &(0x7f0000000680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x236, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@map_idx_val={0x18, 0x2, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @alu={0x4, 0x0, 0x1, 0x0, 0x3, 0x50, 0x4}, @cb_func={0x18, 0x5, 0x4, 0x0, 0xfffffffffffffff8}, @alu={0x7, 0x0, 0x3, 0x9, 0x2, 0x0, 0xfffffffffffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000200)='GPL\x00', 0xc, 0x9e, &(0x7f0000000240)=""/158, 0x1e00, 0x41, '\x00', r2, 0x0, r3, 0x8, &(0x7f00000003c0)={0x0, 0x3}, 0x8, 0x10, &(0x7f0000000400)={0x4, 0x6, 0x7, 0x1}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000500)=[0xffffffffffffffff, r0, r4], &(0x7f0000000540)=[{0x0, 0x5, 0x3, 0x3}]}, 0x94) mprotect(&(0x7f000003b000/0x3000)=nil, 0x3000, 0xb) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000040)=0x7, 0x4) socket$inet6_sctp(0xa, 0x5, 0x84) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, 0x0, 0x20008c04) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x8800) 5.578042588s ago: executing program 2 (id=604): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) mknodat$null(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x103) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount$9p_fd(0x0, 0x0, 0x0, 0x200c01, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup3(0xffffffffffffffff, r1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newtaction={0x48, 0x30, 0x871a15abc695fa3d, 0x70bd27, 0x0, {}, [{0x34, 0x1, [@m_pedit={0x30, 0x1, 0x0, 0x0, {{0xa}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r5 = syz_ublk_setup_io_uring(0x31d, &(0x7f00000000c0)={0x0, 0x1073, 0x8, 0x2, 0x152}, 0x0, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_register$IORING_REGISTER_FILE_ALLOC_RANGE(r5, 0x19, &(0x7f0000000200)={0x4, 0x8c9, 0x4}, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000a40)=[@enter_looper], 0x0, 0x0, 0x0}) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000004000/0x3000)=nil) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') read$FUSE(r6, &(0x7f00000102c0)={0x2020}, 0x2020) 5.577900668s ago: executing program 4 (id=605): write$dsp(0xffffffffffffffff, &(0x7f0000000040)="9eb37edd40f05cd9b67baddd880bfc", 0xf) socket$unix(0x1, 0x3, 0x0) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$sock_buf(r0, 0x1, 0x3d, 0x0, &(0x7f0000001e40)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = timerfd_create(0x9, 0x0) timerfd_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timerfd_settime(r1, 0x3, &(0x7f0000000000)={{}, {0x77359400}}, 0x0) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x480, 0x0) readlink(&(0x7f0000000000)='./bus\x00', &(0x7f0000000180)=""/179, 0xb3) 5.480358331s ago: executing program 4 (id=606): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x2, 0x3a) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r2, 0x0, 0x0) write$FUSE_ATTR(r2, &(0x7f0000000100)={0x78, 0x0, 0x0, {0x2000000007, 0x0, 0x0, {0x10000, 0xffffffffffffffff, 0x58, 0xbbf7, 0x400, 0x3, 0x2, 0x0, 0x8000, 0xa000, 0x9fffffff, 0x0, 0x0, 0x0, 0x200, 0x1000000}}}, 0x78) fchown(r0, 0x0, 0xffffffffffffffff) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x1000000, 0x8000, 0x4, 0x2}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x3, 0x0, 0xf, 0x80000006}, 0x0, 0x0) 4.640448637s ago: executing program 2 (id=608): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSETELEM={0x18, 0xc, 0xa, 0x301, 0x0, 0x0, {0xb, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x40}, 0x1, 0x0, 0x0, 0x4000850}, 0x4000050) 4.490389732s ago: executing program 2 (id=609): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x800000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001400add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a04000800ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) r4 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) ftruncate(r4, 0xffff) fcntl$addseals(r4, 0x409, 0x7) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f00000001c0)=0x1) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @none, 0x7ff}, 0xe) socket(0x2, 0x80805, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000100), 0x0, 0x125800) openat$sequencer(0xffffffffffffff9c, 0x0, 0x8002, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 4.277690788s ago: executing program 4 (id=610): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mount(0x0, 0x0, 0x0, 0x44021, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) set_mempolicy(0x8006, 0x0, 0x5) r2 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000001000)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) readv(r2, &(0x7f00000013c0)=[{&(0x7f0000000240)=""/38, 0x26}, {0x0}], 0x2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r3 = syz_io_uring_setup(0x126a, &(0x7f0000000500)={0x0, 0x72de, 0x0, 0x1, 0x3a8}, &(0x7f0000000140), &(0x7f0000000200), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r3, 0x2, &(0x7f0000002d40)={0x0, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r3, 0x18, &(0x7f0000000040)={0x5, r3, 0x3e, {0xe8, 0x3}, 0x7f}, 0x1) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) sendto$inet_nvme_of_msg(0xffffffffffffffff, &(0x7f0000000300)={@r2t={{0x9, 0x2, 0x18, 0x4, 0x7}, 0x4, 0x5, 0x7, 0x5}, @val=&(0x7f00000001c0)="102db0a11b479e12e27b3c92fdf19fd9"}, 0x84, 0x0, 0x0, 0x0) connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r5, 0x400448c8, &(0x7f0000000600)={r4, r4, 0x8, 0x0, 0x0, 0x6, 0xfe, 0x10cf, 0x5, 0x5, 0x2, 0x1, 'syz0\x00'}) unshare(0x0) shutdown(r4, 0x1) r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r6, &(0x7f0000000040)={0x1f, @none, 0x1}, 0xa) r7 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r7, 0x0) recvmmsg(r7, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 3.447450383s ago: executing program 2 (id=611): sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0xfffffffffffffe02, &(0x7f00000002c0)=0x6) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x1a8043, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000140)={0xffff0000, 0x106000}) syz_emit_ethernet(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r5, 0x7003) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)=ANY=[], 0x98}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r7, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040081}, 0x0) io_uring_enter(0xffffffffffffffff, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) r8 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_ADAP_S_LOG_ADDRS(r8, 0xc05c6104, &(0x7f0000000040)={'\be \x00', 0x0, 0x5, 0x2, 0x40000, 0xc, "00000000020000000000002100", '\x00', "0052008f", '\x00', ["fdfeffbf84a438dfc5d5c010", "0000000000000400", "0000efffffffffffbfff00", "000003cefd70f14003556000"]}) ioctl$CEC_ADAP_S_LOG_ADDRS(r8, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x5, 0x0, 0x3, 0x1000006, 'U\x00', "1575a859", "0725eade", '\'q6O', ["aabe8459c62224475793e8a7", "7f9ce2d2c4f439ff80e1d1c8", "fa0700f22b42a3023be516d1"]}) 3.356455106s ago: executing program 3 (id=613): ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, &(0x7f0000000040)={0x8, 0x2036315a, 0x1, @discrete={0xc, 0x9}}) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f00000000c0)={{0x7, 0x0, 0x0, 0x200000, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x3, 0xfffffffffffffffe, 0xfffffffff7fffffe, 0x0, 0x5, 0x0, 0x10000, 0x4, 0x4, 0x0, 0x0, 0x2, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x4, 0x0, 0x6, 0x0, 0x0, 0x6, 0xae4f, 0x0, 0x0, 0x1, 0x0, 0x5f23, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x6, 0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0xfff, 0x3, 0x0, 0x0, 0x95, 0x0, 0x0, 0x9, 0x0, 0xfa0, 0x0, 0xfffffffffffffffb, 0xea4d, 0x377, 0xffffffffffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0x4000, 0x1, 0x3, 0xfffffffffffffffd, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x9, 0x4000000000000, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x3, 0x8000000000000001, 0x4, 0xd30, 0x0, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x71]}) r2 = socket$igmp6(0xa, 0x3, 0x2) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000, &(0x7f0000000540)='\x00') getsockname(r2, &(0x7f00000000c0)=@ieee802154={0x24, @short}, &(0x7f00000001c0)=0x80) userfaultfd(0x1) r3 = userfaultfd(0x80801) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0xfffe, 0x0, @empty, 0x80000001}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r6, 0x29, 0x30, &(0x7f00000007c0)=ANY=[@ANYRESHEX=r5], 0x310) setsockopt$inet6_group_source_req(r6, 0x29, 0x2b, &(0x7f00000005c0)={0x1, {{0xa, 0x0, 0x1, @loopback, 0x5}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, 0x108) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = socket$inet(0x2, 0x7, 0x0) setsockopt$inet_mreqn(r7, 0x0, 0x27, &(0x7f0000000180)={@multicast1, @local}, 0xc) listen(r2, 0x2) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001080)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="01002cbd7000fddbdf2514000000080001000100000008000100020000000c0006"], 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x48800) 3.274045739s ago: executing program 0 (id=614): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0xffffffff, 0x0, 0xb, 0x3}, {0x10000002, 0x20, 0x400084, 0x3}]}, 0x94) r0 = socket$kcm(0x2, 0x1, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) recvmsg$unix(r1, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setresuid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) setsockopt$sock_attach_bpf(r0, 0x84, 0x64, &(0x7f0000000000)=r3, 0x10) 3.23673248s ago: executing program 0 (id=615): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000001c0)=ANY=[], 0x6c}}, 0x2404c844) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="300000001c000104000000000000000002000000", @ANYRES32, @ANYBLOB="f00014000a000100"], 0x30}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924b68, 0x0) 3.073668015s ago: executing program 0 (id=616): write$dsp(0xffffffffffffffff, &(0x7f0000000040)="9eb37edd40f05cd9b67baddd880bfc", 0xf) socket$unix(0x1, 0x3, 0x0) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$sock_buf(r0, 0x1, 0x3d, 0x0, &(0x7f0000001e40)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = timerfd_create(0x9, 0x0) timerfd_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timerfd_settime(r1, 0x3, &(0x7f0000000000)={{}, {0x77359400}}, 0x0) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x480, 0x0) readlink(&(0x7f0000000000)='./bus\x00', &(0x7f0000000180)=""/179, 0xb3) 2.941194659s ago: executing program 0 (id=617): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x84}, 0x800) getpid() r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x49, &(0x7f0000000040)=0x197a, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000280)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r4, &(0x7f0000007580), 0x0, 0x0) process_vm_readv(0x0, &(0x7f0000002480)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1, &(0x7f00000036c0), 0x0, 0x0) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)={0x14c, 0x19, 0x1, 0x0, 0x25dfdbfb, {0x1d, 0xd601, 0x9}, [@nested={0xc, 0x12, 0x0, 0x1, [@nested={0x8, 0xf8, 0x0, 0x1, [@nested={0x4, 0x73}]}]}, @nested={0x12c, 0x6, 0x0, 0x1, [@nested={0x125, 0x15d, 0x0, 0x1, [@typed={0x14, 0xff, 0x0, 0x0, @ipv6=@private1}, @generic="9f2e44c29c0641c8450936814423292d348600cb8fc6a93f9045702b8d959b53a2993ad4f4cff1760ecca0f2dcbd7dbfd409e5d2bbd6ca3a37ef242eaed1a83b50153f1207f4165cfb1b355cb6c211251599df1419a2af866e9f8d1711945331e9585016de3ec722f2cb3b574f31ccb663372ba79fab1de4de4b088727813b671d961455df4687111b95dd1cec631863c81e847fe742afb00a31b82de734d47aed57ee4bdc2ed1b3b48cf873da1480f0a8e7483b59c420", @nested={0x3a, 0x71, 0x0, 0x1, [@typed={0x8, 0x74, 0x0, 0x0, @u32=0x8}, @generic="04d2ac887aacae0289359ce44722ef791d473092e78a6643de39404bf48f3986b7f8a090df94eaef66d89d7516bc"]}, @generic="5580e9ea1fd329573aa5ec250faa97cd1457eb4c1204918fac79"]}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0x5}, 0x0) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x1, 0x20002f5}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@deltfilter={0xe, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x3}, {0x0, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x8010}, 0x0) 2.010132358s ago: executing program 4 (id=618): r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r0, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x4) 1.961008629s ago: executing program 0 (id=619): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='cpuset.effective_mems\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x48815}, 0x800c000) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)) landlock_create_ruleset(&(0x7f0000000040)={0x182, 0x3}, 0x18, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x14) syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0200000004000000080000"], 0x48) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.851976853s ago: executing program 4 (id=620): socket$igmp(0x2, 0x3, 0x2) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) syz_usb_connect$lan78xx(0x4, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='map_files\x00') prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@private2, 0x300, 0x0, 0x2, 0x9, 0x0, 0x4}, 0x20) syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x38, 0x10, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2b24d, 0x11a24}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x408c1}, 0x0) semop(0x0, &(0x7f0000000000)=[{0x1, 0xbbdd, 0x1000}, {0x0, 0x7fff, 0x800}], 0x2) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000005c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001e40)={0x84, 0x0, &(0x7f00000009c0)=[@acquire={0x40046305, 0x2}, @free_buffer, @acquire={0x40046305, 0x1}, @enter_looper, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000900)={@ptr={0x70742a85, 0x0, &(0x7f00000007c0)=""/206, 0xce, 0x1, 0x7}, @ptr={0x70742a85, 0x1, &(0x7f00000008c0)=""/12, 0xc, 0x2, 0x33}, @fda={0x66646185, 0x4}}, &(0x7f0000000980)={0x0, 0x28, 0x50}}}, @increfs_done={0x40106308, 0x1}, @release={0x40046306, 0x3}, @exit_looper], 0x1000, 0x0, &(0x7f0000000e40)="8be4a537917f04e64a48a4d4c91ab464591f679ff1a9faca0d8a8566160bbcf57ae711eb4cc698c9acf03ee46b0f3fe2035c59666a530b56ba79dfbf5d7ca5a74497fb2753cde3bbb893b804f87928099f991842505518e9da32be365699ee79e26d16a318e9b6539bcce128e62f7890a5e8451bce97817300a569adc40b23721df71536e94b3c58d844b543e777b03c2931888b8a8f4c87d9fc5162386815a19cc63f02aa91c9df1c1f5a9e999a023fa94d5370c6d43f3b35f3f2d65577c0f15e9508ee2d5bc35c9595032437986c44eae401dc79c2d1e1c49ef24f5fe5593dba301e56502908d4dbad7b29c971e27d66dc2e51cbc9e6bbe25e5a9307f4f5022da2ce02c6406a7e6d9ba410992dd01a6017b71a2080db768563a8197bc1a9ece0c42e851c5700b6c51a4ae0d5be9dc5877329d0ed4f151838300c840d55fdd8e28810c0cb2e4ac9cc4c7f1eed3203b4976761705fe0973b58e5f8accf9903f8e3508dc699b4dedf64723bdc4008742e0fe587b8c9e10877947231a74a2235a358c716b449a313092b79fb01570921920731381d30bc3b52a59bedcf1bffc70f157b27d3637d855aa4b59511795020a993683ddac870284dd76feb3483c5fa57ec9ac86449a48cec64f598c755dec52a0bfc38f228d48ea410a2d3813d543f09491615389541f7b60fb18b92d6f5191e701434f9d3360f59bc820bedd11461edce063fa7139521108d8b2ce8b2853b531fae87cb178f9d4d30c45ad9ef2725a472953d744d328cec334763c56b1e7909c2bd04398c7ecca52f8a39682f2e84d838cd30e02d4a5b775963ccb8b4c289a90c2ec5cfb9559c093493d18b5b59ec8f993d9ff3f063c7e284fcb9c2c684fd5c174bef7f6f937eec6aead851e7fdfdee1621d0d37f62abb467d2579cb68a043800b22e810855f9ce820b39597dfdb0662a03598ceb1378f4e55d9fe649440867a92dbe77297c665f8d63ebecab67c90316aa0c55c37ec4c41ab998d164fc559f3f31b596fcca178c91cea35dd37851e3212132213e652c66e9c6e6baf8ed90683ad1a29fc7e2c8d1b26113c4fbec96b6e5b016df8a9c162c781621a587d4530b3a2176057c52d057038062815f737699e8279db526dbeb32e334e992715b6c0f887372b6361f13518a2597c2abc55c3339e11354639552a753aab403d911abeab4661ffbaa13063ed5b4f7d3ada9c5b74cda318b1024d40aa5d9a36ab92b744da65157bf73ccda4d462c1534837070de2145d00cd66f4a4407b4caad0f85c285613ff2be23947ae3e4745764f2b462e6c11072faaf521fc61a0229278b80b248cd8b73b86d834fd1d9de0a6e7f4c3cecb836f3582c085bcbd1c83f2cf41f96d9e89e63d537ccf658364b60e2f39a9fae6655e6ff3a0fd443058dcffb66f40b5815593f63de7ab8d201d69501b9bffca6e461a4061d4c3c6d8748728d151b962a1f228ade4fb3eaee9c644ba56a822c40a50386bfaa083f354d9c47b760259d8195211ac58ab47ffcd5b6b526e6b065b5269dac07f72ed6220216b86db8c4e4cd486edbe68b72ef0e2a5f9785173bfe7af1f30d3390cc2493c9029caa59e8fde466d3a5481aad7205cf00b29392decfe6e3e3c5a5f100b80e95aaf18153fd79339b267e5d8ba21579ce401dfadc935dfa5292201f097e0bd446b12d0b267b5d6e1486e02c504c5c5359ec8d848078104c856c7e641c3566d3cd92a1d1f27da85337a8b663ecabf4c5b5a9192729f10dadfbb972e237e2805e2b8de8176df8d2a06095d6ee5433de564e3ee64df9175b355b6fe62a76566e9e30a0bcde46c126a6d3a2d9ce8283acc9d072341df5df1fadd42b784e5d147704a73435afa1c0216b715a9a828ac294d104f0f91a30b209bea3c842582bb71a69c2bb70ae1377189f87c83d74e9c000888315dbb45a4e7ac97d5e4d6683a19e68254c041f5a6b46399c67f98a86612328132b84fc1dcf81e60c0388cc2406e05639b89223effeed585a559afcc5045143342c6c9d46af31b315af7be1f3de4a69248344f60c887e1261718dca330fbce0883d85dab5ec32a9484512f1502456022cfd5746aff5c6b79edd2cf230f782acffe3c72442635bca9808b48cd336effc7a805729acec766feced779576b2c565d282f1dacbcfdf94b1d38f864173faf858776672cdac5f29c1cf2753aec527477d3a0e3b2a82aededdc7fa05d6dd4e7e920f9f283c8cb8074b3800af1a536cae5007172849416e88c15859d4915e059a5ed4ec600f3b0a1e18e22b21d2e3891b3f58bd2a6d101dfd012cce5ac0262d87d0f5a3f1d0f07999ec083d9d196e8f3acc70f16fa186abeb3d2227a492c59770c45be3e422ba51170726c91380a402b50cefde79d354b413f6065d912a9b27535aec9a25612a7c7921f0960654e2ed74c8bc095c320b026f066ea51e9658a386e225e7dec3b2d0987dee8e2c9fc3292602de91e9247fdba99a63831df3e9061756f1641a22bc97f7f11765402fe9b0be3c977b34bd0ae7c9010d0d811381860c16ff8d1856293ef41b92ffdfd29ec753e5e6fce6ebdef8e596403444881499f5d91e0c01b9d3d5e586932be6b0cba30428ab36c91a4a39b4c0be1a38929ab1973c381f84211ce2cf1d9846ae086fb554d94521e5776b71668dfe0da2784082babcfb3603eb94b6f19fdafa50de6df0fefa051398d0ef9e4ec564569bb19173366f01209330c3f21d46d7a4b26727979b61be7614962b79f4e04a7ef4ca9b0dc5717d9df2f0ecf43bdc337a47512a24aa6935a1f473dcf4fad86f561aa8f34a12c1cddc63c778459ed700f92b80b980b7b1662105ad4599dc9c06bab232801963de950280e712d836ff345f4822442c3a44c38eabc9536faca76cf9591f7952d441808e87bc3b1d483b8fd74190d0620f4a9bda430488d2863a2d83500429a0f3513c2dacdcb29596c3c232643c0bc198d9a0434e65149e6eed3b1ffe1da0c71e8580d5e3b590b926a2385390ea5800841a2d12ea5400b193a2ad1e872202680ecc3fb7ef91d6943336b552bb679f87fff4cb3661859a7394b99ae0d02e2deb820d992d502489f6ea86c51471ee1e40c33e872a6ad59f4cb475a0ac36116dc1f56f4d1e8650a14a92d70b6b50d853b74c1d2ea80b020ee9f567aa8e3b6d7fb1f4a00c2671e5ed76e002160c7088382e1683b33d7dea736482c0ffa58cf1172a4513954b44c0fe5ca00365193b5635362652bd0ed6d59c26ce3d5dc68ae44a988627dee8f0d646cc919c3e734e3b0cee1b904addc093bfab23b7e0ae6e993456453432799df6d5215075c85a23132e4fa3d2e225522cb75c30fa46e0264d4222188a3ebb650afd0c8f86537c4fe8cd5e03b501b492ee9d59bb33afb9671271641683a846681392f4cd25a28cf126e9564ef5c826a3cd8abb2b736af9dad00195611d01cdf0355b7ffa27e481919bd232142e4462479a5d3db7a8a0fda70ca0b67cfc5d0c4b87b76e694cbc4fb5a6c6c19a3b903395f2c108d891e4aee3915a0d7347533194a0b9ff89d061fb6ca95d7dabfab4a5f760833b3b4559b1be01fc6f9e18a3466d41dd91aa5a65b10cb388b38b048aaae27039f33ceb8159e3d663faa7a4f0afffc3c9d70202b7a418b408f402bcc8d35ccdca40a500f3581b41861fafe96caea439d85d8324b00c2e281aec08ac563727e28fb2bd562f7b8da32d912e38d4630d6404ee5b655a8e036a7a7d67db18e985b97aaab3fc7fac9bc83ba19f84448970ce0ce5944a0bf14a377480aeb25deb4bf1e6192efaa9f3901bc6dda78a2274025562207feda6cf36e591996e02614f3204d4c96d3647e39e3262f0b794032718d85484e0f0fc30e7ff0c25d0aa0f48604b384a11176b4471b70ed58ed9f380c56c86f53e8de3a016831859023e7eb5b72e144db924b132299995df8b452704c980566dc10159cba0dd41c0ad25420d1c0c8d91074a069bc27a757e22d82210fa84baccca4857d231378daf17d64cfbb20dacbf3fad90f3119865fd950fe339b84943ab43bb0d63e153709da26326ea98189d5a1e82c93dfd46525fff9df89af7253e2fb5226f6ad2c2d953e4eb47ab38a98bd22bb82be4724d0300a445c409c0cb850b47f26fcee7a8b75732ea61051c2f792f9d75f87a8a7f8db9b5e02bfae12113378ef754cc07bf6a6ab08ab074a0bab1921bc5cdcc1c7808a923adbdc65a3011634fc0b396cb6c9066a6b9489616b5320fb790aa6342586322a879f1785cf2400570b4a35c6a5b0e5dca5600964d4f28b168a987bd7017197977040b6eea12ad0f759da543cdfccba90dcfa86f9f27be0e1662fe00d74194bebc0b318d94d37bf7dec399bb41893b10b9b30cb802bc8d925daff63a638c4501f76b07e09c6c0d368fa1a8fd9d6e1611f749b4da993c857ff09d6ccc65ddc20eb546a9942b76aa47b48433d6f185f9de648948da0a31187b1b377c534135bd80f7d59a466e02818ed5e35d44987b4205bd6c1820d68a0b2b0c3a4a8b106ec766409f98063ef48dfc544e8127a2a46b96660b1852dd70d3d18dbe73e16f345099a384edbdd9a5a80df77554d13797f56f853c96427fd4dac560cf6c4f5f070d30ebeb42b864229bc75ac381f59bb7d912d506643c6a430b6f0019a734773139b6e7edcb02ecaf70a79f0f78bda301b0887cd8533e73bfdc1a46bc80447530ec833d11f7c048f4ab9eff1293e600e4666568cc5391d9cd1e8d0e49070b73505ec9e9ac33d12489b1cc2040500cbe7ce5483f7520bf0eb0b9c65a41d3d297324ea1561f4e7e5bf0aa47804a680caaa79e7034f754c6a1b908b192bb20f55066031cb6879a425fc5fde3c4720aae8acee5d45644d14c531bc1c13b66d66edcfe78d715a0a6d16a1a364ee61a9d2cdf800b6ac9678a311fdb4fac7e1d8b7e6df5046b345ea60f781ba089f4fd2845a449883584ea3026676578d3c62359c61e3a989ab54946570d05df21b7d09d54f7165e401b4cf05ee8de52393c533d0b7429718ef30001465e7d7a9a6754e5aff4e29be94097616bbc9d428c6c6ddb9536ababd435399fae6e84222bdbf9534cb00596933c86a70e767a03632ea976d53f63070fde5944af8419d28e41b2a6726781ad2920e94381214d3b1975a7fec023d7f65c4c4ae40bd1bcbf2f630084a1ce63dc5c71ff8eeda619ffc0a97f4b404d3e655a7b6684e8991db0e6752c76617e8c76bdcfc23f9dfeec585b93bbad6e3ad0cfdd405e246db860515162e46374ddf2106f21c97b3f0df09926ec52e60209a28fc0b073fcb6a7c9230430b2f37c0466d368f57c38b1409197bbc17050697b61ca800a1e309e28e9f34db62367f14260405507cd6a1ce11931ec5b025badc2be7c9fdfb3532f5376dba688be7ae0b0e0bfd79a0b53deb6324f0758da3655e4447b3e6e2e553b1064aa3a01c03e132c2b1a3011cc7c1f82494a83fb4748b253be36817e7e3f0c3012415e26af9e128d1976dc154296aef29089d3a8e9e71ea3a0389516ebec2f3192f4da29ee65a1c2d4607235a08957caaed606ebe445f9d1bbe71a6d68bfd7e151b7fed33c664b24b3a3ce26cff75eb6b8aabe307d37eab2dd56606903946427afb8789ce3c76beb1f180f53601e321e7227ac9236b6fba62b94678e6f48d630b7371971545f90a9a713c3b7043a9d6faf7bb6bf50a744e308828aef90be98763e745b2dcc1edb38603621c4db6b84b9e9aa2fb38d9244f0ba3755f6ad9ed53618681706f92e3b2ece29460769e5730aa2225ac4"}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000280)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @multicast2}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x200008c0) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e23, @multicast2}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000000010010000"], 0x18}, 0x10) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) close_range(r3, 0xffffffffffffffff, 0x0) r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a0, 0xc000, 0x8, 0xc4}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\"\x00\x00', @ANYRES32], 0x48) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r5, &(0x7f0000000040)=0x1c8, 0x12) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xb7, 0x9e, 0x69, 0x8, 0x2040, 0xd300, 0x16b3, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1}}]}}, 0x0) epoll_create(0x7) 1.254008921s ago: executing program 1 (id=621): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@deltfilter={0x24, 0x2d, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0xf, 0xfff2}, {0xfff3, 0x2}, {0xfff3, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) 1.158921324s ago: executing program 1 (id=622): r0 = socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0xcd1d, 0x10100, 0x1000000, 0x20000}, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x421, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_FORWARD_DELAY={0x8, 0x1, 0xfffffffe}, @IFLA_BR_STP_STATE={0x8, 0x5, 0x1}]}}}]}, 0x44}}, 0x0) 122.951376ms ago: executing program 1 (id=623): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000009, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x700}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000240)={&(0x7f000088e000/0x1000)=nil, &(0x7f0000a6b000/0x3000)=nil, 0x1000}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, 0x0) 100.186907ms ago: executing program 3 (id=624): socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) socket$netlink(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket(0x10, 0x803, 0x0) socket(0x40000000015, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r1], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x0) 0s ago: executing program 0 (id=625): r0 = socket$netlink(0x10, 0x3, 0x8000000004) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[], 0x270}}, 0x800) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000000)) kernel console output (not intermixed with test programs): .109055][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 67.118447][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 67.127472][ T156] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.135184][ T156] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.144084][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 67.153385][ T4232] Bluetooth: hci1: command 0x041b tx timeout [ 67.159978][ T4232] Bluetooth: hci3: command 0x041b tx timeout [ 67.160447][ T4234] Bluetooth: hci2: command 0x041b tx timeout [ 67.170441][ T4188] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.178216][ T4234] Bluetooth: hci4: command 0x041b tx timeout [ 67.182970][ T4194] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.204944][ T4189] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 67.222978][ T4189] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.236507][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.245047][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 67.255173][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 67.266987][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 67.277509][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 67.287619][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 67.302796][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 67.311364][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 67.320546][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 67.365232][ T4198] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.380581][ T4188] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.392644][ T4210] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 67.404469][ T4210] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 67.421791][ T4210] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 67.430874][ T4210] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 67.440600][ T4210] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 67.450365][ T4210] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 67.459032][ T4210] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 67.468070][ T4210] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.510577][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 67.529222][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 67.552097][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 67.564011][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 67.574495][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 67.588548][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 67.600856][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 67.610152][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 67.619830][ T156] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.627196][ T156] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.636135][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 67.645748][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 67.655578][ T156] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.663081][ T156] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.673391][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 67.681678][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 67.689928][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 67.701683][ T4194] device veth0_vlan entered promiscuous mode [ 67.717839][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 67.739879][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 67.748436][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 67.762341][ T4199] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.774382][ T4199] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 67.800656][ T4189] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.808657][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 67.821305][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 67.853592][ T4194] device veth1_vlan entered promiscuous mode [ 67.869852][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 67.883995][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 67.894397][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 67.905434][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 67.915164][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 67.925528][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 67.935696][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 67.945381][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 67.954673][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.982097][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 67.991757][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 68.000850][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 68.011549][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 68.020375][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 68.043490][ T4194] device veth0_macvtap entered promiscuous mode [ 68.055251][ T4188] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 68.070347][ T4198] device veth0_vlan entered promiscuous mode [ 68.112008][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 68.128140][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 68.137151][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 68.146956][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 68.156888][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 68.167782][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 68.178940][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 68.188477][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 68.198194][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 68.208807][ T4194] device veth1_macvtap entered promiscuous mode [ 68.222885][ T4198] device veth1_vlan entered promiscuous mode [ 68.233221][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 68.241587][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 68.252619][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 68.262473][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 68.288964][ T4189] device veth0_vlan entered promiscuous mode [ 68.317655][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 68.332846][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 68.342668][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 68.358979][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 68.370164][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 68.384675][ T4189] device veth1_vlan entered promiscuous mode [ 68.397153][ T4194] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.410491][ T4199] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.438989][ T4198] device veth0_macvtap entered promiscuous mode [ 68.448009][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 68.457352][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 68.465621][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 68.485392][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 68.498142][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 68.507899][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 68.520378][ T4194] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.549003][ T4198] device veth1_macvtap entered promiscuous mode [ 68.558170][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 68.567219][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 68.575190][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 68.584866][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 68.598312][ T4194] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.612190][ T4194] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.622054][ T4194] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.631261][ T4194] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.651817][ T4189] device veth0_macvtap entered promiscuous mode [ 68.685434][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 68.695515][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 68.705383][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 68.714976][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 68.733722][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 68.776990][ T4189] device veth1_macvtap entered promiscuous mode [ 68.787032][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.800304][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.811748][ T4198] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.838445][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.851940][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.864989][ T4198] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.874337][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 68.887094][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 68.898535][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 68.910861][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 68.919766][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 68.928055][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 68.939114][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 68.960045][ T4188] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.971561][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 68.981546][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 69.008434][ T4198] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.025104][ T4198] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.036419][ T4198] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.047214][ T4198] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.070899][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 69.082685][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 69.098410][ T4199] device veth0_vlan entered promiscuous mode [ 69.130969][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.147032][ T4234] Bluetooth: hci0: command 0x040f tx timeout [ 69.150283][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.171521][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.186199][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.202280][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.229754][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 69.243838][ T4177] Bluetooth: hci4: command 0x040f tx timeout [ 69.247771][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 69.252510][ T4177] Bluetooth: hci2: command 0x040f tx timeout [ 69.269177][ T4177] Bluetooth: hci3: command 0x040f tx timeout [ 69.277233][ T4177] Bluetooth: hci1: command 0x040f tx timeout [ 69.290507][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.308575][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.322209][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.335149][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.349258][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.364931][ T4189] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.375281][ T4189] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.385585][ T4189] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.399691][ T4189] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.450013][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 69.462207][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 69.477894][ T4199] device veth1_vlan entered promiscuous mode [ 69.493081][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.504421][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.532147][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 69.542094][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 69.556272][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 69.596922][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 69.607279][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 69.617849][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 69.630336][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 69.646839][ T4199] device veth0_macvtap entered promiscuous mode [ 69.726146][ T156] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.735466][ T156] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.751161][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 69.761801][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 69.786273][ T4199] device veth1_macvtap entered promiscuous mode [ 69.796190][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.812718][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.837232][ T4188] device veth0_vlan entered promiscuous mode [ 69.846874][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 69.856808][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 69.865310][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 69.877571][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 69.904812][ T4199] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.917088][ T4199] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.929733][ T4199] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.942886][ T4199] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.953865][ T4199] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.965632][ T4199] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.980315][ T4199] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.991904][ T4199] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.005519][ T4199] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.017722][ T4199] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.035015][ T4199] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.045911][ T4199] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.057974][ T4199] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.071530][ T4199] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.090851][ T4188] device veth1_vlan entered promiscuous mode [ 70.100402][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 70.113673][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 70.123479][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 70.134857][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 70.144954][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 70.154857][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 70.164923][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 70.195509][ T3044] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.197409][ T4199] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.216508][ T3044] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.220224][ T4199] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.234290][ T4199] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.244225][ T4199] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.268367][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 70.338803][ T156] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.355297][ T156] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.363484][ T4268] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 70.401521][ T4188] device veth0_macvtap entered promiscuous mode [ 70.413608][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 70.452089][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 70.500481][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 70.511828][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 70.527060][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 70.559503][ T4188] device veth1_macvtap entered promiscuous mode [ 70.604646][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 70.662353][ T150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.806608][ T150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.848853][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.860931][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.875566][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.892772][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.911476][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.931090][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.942173][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.957007][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.977234][ T4188] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.985361][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 70.997733][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 71.013768][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 71.046944][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.059121][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.071951][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.089664][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.101932][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.123455][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.138726][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.156618][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.170527][ T4188] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.190997][ T4188] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.200299][ T4188] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.211298][ T4188] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.227188][ T4188] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.255681][ T156] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.280179][ T156] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.318703][ T4235] Bluetooth: hci0: command 0x0419 tx timeout [ 71.339221][ T4235] Bluetooth: hci1: command 0x0419 tx timeout [ 71.346380][ T4235] Bluetooth: hci3: command 0x0419 tx timeout [ 71.346433][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 71.352914][ T4235] Bluetooth: hci2: command 0x0419 tx timeout [ 71.368998][ T4235] Bluetooth: hci4: command 0x0419 tx timeout [ 71.370022][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 71.388172][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 71.407620][ T156] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.470769][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.475564][ T156] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.478649][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.518592][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 71.722225][ T150] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.766973][ T150] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.124497][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.233455][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.265447][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.725799][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 72.925795][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 73.190242][ T4295] Can't find ip_set type hash:ma [ 73.205815][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 73.218402][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 73.228261][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 73.237511][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 73.247265][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 73.257798][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 73.267580][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 73.285831][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 73.348294][ T4288] process 'syz.3.4' launched './file0' with NULL argv: empty string added [ 73.379687][ T4294] Process accounting resumed [ 73.417598][ T4210] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.616025][ T4308] CUSE: info not properly terminated [ 75.436376][ T1111] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 76.445929][ T1111] usb 3-1: device descriptor read/all, error -71 [ 79.616261][ T13] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 79.833897][ T4337] Can't find ip_set type hash:ma [ 80.166514][ T4345] Process accounting resumed [ 80.567713][ T4351] CUSE: info not properly terminated [ 83.708555][ T4368] Cannot find add_set index 0 as target [ 83.886087][ T4235] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 86.136700][ T4235] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 86.219211][ T4235] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 86.656100][ T4235] usb 2-1: string descriptor 0 read error: -71 [ 86.662671][ T4235] usb 2-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 86.690344][ T4235] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.847059][ T7] cfg80211: failed to load regulatory.db [ 86.886357][ T4235] usb 2-1: can't set config #1, error -71 [ 87.470689][ T4235] usb 2-1: USB disconnect, device number 2 [ 87.572261][ T4395] Process accounting resumed [ 89.561751][ T4417] CUSE: info not properly terminated [ 91.527233][ T4421] Cannot find add_set index 0 as target [ 91.819958][ T4430] netlink: set zone limit has 8 unknown bytes [ 92.982879][ T4235] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 93.376221][ T4235] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.455569][ T4235] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 94.156255][ T4235] usb 1-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 94.175894][ T4235] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.204637][ T4235] usb 1-1: Product: syz [ 94.216172][ T4235] usb 1-1: Manufacturer: syz [ 94.220835][ T4235] usb 1-1: SerialNumber: syz [ 94.383495][ T4444] Process accounting resumed [ 94.648403][ T4235] usb 1-1: unit 4 not found! [ 94.858661][ T4452] tipc: Started in network mode [ 94.886841][ T4452] tipc: Node identity 72b8c3bda795, cluster identity 4711 [ 94.889755][ T4235] usb 1-1: USB disconnect, device number 2 [ 94.901572][ T4452] tipc: Enabled bearer , priority 0 [ 94.932586][ T4455] device syzkaller0 entered promiscuous mode [ 94.978604][ T4452] netlink: 44 bytes leftover after parsing attributes in process `syz.1.51'. [ 95.578266][ T4455] tipc: Resetting bearer [ 95.596024][ T4180] udevd[4180]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 95.688840][ T4451] tipc: Resetting bearer [ 96.009743][ T4463] sctp: failed to load transform for md5: -2 [ 96.273750][ T4451] tipc: Disabling bearer [ 96.447496][ T4473] syz.0.55 uses obsolete (PF_INET,SOCK_PACKET) [ 96.496681][ T13] tipc: Node number set to 3576546237 [ 98.605905][ T4357] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 100.586431][ T4357] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 100.645177][ T4357] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 100.826209][ T4357] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 100.864517][ T4357] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.101652][ T4357] usb 5-1: Product: syz [ 101.106717][ T4357] usb 5-1: Manufacturer: syz [ 101.270602][ T4516] sctp: failed to load transform for md5: -2 [ 101.365140][ T4357] usb 5-1: SerialNumber: syz [ 101.496351][ T4357] usb 5-1: can't set config #1, error -71 [ 101.524420][ T4357] usb 5-1: USB disconnect, device number 3 [ 101.882510][ T4526] tipc: Started in network mode [ 101.953517][ T4526] tipc: Node identity 763b12a8bd87, cluster identity 4711 [ 102.018220][ T4526] tipc: Enabled bearer , priority 0 [ 102.154508][ T4533] device syzkaller0 entered promiscuous mode [ 102.269398][ T4543] Cannot find add_set index 0 as target [ 102.290784][ T4526] tipc: Resetting bearer [ 102.352077][ T4526] tipc: Disabling bearer [ 104.886235][ T4234] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 108.587089][ T4234] usb 4-1: unable to read config index 0 descriptor/all [ 108.594685][ T4234] usb 4-1: can't read configurations, error -71 [ 108.611367][ T4601] Cannot find add_set index 0 as target [ 108.825249][ T4195] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 108.836139][ T4195] CPU: 0 PID: 4195 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 108.844179][ T4195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 108.854539][ T4195] Workqueue: hci4 hci_rx_work [ 108.859781][ T4195] Call Trace: [ 108.863677][ T4195] [ 108.866836][ T4195] dump_stack_lvl+0x188/0x250 [ 108.871837][ T4195] ? show_regs_print_info+0x20/0x20 [ 108.878121][ T4195] ? load_image+0x400/0x400 [ 108.883705][ T4195] sysfs_create_dir_ns+0x26a/0x290 [ 108.890710][ T4195] ? sysfs_warn_dup+0xa0/0xa0 [ 108.897060][ T4195] ? process_one_work+0x85f/0x1010 [ 108.902618][ T4195] ? do_raw_spin_unlock+0x11d/0x230 [ 108.908509][ T4195] kobject_add_internal+0x6e0/0xd90 [ 108.913879][ T4195] kobject_add+0x160/0x230 [ 108.918434][ T4195] ? kobject_init+0x1d0/0x1d0 [ 108.923315][ T4195] ? klist_children_get+0x50/0x50 [ 108.928645][ T4195] ? get_device_parent+0x121/0x3f0 [ 108.934141][ T4195] device_add+0x48c/0x1000 [ 108.938792][ T4195] hci_conn_add_sysfs+0xd1/0x1e0 [ 108.943915][ T4195] le_conn_complete_evt+0xc4b/0x15c0 [ 108.949337][ T4195] ? cs_le_create_conn+0x5e0/0x5e0 [ 108.954616][ T4195] ? __mutex_trylock_common+0x155/0x260 [ 108.960241][ T4195] hci_le_meta_evt+0x285/0x3cb0 [ 108.965299][ T4195] ? hci_event_packet+0x37e/0x1370 [ 108.970623][ T4195] ? __lock_acquire+0x7d10/0x7d10 [ 108.975997][ T4195] ? hci_remote_host_features_evt+0x290/0x290 [ 108.982205][ T4195] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 108.988047][ T4195] ? mark_lock+0x94/0x320 [ 108.992639][ T4195] ? mutex_unlock+0x10/0x10 [ 108.997394][ T4195] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 109.003688][ T4195] ? lock_chain_count+0x20/0x20 [ 109.008663][ T4195] ? __rwlock_init+0x140/0x140 [ 109.014659][ T4195] hci_event_packet+0xe4b/0x1370 [ 109.019874][ T4195] ? lockdep_hardirqs_on+0x94/0x140 [ 109.025293][ T4195] ? rcu_lock_release+0x20/0x20 [ 109.030181][ T4195] ? hci_send_to_monitor+0x9c/0x4a0 [ 109.035654][ T4195] hci_rx_work+0x255/0xa10 [ 109.040242][ T4195] process_one_work+0x85f/0x1010 [ 109.045716][ T4195] ? worker_detach_from_pool+0x240/0x240 [ 109.051491][ T4195] ? lockdep_hardirqs_off+0x70/0x100 [ 109.057263][ T4195] ? _raw_spin_lock_irq+0xb7/0xf0 [ 109.062759][ T4195] ? _raw_spin_lock_irqsave+0x100/0x100 [ 109.068937][ T4195] ? wq_worker_running+0x97/0x170 [ 109.074643][ T4195] worker_thread+0xaa6/0x1290 [ 109.079545][ T4195] ? lockdep_hardirqs_on+0x94/0x140 [ 109.085098][ T4195] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 109.091232][ T4195] kthread+0x436/0x520 [ 109.096026][ T4195] ? rcu_lock_release+0x20/0x20 [ 109.101407][ T4195] ? kthread_blkcg+0xd0/0xd0 [ 109.106032][ T4195] ret_from_fork+0x1f/0x30 [ 109.111547][ T4195] [ 109.132044][ T4195] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 109.146379][ T4195] Bluetooth: hci4: failed to register connection device [ 114.683295][ T4628] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 115.038063][ T4636] netlink: 12 bytes leftover after parsing attributes in process `syz.0.101'. [ 115.192590][ T4232] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 115.485963][ T4232] usb 2-1: Using ep0 maxpacket: 8 [ 115.616083][ T4232] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 115.634834][ T4232] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 115.666597][ T4232] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 115.695840][ T4232] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 115.715828][ T4232] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 115.812195][ T4195] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 115.821977][ T4195] CPU: 0 PID: 4195 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 115.829556][ T4195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 115.839784][ T4195] Workqueue: hci1 hci_rx_work [ 115.844595][ T4195] Call Trace: [ 115.847895][ T4195] [ 115.850858][ T4195] dump_stack_lvl+0x188/0x250 [ 115.855569][ T4195] ? show_regs_print_info+0x20/0x20 [ 115.860909][ T4195] ? load_image+0x400/0x400 [ 115.866011][ T4195] sysfs_create_dir_ns+0x26a/0x290 [ 115.871360][ T4195] ? sysfs_warn_dup+0xa0/0xa0 [ 115.876078][ T4195] ? process_one_work+0x85f/0x1010 [ 115.882098][ T4195] ? do_raw_spin_unlock+0x11d/0x230 [ 115.888059][ T4195] kobject_add_internal+0x6e0/0xd90 [ 115.893360][ T4195] kobject_add+0x160/0x230 [ 115.898220][ T4195] ? kobject_init+0x1d0/0x1d0 [ 115.903425][ T4195] ? klist_children_get+0x50/0x50 [ 115.909023][ T4195] ? get_device_parent+0x121/0x3f0 [ 115.914933][ T4195] device_add+0x48c/0x1000 [ 115.920925][ T4195] hci_conn_add_sysfs+0xd1/0x1e0 [ 115.926987][ T4195] le_conn_complete_evt+0xc4b/0x15c0 [ 115.932608][ T4195] ? cs_le_create_conn+0x5e0/0x5e0 [ 115.938412][ T4195] ? __mutex_trylock_common+0x155/0x260 [ 115.944389][ T4195] hci_le_meta_evt+0x285/0x3cb0 [ 115.949465][ T4195] ? hci_event_packet+0x37e/0x1370 [ 115.954815][ T4195] ? __lock_acquire+0x7d10/0x7d10 [ 115.960237][ T4195] ? hci_remote_host_features_evt+0x290/0x290 [ 115.966391][ T4195] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 115.973091][ T4195] ? mark_lock+0x94/0x320 [ 115.977463][ T4195] ? mutex_unlock+0x10/0x10 [ 115.982107][ T4195] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 115.988513][ T4195] ? lock_chain_count+0x20/0x20 [ 115.994003][ T4195] ? __rwlock_init+0x140/0x140 [ 116.000238][ T4195] hci_event_packet+0xe4b/0x1370 [ 116.007009][ T4195] ? lockdep_hardirqs_on+0x94/0x140 [ 116.014212][ T4195] ? rcu_lock_release+0x20/0x20 [ 116.021307][ T4195] ? hci_send_to_monitor+0x9c/0x4a0 [ 116.027672][ T4195] hci_rx_work+0x255/0xa10 [ 116.032919][ T4195] process_one_work+0x85f/0x1010 [ 116.037953][ T4195] ? worker_detach_from_pool+0x240/0x240 [ 116.044077][ T4195] ? lockdep_hardirqs_off+0x70/0x100 [ 116.049417][ T4195] ? _raw_spin_lock_irq+0xb7/0xf0 [ 116.054739][ T4195] ? _raw_spin_lock_irqsave+0x100/0x100 [ 116.060313][ T4195] ? wq_worker_running+0x97/0x170 [ 116.066594][ T4195] worker_thread+0xaa6/0x1290 [ 116.072554][ T4195] ? lockdep_hardirqs_on+0x94/0x140 [ 116.077975][ T4195] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 116.084434][ T4195] kthread+0x436/0x520 [ 116.088870][ T4195] ? rcu_lock_release+0x20/0x20 [ 116.093845][ T4195] ? kthread_blkcg+0xd0/0xd0 [ 116.098471][ T4195] ret_from_fork+0x1f/0x30 [ 116.102938][ T4195] [ 116.105989][ C0] vkms_vblank_simulate: vblank timer overrun [ 116.125860][ T4195] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 116.140787][ T4195] Bluetooth: hci1: failed to register connection device [ 116.732531][ T4649] block device autoloading is deprecated and will be removed. [ 116.975882][ T1111] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 117.245872][ T1111] usb 1-1: Using ep0 maxpacket: 8 [ 117.366497][ T1111] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 117.576201][ T1111] usb 1-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 117.628470][ T1111] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.694283][ T1111] usb 1-1: Product: syz [ 117.719098][ T1111] usb 1-1: Manufacturer: syz [ 117.739332][ T1111] usb 1-1: SerialNumber: syz [ 118.672630][ T4232] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 118.678322][ T1111] usb 1-1: config 0 descriptor?? [ 118.717106][ T4232] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.967179][ T4232] usb 2-1: can't set config #16, error -71 [ 120.012744][ T1111] msi2500 1-1:0.0: Registered as swradio24 [ 120.022776][ T1111] msi2500 1-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 120.042614][ T1111] usb 1-1: USB disconnect, device number 3 [ 120.068742][ T4232] usb 2-1: USB disconnect, device number 3 [ 120.335399][ T4667] netlink: 'syz.3.109': attribute type 39 has an invalid length. [ 122.296016][ T13] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 122.766172][ T13] usb 5-1: unable to get BOS descriptor or descriptor too short [ 122.806488][ T4695] Cannot find add_set index 0 as target [ 122.876629][ T13] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 238, changing to 7 [ 123.066596][ T13] usb 5-1: New USB device found, idVendor=17cc, idProduct=1000, bcdDevice= 0.40 [ 123.083088][ T13] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.114196][ T13] usb 5-1: Product: syz [ 123.124276][ T13] usb 5-1: Manufacturer: syz [ 123.143165][ T13] usb 5-1: SerialNumber: syz [ 123.306723][ T1111] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 123.345969][ T13] snd-usb-audio: probe of 5-1:1.0 failed with error -71 [ 123.390617][ T13] snd-usb-audio: probe of 5-1:1.1 failed with error -71 [ 123.436663][ T13] snd-usb-audio: probe of 5-1:1.2 failed with error -71 [ 123.453777][ T13] usb 5-1: USB disconnect, device number 4 [ 123.645927][ T1111] usb 1-1: Using ep0 maxpacket: 8 [ 123.722344][ T151] block nbd3: Attempted send on invalid socket [ 123.730175][ T151] blk_update_request: I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 123.745056][ T4705] SQUASHFS error: Failed to read block 0x0: -5 [ 123.753397][ T4705] unable to read squashfs_super_block [ 124.109831][ T1111] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 124.356637][ T1111] usb 1-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 124.419647][ T1111] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.014193][ T1111] usb 1-1: Product: syz [ 125.029069][ T1111] usb 1-1: Manufacturer: syz [ 125.033831][ T1111] usb 1-1: SerialNumber: syz [ 125.092471][ T1111] usb 1-1: config 0 descriptor?? [ 126.258925][ T4726] sctp: failed to load transform for md5: -2 [ 126.473688][ T1111] msi2500 1-1:0.0: Registered as swradio24 [ 126.480720][ T1111] msi2500 1-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 126.493878][ T1111] usb 1-1: USB disconnect, device number 4 [ 127.135890][ T1111] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 127.744980][ T151] block nbd4: Attempted send on invalid socket [ 127.777155][ T151] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 127.821865][ T4757] SQUASHFS error: Failed to read block 0x0: -5 [ 127.828272][ T4757] unable to read squashfs_super_block [ 128.059766][ T1111] usb 1-1: unable to get BOS descriptor or descriptor too short [ 128.156174][ T1111] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 238, changing to 7 [ 129.185978][ T1111] usb 1-1: New USB device found, idVendor=17cc, idProduct=1000, bcdDevice= 0.40 [ 129.210832][ T1111] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.343480][ T1111] usb 1-1: Product: syz [ 129.348776][ T1111] usb 1-1: Manufacturer: syz [ 129.355923][ T1111] usb 1-1: SerialNumber: syz [ 130.285966][ T1111] snd-usb-audio: probe of 1-1:1.0 failed with error -71 [ 130.463777][ T4781] sctp: failed to load transform for md5: -2 [ 130.470905][ T4432] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 130.832301][ T1111] snd-usb-audio: probe of 1-1:1.1 failed with error -71 [ 130.914739][ T1111] snd-usb-audio: probe of 1-1:1.2 failed with error -71 [ 130.965027][ T4432] usb 4-1: Using ep0 maxpacket: 8 [ 131.016812][ T1111] usb 1-1: USB disconnect, device number 5 [ 131.316397][ T4432] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 131.768122][ T26] audit: type=1326 audit(1780957007.903:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4793 comm="syz.4.147" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f257e499e59 code=0x0 [ 131.865254][ T4432] usb 4-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 131.888846][ T4432] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.906627][ T4432] usb 4-1: Product: syz [ 131.915871][ T4432] usb 4-1: Manufacturer: syz [ 131.921101][ T4432] usb 4-1: SerialNumber: syz [ 131.989870][ T4807] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x0000000000000065' [ 132.002559][ T4432] usb 4-1: config 0 descriptor?? [ 132.094359][ T4809] netlink: 12 bytes leftover after parsing attributes in process `syz.2.151'. [ 132.104810][ T4809] netlink: 'syz.2.151': attribute type 2 has an invalid length. [ 132.115612][ T4809] netlink: 'syz.2.151': attribute type 1 has an invalid length. [ 132.176400][ T4809] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 132.184813][ T4809] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 132.194102][ T4809] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 132.556423][ T4804] netlink: 12 bytes leftover after parsing attributes in process `syz.4.150'. [ 132.910759][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.917267][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.983175][ T4432] msi2500 4-1:0.0: Registered as swradio24 [ 133.014830][ T4432] msi2500 4-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 133.277944][ T4432] usb 4-1: USB disconnect, device number 4 [ 137.397270][ T4177] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 137.647546][ T264] block nbd3: Attempted send on invalid socket [ 137.654305][ T264] blk_update_request: I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 137.667375][ T4177] usb 3-1: Using ep0 maxpacket: 8 [ 137.667695][ T4870] SQUASHFS error: Failed to read block 0x0: -5 [ 137.679828][ T4870] unable to read squashfs_super_block [ 137.986206][ T4177] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 138.347083][ T4177] usb 3-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 138.925440][ T4177] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.935856][ T4177] usb 3-1: Product: syz [ 138.940126][ T4177] usb 3-1: Manufacturer: syz [ 138.944818][ T4177] usb 3-1: SerialNumber: syz [ 138.955126][ T4177] usb 3-1: config 0 descriptor?? [ 138.968022][ T4195] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 138.980187][ T4195] CPU: 0 PID: 4195 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 138.987955][ T4195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 138.998033][ T4195] Workqueue: hci0 hci_rx_work [ 139.002944][ T4195] Call Trace: [ 139.006340][ T4195] [ 139.009840][ T4195] dump_stack_lvl+0x188/0x250 [ 139.014799][ T4195] ? show_regs_print_info+0x20/0x20 [ 139.020441][ T4195] ? load_image+0x400/0x400 [ 139.025278][ T4195] sysfs_create_dir_ns+0x26a/0x290 [ 139.030589][ T4195] ? sysfs_warn_dup+0xa0/0xa0 [ 139.035362][ T4195] ? process_one_work+0x85f/0x1010 [ 139.040741][ T4195] ? do_raw_spin_unlock+0x11d/0x230 [ 139.046296][ T4195] kobject_add_internal+0x6e0/0xd90 [ 139.051637][ T4195] kobject_add+0x160/0x230 [ 139.056454][ T4195] ? kobject_init+0x1d0/0x1d0 [ 139.061230][ T4195] ? klist_children_get+0x50/0x50 [ 139.066540][ T4195] ? get_device_parent+0x121/0x3f0 [ 139.071881][ T4195] device_add+0x48c/0x1000 [ 139.076529][ T4195] hci_conn_add_sysfs+0xd1/0x1e0 [ 139.081781][ T4195] le_conn_complete_evt+0xc4b/0x15c0 [ 139.087098][ T4195] ? cs_le_create_conn+0x5e0/0x5e0 [ 139.092403][ T4195] ? __mutex_trylock_common+0x155/0x260 [ 139.098289][ T4195] hci_le_meta_evt+0x285/0x3cb0 [ 139.103333][ T4195] ? hci_event_packet+0x37e/0x1370 [ 139.108653][ T4195] ? __lock_acquire+0x7d10/0x7d10 [ 139.113805][ T4195] ? hci_remote_host_features_evt+0x290/0x290 [ 139.120024][ T4195] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 139.125882][ T4195] ? mark_lock+0x94/0x320 [ 139.130647][ T4195] ? mutex_unlock+0x10/0x10 [ 139.135563][ T4195] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 139.142055][ T4195] ? lock_chain_count+0x20/0x20 [ 139.147641][ T4195] ? __rwlock_init+0x140/0x140 [ 139.152685][ T4195] hci_event_packet+0xe4b/0x1370 [ 139.158995][ T4195] ? lockdep_hardirqs_on+0x94/0x140 [ 139.164600][ T4195] ? rcu_lock_release+0x20/0x20 [ 139.170380][ T4195] ? hci_send_to_monitor+0x9c/0x4a0 [ 139.176132][ T4195] hci_rx_work+0x255/0xa10 [ 139.180962][ T4195] process_one_work+0x85f/0x1010 [ 139.187689][ T4195] ? worker_detach_from_pool+0x240/0x240 [ 139.193834][ T4195] ? lockdep_hardirqs_off+0x70/0x100 [ 139.199328][ T4195] ? _raw_spin_lock_irq+0xb7/0xf0 [ 139.204477][ T4195] ? _raw_spin_lock_irqsave+0x100/0x100 [ 139.210152][ T4195] ? wq_worker_running+0x97/0x170 [ 139.215283][ T4195] worker_thread+0xaa6/0x1290 [ 139.220108][ T4195] ? lockdep_hardirqs_on+0x94/0x140 [ 139.225510][ T4195] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 139.232654][ T4195] kthread+0x436/0x520 [ 139.236760][ T4195] ? rcu_lock_release+0x20/0x20 [ 139.241893][ T4195] ? kthread_blkcg+0xd0/0xd0 [ 139.251079][ T4195] ret_from_fork+0x1f/0x30 [ 139.257947][ T4195] [ 139.270334][ T4195] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 139.290592][ T4195] Bluetooth: hci0: failed to register connection device [ 139.419206][ T4884] netlink: 12 bytes leftover after parsing attributes in process `syz.3.168'. [ 139.428616][ T4884] netlink: 'syz.3.168': attribute type 2 has an invalid length. [ 139.436445][ T4884] netlink: 'syz.3.168': attribute type 1 has an invalid length. [ 139.458497][ T4884] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 139.467020][ T4884] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 139.475852][ T4884] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 140.122436][ T4177] msi2500 3-1:0.0: Registered as swradio24 [ 140.134176][ T4177] msi2500 3-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 140.238586][ T4893] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x0000000000000074' [ 141.055159][ T4177] usb 3-1: USB disconnect, device number 4 [ 143.239290][ T151] block nbd0: Attempted send on invalid socket [ 143.246890][ T151] blk_update_request: I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 143.258851][ T4918] SQUASHFS error: Failed to read block 0x0: -5 [ 143.269982][ T4918] unable to read squashfs_super_block [ 144.430225][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 144.440678][ T4196] CPU: 0 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 144.448352][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 144.458525][ T4196] Workqueue: hci3 hci_rx_work [ 144.463252][ T4196] Call Trace: [ 144.466560][ T4196] [ 144.469512][ T4196] dump_stack_lvl+0x188/0x250 [ 144.474218][ T4196] ? show_regs_print_info+0x20/0x20 [ 144.479529][ T4196] ? load_image+0x400/0x400 [ 144.484259][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 144.489421][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 144.494228][ T4196] ? process_one_work+0x85f/0x1010 [ 144.499550][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 144.504782][ T4196] kobject_add_internal+0x6e0/0xd90 [ 144.510038][ T4196] kobject_add+0x160/0x230 [ 144.514484][ T4196] ? kobject_init+0x1d0/0x1d0 [ 144.519374][ T4196] ? klist_children_get+0x50/0x50 [ 144.524697][ T4196] ? get_device_parent+0x121/0x3f0 [ 144.529956][ T4196] device_add+0x48c/0x1000 [ 144.534412][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 144.539386][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 144.544803][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 144.549956][ T4196] ? __mutex_trylock_common+0x155/0x260 [ 144.555719][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 144.560852][ T4196] ? hci_event_packet+0x37e/0x1370 [ 144.566178][ T4196] ? __lock_acquire+0x7d10/0x7d10 [ 144.571361][ T4196] ? __schedule+0x1497/0x43c0 [ 144.576187][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 144.582402][ T4196] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 144.588166][ T4196] ? mark_lock+0x94/0x320 [ 144.592523][ T4196] ? mutex_unlock+0x10/0x10 [ 144.597055][ T4196] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 144.603067][ T4196] ? lock_chain_count+0x20/0x20 [ 144.607944][ T4196] ? __rwlock_init+0x140/0x140 [ 144.612741][ T4196] hci_event_packet+0xe4b/0x1370 [ 144.617733][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 144.623148][ T4196] ? rcu_lock_release+0x20/0x20 [ 144.628205][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 144.633610][ T4196] hci_rx_work+0x255/0xa10 [ 144.638066][ T4196] process_one_work+0x85f/0x1010 [ 144.643045][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 144.649144][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 144.654947][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 144.660876][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 144.667178][ T4196] ? wq_worker_running+0x97/0x170 [ 144.672522][ T4196] worker_thread+0xaa6/0x1290 [ 144.677270][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 144.682525][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 144.688655][ T4196] kthread+0x436/0x520 [ 144.692832][ T4196] ? rcu_lock_release+0x20/0x20 [ 144.697719][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 144.702340][ T4196] ret_from_fork+0x1f/0x30 [ 144.706805][ T4196] [ 144.728946][ T4196] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 144.743772][ T4196] Bluetooth: hci3: failed to register connection device [ 146.164309][ T4946] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x000000000000007c' [ 146.296236][ T1111] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 147.215964][ T1111] usb 4-1: Using ep0 maxpacket: 8 [ 148.075935][ T1111] usb 4-1: device descriptor read/all, error -71 [ 148.483657][ T264] block nbd0: Attempted send on invalid socket [ 148.696581][ T264] blk_update_request: I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 148.708834][ T4966] SQUASHFS error: Failed to read block 0x0: -5 [ 148.715196][ T4966] unable to read squashfs_super_block [ 151.309203][ T4988] sctp: failed to load transform for md5: -2 [ 152.118515][ T5006] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x000000000000006c' [ 152.205938][ T1111] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 152.606082][ T1111] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 152.647412][ T1111] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 152.966486][ T4235] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 152.986243][ T1111] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 153.013026][ T1111] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.069725][ T1111] usb 5-1: Product: syz [ 153.145060][ T1111] usb 5-1: can't set config #1, error -71 [ 153.228612][ T1111] usb 5-1: USB disconnect, device number 5 [ 153.245978][ T4235] usb 1-1: Using ep0 maxpacket: 8 [ 153.366173][ T4235] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 153.726270][ T4235] usb 1-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 153.778565][ T4235] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.836465][ T4235] usb 1-1: Product: syz [ 153.869705][ T4235] usb 1-1: Manufacturer: syz [ 153.898086][ T4235] usb 1-1: SerialNumber: syz [ 154.056637][ T4235] usb 1-1: config 0 descriptor?? [ 154.462856][ T4235] msi2500 1-1:0.0: Registered as swradio24 [ 154.471910][ T4235] msi2500 1-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 154.571780][ T4235] usb 1-1: USB disconnect, device number 6 [ 156.915298][ T5055] sctp: failed to load transform for md5: -2 [ 157.405057][ T4357] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 158.161052][ T5073] netlink: 12 bytes leftover after parsing attributes in process `syz.2.217'. [ 158.170151][ T5073] netlink: 'syz.2.217': attribute type 2 has an invalid length. [ 158.178336][ T5073] netlink: 'syz.2.217': attribute type 1 has an invalid length. [ 158.201073][ T5073] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 158.209718][ T5073] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 158.218390][ T5073] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 158.738001][ T4357] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 158.748820][ T4357] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 158.870331][ T264] block nbd4: Attempted send on invalid socket [ 158.876787][ T264] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 158.888374][ T5090] SQUASHFS error: Failed to read block 0x0: -5 [ 158.894750][ T5090] unable to read squashfs_super_block [ 159.694546][ T5101] tipc: Started in network mode [ 159.699635][ T5101] tipc: Node identity 32a905ec77c4, cluster identity 4711 [ 159.719805][ T5101] tipc: Enabled bearer , priority 0 [ 161.979460][ T4357] usb 1-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 162.175927][ T5104] device syzkaller0 entered promiscuous mode [ 162.183649][ T4357] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.365945][ T4357] usb 1-1: can't set config #1, error -71 [ 162.384679][ T4357] usb 1-1: USB disconnect, device number 7 [ 162.417981][ T4235] tipc: Node number set to 1164772844 [ 162.473392][ T5100] tipc: Resetting bearer [ 162.486081][ T13] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 162.727152][ T5100] tipc: Disabling bearer [ 163.716420][ T5123] netlink: 36 bytes leftover after parsing attributes in process `syz.2.229'. [ 164.510946][ T5138] netlink: 12 bytes leftover after parsing attributes in process `syz.3.234'. [ 164.520208][ T5138] netlink: 'syz.3.234': attribute type 2 has an invalid length. [ 164.528159][ T5138] netlink: 'syz.3.234': attribute type 1 has an invalid length. [ 164.570992][ T5138] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 164.580024][ T5138] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 164.588962][ T5138] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 165.159644][ T151] block nbd2: Attempted send on invalid socket [ 165.166105][ T151] blk_update_request: I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 165.177213][ T5139] SQUASHFS error: Failed to read block 0x0: -5 [ 165.183425][ T5139] unable to read squashfs_super_block [ 165.562057][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 165.572434][ T4196] CPU: 0 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 165.580102][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 165.590277][ T4196] Workqueue: hci1 hci_rx_work [ 165.594991][ T4196] Call Trace: [ 165.598271][ T4196] [ 165.601214][ T4196] dump_stack_lvl+0x188/0x250 [ 165.605917][ T4196] ? show_regs_print_info+0x20/0x20 [ 165.611293][ T4196] ? load_image+0x400/0x400 [ 165.615809][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 165.620939][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 165.625623][ T4196] ? process_one_work+0x85f/0x1010 [ 165.630756][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 165.635962][ T4196] kobject_add_internal+0x6e0/0xd90 [ 165.641163][ T4196] kobject_add+0x160/0x230 [ 165.645690][ T4196] ? kobject_init+0x1d0/0x1d0 [ 165.650372][ T4196] ? klist_children_get+0x50/0x50 [ 165.655394][ T4196] ? get_device_parent+0x121/0x3f0 [ 165.660527][ T4196] device_add+0x48c/0x1000 [ 165.665116][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 165.670053][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 165.675433][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 165.680766][ T4196] ? __mutex_trylock_common+0x155/0x260 [ 165.686500][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 165.691347][ T4196] ? hci_event_packet+0x37e/0x1370 [ 165.696452][ T4196] ? __lock_acquire+0x7d10/0x7d10 [ 165.701588][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 165.707683][ T4196] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 165.713313][ T4196] ? mark_lock+0x94/0x320 [ 165.717636][ T4196] ? mutex_unlock+0x10/0x10 [ 165.722159][ T4196] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 165.728405][ T4196] ? lock_chain_count+0x20/0x20 [ 165.733254][ T4196] ? __rwlock_init+0x140/0x140 [ 165.738023][ T4196] hci_event_packet+0xe4b/0x1370 [ 165.742988][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 165.748608][ T4196] ? rcu_lock_release+0x20/0x20 [ 165.753565][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 165.758766][ T4196] hci_rx_work+0x255/0xa10 [ 165.763204][ T4196] process_one_work+0x85f/0x1010 [ 165.768163][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 165.773819][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 165.779126][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 165.784248][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 165.789794][ T4196] ? wq_worker_running+0x97/0x170 [ 165.794825][ T4196] worker_thread+0xaa6/0x1290 [ 165.799766][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 165.804963][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 165.811051][ T4196] kthread+0x436/0x520 [ 165.815140][ T4196] ? rcu_lock_release+0x20/0x20 [ 165.820161][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 165.824750][ T4196] ret_from_fork+0x1f/0x30 [ 165.829168][ T4196] [ 166.091476][ T4196] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 166.126924][ T4196] Bluetooth: hci1: failed to register connection device [ 169.193466][ T5174] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x0000000000000080' [ 170.174836][ T5178] netlink: 36 bytes leftover after parsing attributes in process `syz.1.243'. [ 172.156094][ T151] block nbd3: Attempted send on invalid socket [ 172.162518][ T151] blk_update_request: I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 172.173772][ T5193] SQUASHFS error: Failed to read block 0x0: -5 [ 172.180081][ T5193] unable to read squashfs_super_block [ 172.304082][ T5191] tipc: Enabled bearer , priority 0 [ 172.406426][ T5191] device syzkaller0 entered promiscuous mode [ 172.532262][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 172.542139][ T4196] CPU: 1 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 172.549819][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 172.559899][ T4196] Workqueue: hci3 hci_rx_work [ 172.564611][ T4196] Call Trace: [ 172.567913][ T4196] [ 172.570862][ T4196] dump_stack_lvl+0x188/0x250 [ 172.575572][ T4196] ? show_regs_print_info+0x20/0x20 [ 172.580791][ T4196] ? load_image+0x400/0x400 [ 172.585372][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 172.590515][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 172.595304][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 172.600645][ T4196] kobject_add_internal+0x6e0/0xd90 [ 172.605875][ T4196] kobject_add+0x160/0x230 [ 172.610330][ T4196] ? kobject_init+0x1d0/0x1d0 [ 172.615046][ T4196] ? klist_children_get+0x50/0x50 [ 172.620366][ T4196] ? get_device_parent+0x121/0x3f0 [ 172.625527][ T4196] device_add+0x48c/0x1000 [ 172.630007][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 172.635133][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 172.640548][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 172.645693][ T4196] ? __mutex_trylock_common+0x155/0x260 [ 172.651404][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 172.656370][ T4196] ? hci_event_packet+0x37e/0x1370 [ 172.661500][ T4196] ? __lock_acquire+0x7d10/0x7d10 [ 172.666561][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 172.672744][ T4196] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 172.678406][ T4196] ? mark_lock+0x94/0x320 [ 172.682766][ T4196] ? mutex_unlock+0x10/0x10 [ 172.687293][ T4196] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 172.693354][ T4196] ? lock_chain_count+0x20/0x20 [ 172.698229][ T4196] ? __rwlock_init+0x140/0x140 [ 172.703019][ T4196] hci_event_packet+0xe4b/0x1370 [ 172.708156][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 172.713390][ T4196] ? rcu_lock_release+0x20/0x20 [ 172.718442][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 172.723754][ T4196] hci_rx_work+0x255/0xa10 [ 172.728400][ T4196] process_one_work+0x85f/0x1010 [ 172.733380][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 172.739046][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 172.744563][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 172.749797][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 172.755373][ T4196] ? wq_worker_running+0x97/0x170 [ 172.760541][ T4196] worker_thread+0xaa6/0x1290 [ 172.765358][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 172.770672][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 172.776602][ T4196] kthread+0x436/0x520 [ 172.780786][ T4196] ? rcu_lock_release+0x20/0x20 [ 172.785659][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 172.790277][ T4196] ret_from_fork+0x1f/0x30 [ 172.794748][ T4196] [ 172.818464][ T4196] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 172.832912][ T4196] Bluetooth: hci3: failed to register connection device [ 173.298383][ T5191] netlink: 44 bytes leftover after parsing attributes in process `syz.1.246'. [ 175.231931][ T5185] tipc: Resetting bearer [ 175.366429][ T5185] tipc: Disabling bearer [ 176.393099][ T5228] netlink: 36 bytes leftover after parsing attributes in process `syz.2.256'. [ 177.306171][ T5237] sctp: failed to load transform for md5: -2 [ 177.779796][ T5255] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x00000000000000f9' [ 178.674445][ T264] block nbd1: Attempted send on invalid socket [ 178.680866][ T264] blk_update_request: I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 178.694291][ T5260] SQUASHFS error: Failed to read block 0x0: -5 [ 178.701515][ T5260] unable to read squashfs_super_block [ 179.506022][ T1111] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 179.528167][ T5269] tipc: Enabled bearer , priority 0 [ 179.574248][ T5269] device syzkaller0 entered promiscuous mode [ 179.631219][ T5269] netlink: 44 bytes leftover after parsing attributes in process `syz.1.267'. [ 179.651479][ T5268] tipc: Resetting bearer [ 179.781365][ T5268] tipc: Disabling bearer [ 179.826151][ T1111] usb 1-1: Using ep0 maxpacket: 8 [ 179.873322][ T5277] netlink: 20 bytes leftover after parsing attributes in process `syz.2.270'. [ 180.979318][ T1111] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 180.992406][ T1111] usb 1-1: can't read configurations, error -71 [ 183.291729][ T151] block nbd2: Attempted send on invalid socket [ 183.298190][ T151] blk_update_request: I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 183.310570][ T5307] SQUASHFS error: Failed to read block 0x0: -5 [ 183.317651][ T5307] unable to read squashfs_super_block [ 183.366485][ T5306] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x00000000000000bf' [ 183.639756][ T5312] tipc: Enabled bearer , priority 0 [ 183.774588][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 183.783821][ T5312] netlink: 44 bytes leftover after parsing attributes in process `syz.4.283'. [ 183.787872][ T4196] CPU: 1 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 183.800869][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 183.811180][ T4196] Workqueue: hci2 hci_rx_work [ 183.815890][ T4196] Call Trace: [ 183.819269][ T4196] [ 183.822205][ T4196] dump_stack_lvl+0x188/0x250 [ 183.826883][ T4196] ? show_regs_print_info+0x20/0x20 [ 183.832090][ T4196] ? load_image+0x400/0x400 [ 183.836596][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 183.841732][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 183.846529][ T4196] ? process_one_work+0x85f/0x1010 [ 183.851744][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 183.856965][ T4196] kobject_add_internal+0x6e0/0xd90 [ 183.862206][ T4196] kobject_add+0x160/0x230 [ 183.866641][ T4196] ? kobject_init+0x1d0/0x1d0 [ 183.871443][ T4196] ? klist_children_get+0x50/0x50 [ 183.876486][ T4196] ? get_device_parent+0x121/0x3f0 [ 183.881613][ T4196] device_add+0x48c/0x1000 [ 183.886067][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 183.891127][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 183.896427][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 183.901905][ T4196] ? __mutex_trylock_common+0x155/0x260 [ 183.907496][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 183.912366][ T4196] ? hci_event_packet+0x37e/0x1370 [ 183.917486][ T4196] ? __lock_acquire+0x7d10/0x7d10 [ 183.922512][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 183.928605][ T4196] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 183.934239][ T4196] ? mark_lock+0x94/0x320 [ 183.938571][ T4196] ? mutex_unlock+0x10/0x10 [ 183.943171][ T4196] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 183.949157][ T4196] ? lock_chain_count+0x20/0x20 [ 183.954018][ T4196] ? __rwlock_init+0x140/0x140 [ 183.959130][ T4196] hci_event_packet+0xe4b/0x1370 [ 183.964532][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 183.969859][ T4196] ? rcu_lock_release+0x20/0x20 [ 183.974730][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 183.979917][ T4196] hci_rx_work+0x255/0xa10 [ 183.984337][ T4196] process_one_work+0x85f/0x1010 [ 183.989279][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 183.994990][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 184.000274][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 184.005309][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 184.010915][ T4196] ? wq_worker_running+0x97/0x170 [ 184.016034][ T4196] worker_thread+0xaa6/0x1290 [ 184.020725][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 184.025934][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 184.031839][ T4196] kthread+0x436/0x520 [ 184.035910][ T4196] ? rcu_lock_release+0x20/0x20 [ 184.040780][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 184.045364][ T4196] ret_from_fork+0x1f/0x30 [ 184.049804][ T4196] [ 184.110800][ T5321] netlink: 20 bytes leftover after parsing attributes in process `syz.3.281'. [ 184.457637][ T4196] kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 184.471630][ T4196] Bluetooth: hci2: failed to register connection device [ 186.231375][ T5312] tipc: Resetting bearer [ 186.268578][ T5311] tipc: Disabling bearer [ 186.505809][ T23] Bluetooth: hci0: command 0x0406 tx timeout [ 186.505892][ T7] Bluetooth: hci2: command 0x0406 tx timeout [ 186.593933][ T1111] Bluetooth: hci4: command 0x0406 tx timeout [ 186.603417][ T1111] Bluetooth: hci1: command 0x0406 tx timeout [ 186.635869][ T1111] Bluetooth: hci3: command 0x0406 tx timeout [ 186.643089][ T5334] CUSE: info not properly terminated [ 186.656226][ T4285] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 187.805856][ T4285] usb 4-1: Using ep0 maxpacket: 8 [ 187.812645][ T5346] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x0000000000000117' [ 188.125021][ T4285] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 188.626355][ T5359] netlink: 20 bytes leftover after parsing attributes in process `syz.0.294'. [ 189.243306][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 189.254748][ T4196] CPU: 1 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 189.262342][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 189.272519][ T4196] Workqueue: hci3 hci_rx_work [ 189.277235][ T4196] Call Trace: [ 189.280536][ T4196] [ 189.283484][ T4196] dump_stack_lvl+0x188/0x250 [ 189.288193][ T4196] ? show_regs_print_info+0x20/0x20 [ 189.293411][ T4196] ? load_image+0x400/0x400 [ 189.297954][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 189.303230][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 189.306129][ T4285] usb 4-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 189.307937][ T4196] ? process_one_work+0x85f/0x1010 [ 189.322096][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 189.327332][ T4196] kobject_add_internal+0x6e0/0xd90 [ 189.332565][ T4196] kobject_add+0x160/0x230 [ 189.337095][ T4196] ? kobject_init+0x1d0/0x1d0 [ 189.341992][ T4196] ? klist_children_get+0x50/0x50 [ 189.347147][ T4196] ? get_device_parent+0x121/0x3f0 [ 189.352373][ T4196] device_add+0x48c/0x1000 [ 189.356838][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 189.361808][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 189.367149][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 189.372292][ T4196] ? __mutex_trylock_common+0x155/0x260 [ 189.377869][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 189.382924][ T4196] ? hci_event_packet+0x37e/0x1370 [ 189.388065][ T4196] ? __lock_acquire+0x7d10/0x7d10 [ 189.393120][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 189.399210][ T4196] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 189.404961][ T4196] ? mark_lock+0x94/0x320 [ 189.409314][ T4196] ? mutex_unlock+0x10/0x10 [ 189.413839][ T4196] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 189.419849][ T4196] ? lock_chain_count+0x20/0x20 [ 189.424834][ T4196] ? __rwlock_init+0x140/0x140 [ 189.429621][ T4196] hci_event_packet+0xe4b/0x1370 [ 189.434576][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 189.439892][ T4196] ? rcu_lock_release+0x20/0x20 [ 189.444786][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 189.450015][ T4196] hci_rx_work+0x255/0xa10 [ 189.454473][ T4196] process_one_work+0x85f/0x1010 [ 189.459478][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 189.465219][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 189.470538][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 189.475669][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 189.481245][ T4196] ? wq_worker_running+0x97/0x170 [ 189.486293][ T4196] worker_thread+0xaa6/0x1290 [ 189.491095][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 189.496315][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 189.502248][ T4196] kthread+0x436/0x520 [ 189.506336][ T4196] ? rcu_lock_release+0x20/0x20 [ 189.511202][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 189.515823][ T4196] ret_from_fork+0x1f/0x30 [ 189.520350][ T4196] [ 189.560448][ T4196] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 189.575374][ T4196] Bluetooth: hci3: failed to register connection device [ 189.584873][ T4196] Bluetooth: hci3: link tx timeout [ 189.590814][ T4196] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 191.369585][ T4285] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.378196][ T4285] usb 4-1: Product: syz [ 191.382905][ T4285] usb 4-1: Manufacturer: syz [ 191.387717][ T4285] usb 4-1: SerialNumber: syz [ 191.406836][ T4285] usb 4-1: config 0 descriptor?? [ 191.435961][ T4285] usb 4-1: can't set config #0, error -71 [ 191.443984][ T4285] usb 4-1: USB disconnect, device number 7 [ 191.482369][ T5376] CUSE: info not properly terminated [ 191.513361][ T5374] tipc: Enabled bearer , priority 0 [ 191.523848][ T5374] netlink: 44 bytes leftover after parsing attributes in process `syz.4.299'. [ 191.558069][ T5374] tipc: Resetting bearer [ 191.631774][ T5379] netlink: 12 bytes leftover after parsing attributes in process `syz.3.298'. [ 191.640939][ T5379] netlink: 'syz.3.298': attribute type 2 has an invalid length. [ 191.649323][ T5379] netlink: 'syz.3.298': attribute type 1 has an invalid length. [ 191.752406][ T5379] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 191.774803][ T5379] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 191.783872][ T5379] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 191.898096][ T5373] tipc: Disabling bearer [ 195.944883][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.952855][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 196.007999][ T264] block nbd2: Attempted send on invalid socket [ 196.014950][ T264] blk_update_request: I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 196.026492][ T5409] SQUASHFS error: Failed to read block 0x0: -5 [ 196.032701][ T5409] unable to read squashfs_super_block [ 196.425832][ T21] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 196.642936][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 196.652589][ T4196] CPU: 1 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 196.660168][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 196.670249][ T4196] Workqueue: hci2 hci_rx_work [ 196.675000][ T4196] Call Trace: [ 196.678300][ T4196] [ 196.681248][ T4196] dump_stack_lvl+0x188/0x250 [ 196.685958][ T4196] ? show_regs_print_info+0x20/0x20 [ 196.691199][ T4196] ? load_image+0x400/0x400 [ 196.695730][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 196.700879][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 196.705566][ T4196] ? process_one_work+0x85f/0x1010 [ 196.710679][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 196.715880][ T4196] kobject_add_internal+0x6e0/0xd90 [ 196.721170][ T4196] kobject_add+0x160/0x230 [ 196.725594][ T4196] ? kobject_init+0x1d0/0x1d0 [ 196.730286][ T4196] ? klist_children_get+0x50/0x50 [ 196.735325][ T4196] ? get_device_parent+0x121/0x3f0 [ 196.740431][ T4196] device_add+0x48c/0x1000 [ 196.744868][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 196.749915][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 196.755220][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 196.760344][ T4196] ? __mutex_trylock_common+0x155/0x260 [ 196.766050][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 196.771351][ T4196] ? hci_event_packet+0x37e/0x1370 [ 196.776472][ T4196] ? __lock_acquire+0x7d10/0x7d10 [ 196.781512][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 196.787622][ T4196] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 196.793479][ T4196] ? mark_lock+0x94/0x320 [ 196.797818][ T4196] ? mutex_unlock+0x10/0x10 [ 196.802331][ T4196] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 196.808430][ T4196] ? lock_chain_count+0x20/0x20 [ 196.813330][ T4196] ? __rwlock_init+0x140/0x140 [ 196.818102][ T4196] hci_event_packet+0xe4b/0x1370 [ 196.823064][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 196.828784][ T4196] ? rcu_lock_release+0x20/0x20 [ 196.833639][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 196.838850][ T4196] hci_rx_work+0x255/0xa10 [ 196.843308][ T4196] process_one_work+0x85f/0x1010 [ 196.848464][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 196.854091][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 196.859373][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 196.864395][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 196.870244][ T4196] ? wq_worker_running+0x97/0x170 [ 196.875286][ T4196] worker_thread+0xaa6/0x1290 [ 196.880016][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 196.885223][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 196.891205][ T4196] kthread+0x436/0x520 [ 196.895402][ T4196] ? rcu_lock_release+0x20/0x20 [ 196.900261][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 196.904897][ T4196] ret_from_fork+0x1f/0x30 [ 196.909337][ T4196] [ 196.937440][ T21] usb 1-1: Using ep0 maxpacket: 8 [ 196.945803][ T4196] kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 196.959679][ T4196] Bluetooth: hci2: failed to register connection device [ 197.265044][ T21] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 197.272637][ T5421] tipc: Enabled bearer , priority 0 [ 197.274312][ T5421] netlink: 44 bytes leftover after parsing attributes in process `syz.1.313'. [ 197.281586][ T5426] CUSE: info not properly terminated [ 197.853350][ T21] usb 1-1: can't read configurations, error -71 [ 197.883083][ T5421] tipc: Resetting bearer [ 198.483332][ T5419] tipc: Disabling bearer [ 198.704791][ T5447] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x00000000000000cc' [ 198.999584][ T151] block nbd0: Attempted send on invalid socket [ 199.006252][ T151] blk_update_request: I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 199.017775][ T5452] SQUASHFS error: Failed to read block 0x0: -5 [ 199.024139][ T5452] unable to read squashfs_super_block [ 199.389034][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 199.400156][ T4196] CPU: 0 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 199.407833][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 199.418020][ T4196] Workqueue: hci1 hci_rx_work [ 199.422751][ T4196] Call Trace: [ 199.426046][ T4196] [ 199.428996][ T4196] dump_stack_lvl+0x188/0x250 [ 199.433703][ T4196] ? show_regs_print_info+0x20/0x20 [ 199.439012][ T4196] ? load_image+0x400/0x400 [ 199.443643][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 199.448791][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 199.453516][ T4196] ? process_one_work+0x85f/0x1010 [ 199.458660][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 199.463883][ T4196] kobject_add_internal+0x6e0/0xd90 [ 199.469260][ T4196] kobject_add+0x160/0x230 [ 199.473723][ T4196] ? kobject_init+0x1d0/0x1d0 [ 199.478412][ T4196] ? klist_children_get+0x50/0x50 [ 199.483459][ T4196] ? get_device_parent+0x121/0x3f0 [ 199.488785][ T4196] device_add+0x48c/0x1000 [ 199.494423][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 199.499659][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 199.504971][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 199.510114][ T4196] ? __mutex_trylock_common+0x155/0x260 [ 199.515777][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 199.520886][ T4196] ? hci_event_packet+0x37e/0x1370 [ 199.526025][ T4196] ? __lock_acquire+0x7d10/0x7d10 [ 199.531059][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 199.537125][ T4196] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 199.542764][ T4196] ? mark_lock+0x94/0x320 [ 199.547149][ T4196] ? mutex_unlock+0x10/0x10 [ 199.551841][ T4196] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 199.557928][ T4196] ? lock_chain_count+0x20/0x20 [ 199.562782][ T4196] ? __rwlock_init+0x140/0x140 [ 199.567567][ T4196] hci_event_packet+0xe4b/0x1370 [ 199.572523][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 199.577725][ T4196] ? rcu_lock_release+0x20/0x20 [ 199.582588][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 199.587810][ T4196] hci_rx_work+0x255/0xa10 [ 199.592270][ T4196] process_one_work+0x85f/0x1010 [ 199.597262][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 199.603091][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 199.608398][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 199.613533][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 199.619101][ T4196] ? wq_worker_running+0x97/0x170 [ 199.624157][ T4196] worker_thread+0xaa6/0x1290 [ 199.628841][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 199.634043][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 199.639944][ T4196] kthread+0x436/0x520 [ 199.644022][ T4196] ? rcu_lock_release+0x20/0x20 [ 199.648881][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 199.653485][ T4196] ret_from_fork+0x1f/0x30 [ 199.658157][ T4196] [ 199.764848][ T4196] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 199.780558][ T4196] Bluetooth: hci1: failed to register connection device [ 199.790829][ T4196] Bluetooth: hci1: link tx timeout [ 199.797582][ T4196] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 202.678304][ T5482] device syzkaller0 entered promiscuous mode [ 202.686350][ T5478] CUSE: info not properly terminated [ 202.749073][ T5482] netlink: 44 bytes leftover after parsing attributes in process `syz.3.331'. [ 202.795916][ T1111] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 203.276055][ T1111] usb 2-1: Using ep0 maxpacket: 8 [ 203.525938][ T1111] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 203.571844][ T5490] netlink: 40 bytes leftover after parsing attributes in process `syz.0.334'. [ 203.582188][ T5494] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x00000000000000d4' [ 203.954207][ T151] block nbd0: Attempted send on invalid socket [ 203.960807][ T151] blk_update_request: I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 203.972517][ T5501] SQUASHFS error: Failed to read block 0x0: -5 [ 203.979010][ T5501] unable to read squashfs_super_block [ 204.035940][ T1111] usb 2-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 204.105425][ T1111] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.113768][ T1111] usb 2-1: Product: syz [ 204.118166][ T1111] usb 2-1: Manufacturer: syz [ 204.122855][ T1111] usb 2-1: SerialNumber: syz [ 204.132290][ T1111] usb 2-1: config 0 descriptor?? [ 204.320461][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 204.330464][ T4196] CPU: 0 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 204.338231][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 204.348398][ T4196] Workqueue: hci4 hci_rx_work [ 204.353111][ T4196] Call Trace: [ 204.356410][ T4196] [ 204.359361][ T4196] dump_stack_lvl+0x188/0x250 [ 204.364069][ T4196] ? show_regs_print_info+0x20/0x20 [ 204.369377][ T4196] ? load_image+0x400/0x400 [ 204.373922][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 204.379059][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 204.383845][ T4196] ? process_one_work+0x85f/0x1010 [ 204.389175][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 204.394403][ T4196] kobject_add_internal+0x6e0/0xd90 [ 204.399634][ T4196] kobject_add+0x160/0x230 [ 204.404166][ T4196] ? kobject_init+0x1d0/0x1d0 [ 204.408872][ T4196] ? klist_children_get+0x50/0x50 [ 204.413936][ T4196] ? get_device_parent+0x121/0x3f0 [ 204.419076][ T4196] device_add+0x48c/0x1000 [ 204.423531][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 204.428501][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 204.433954][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 204.439203][ T4196] ? __switch_to_asm+0x34/0x60 [ 204.443995][ T4196] ? __mutex_trylock_common+0x155/0x260 [ 204.449661][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 204.454536][ T4196] ? hci_event_packet+0x37e/0x1370 [ 204.459673][ T4196] ? __lock_acquire+0x7d10/0x7d10 [ 204.464729][ T4196] ? mark_lock+0x94/0x320 [ 204.469083][ T4196] ? release_firmware_map_entry+0x190/0x190 [ 204.475003][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 204.481093][ T4196] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 204.486752][ T4196] ? mutex_unlock+0x10/0x10 [ 204.491280][ T4196] ? preempt_schedule+0xbc/0xd0 [ 204.496410][ T4196] ? schedule_preempt_disabled+0x20/0x20 [ 204.502078][ T4196] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 204.507748][ T4196] hci_event_packet+0xe4b/0x1370 [ 204.512722][ T4196] ? rcu_lock_release+0x20/0x20 [ 204.517602][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 204.522824][ T4196] hci_rx_work+0x255/0xa10 [ 204.527279][ T4196] process_one_work+0x85f/0x1010 [ 204.532257][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 204.537915][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 204.543231][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 204.548277][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 204.553855][ T4196] ? wq_worker_running+0x97/0x170 [ 204.558915][ T4196] worker_thread+0xaa6/0x1290 [ 204.563639][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 204.568881][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 204.574826][ T4196] kthread+0x436/0x520 [ 204.578923][ T4196] ? rcu_lock_release+0x20/0x20 [ 204.583801][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 204.588422][ T4196] ret_from_fork+0x1f/0x30 [ 204.592983][ T4196] [ 204.712645][ T4196] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 204.731318][ T4196] Bluetooth: hci4: failed to register connection device [ 204.887985][ T1111] msi2500 2-1:0.0: Registered as swradio24 [ 204.894322][ T1111] msi2500 2-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 204.913694][ T1111] usb 2-1: USB disconnect, device number 5 [ 206.672274][ T264] block nbd4: Attempted send on invalid socket [ 206.679264][ T264] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 206.691559][ T5525] SQUASHFS error: Failed to read block 0x0: -5 [ 206.698050][ T5525] unable to read squashfs_super_block [ 207.555945][ T5530] CUSE: info not properly terminated [ 207.602101][ T5533] device syzkaller0 entered promiscuous mode [ 207.608702][ T5535] netlink: 40 bytes leftover after parsing attributes in process `syz.0.348'. [ 207.624256][ T5533] netlink: 44 bytes leftover after parsing attributes in process `syz.1.347'. [ 209.202197][ T264] block nbd1: Attempted send on invalid socket [ 209.207080][ T5555] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x00000000000000ce' [ 209.209469][ T264] blk_update_request: I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 209.233232][ T5552] SQUASHFS error: Failed to read block 0x0: -5 [ 209.239546][ T5552] unable to read squashfs_super_block [ 209.295802][ T13] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 209.545975][ T13] usb 5-1: Using ep0 maxpacket: 8 [ 210.066127][ T13] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 210.296175][ T13] usb 5-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 210.346074][ T13] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.973693][ T13] usb 5-1: Product: syz [ 212.068586][ T13] usb 5-1: Manufacturer: syz [ 212.240001][ T13] usb 5-1: SerialNumber: syz [ 212.594560][ T13] usb 5-1: config 0 descriptor?? [ 212.616713][ T13] usb 5-1: can't set config #0, error -71 [ 212.693516][ T13] usb 5-1: USB disconnect, device number 6 [ 212.956667][ T151] block nbd3: Attempted send on invalid socket [ 212.963145][ T151] blk_update_request: I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 212.974708][ T5573] SQUASHFS error: Failed to read block 0x0: -5 [ 212.981088][ T5573] unable to read squashfs_super_block [ 212.983318][ T5576] netlink: 40 bytes leftover after parsing attributes in process `syz.4.360'. [ 213.269288][ T5586] netlink: 'syz.1.364': attribute type 39 has an invalid length. [ 213.365428][ T5584] CUSE: info not properly terminated [ 216.290374][ T5609] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x000000000000014c' [ 218.495903][ T4232] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 218.510452][ T5625] netlink: 12 bytes leftover after parsing attributes in process `syz.3.373'. [ 218.519627][ T5625] netlink: 'syz.3.373': attribute type 2 has an invalid length. [ 218.527683][ T5625] netlink: 'syz.3.373': attribute type 1 has an invalid length. [ 218.597237][ T5625] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 218.605853][ T5625] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 218.614436][ T5625] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 219.629795][ T151] block nbd4: Attempted send on invalid socket [ 219.636184][ T151] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 219.706964][ T4232] usb 3-1: device not accepting address 5, error -71 [ 219.713959][ T5638] SQUASHFS error: Failed to read block 0x0: -5 [ 219.720252][ T5638] unable to read squashfs_super_block [ 220.673950][ T5637] CUSE: info not properly terminated [ 221.037477][ T5656] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x0000000000000155' [ 221.051924][ T5650] device syzkaller0 entered promiscuous mode [ 221.101760][ T5650] netlink: 44 bytes leftover after parsing attributes in process `syz.1.381'. [ 223.694496][ T5668] netlink: 'syz.1.385': attribute type 39 has an invalid length. [ 223.884152][ T5673] netlink: 12 bytes leftover after parsing attributes in process `syz.3.386'. [ 223.893390][ T5673] netlink: 'syz.3.386': attribute type 2 has an invalid length. [ 223.901224][ T5673] netlink: 'syz.3.386': attribute type 1 has an invalid length. [ 223.932096][ T5673] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 223.940502][ T5673] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 223.949172][ T5673] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 225.710634][ T4232] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 226.009383][ T264] block nbd2: Attempted send on invalid socket [ 226.016428][ T264] blk_update_request: I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 226.030380][ T5688] SQUASHFS error: Failed to read block 0x0: -5 [ 226.036676][ T5688] unable to read squashfs_super_block [ 226.354628][ T5696] CUSE: info not properly terminated [ 226.367339][ T5697] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x0000000000000114' [ 226.586041][ T4232] usb 1-1: Using ep0 maxpacket: 8 [ 227.431186][ T5705] Zero length message leads to an empty skb [ 227.605945][ T4232] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 227.917541][ T4232] usb 1-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 228.379367][ T4232] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.389543][ T4232] usb 1-1: Product: syz [ 228.393975][ T4232] usb 1-1: Manufacturer: syz [ 228.531183][ T4232] usb 1-1: SerialNumber: syz [ 228.559680][ T4232] usb 1-1: config 0 descriptor?? [ 228.741425][ T151] block nbd3: Attempted send on invalid socket [ 228.747930][ T151] blk_update_request: I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 228.760612][ T5719] SQUASHFS error: Failed to read block 0x0: -5 [ 228.766995][ T5719] unable to read squashfs_super_block [ 228.815819][ T5721] netlink: 12 bytes leftover after parsing attributes in process `syz.0.400'. [ 228.824861][ T5721] netlink: 'syz.0.400': attribute type 2 has an invalid length. [ 228.832673][ T5721] netlink: 'syz.0.400': attribute type 1 has an invalid length. [ 228.860860][ T5721] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 228.869327][ T5721] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 228.877865][ T5721] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 229.476553][ T4232] usb 1-1: can't set config #0, error -71 [ 229.546901][ T4232] usb 1-1: USB disconnect, device number 12 [ 230.219345][ T151] block nbd4: Attempted send on invalid socket [ 230.236747][ T151] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 230.248317][ T5737] SQUASHFS error: Failed to read block 0x0: -5 [ 230.254534][ T5737] unable to read squashfs_super_block [ 230.855340][ T5731] netlink: 'syz.2.402': attribute type 39 has an invalid length. [ 232.171357][ T5754] CUSE: info not properly terminated [ 232.192099][ T5755] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x00000000000000ef' [ 233.353372][ T4177] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 233.497639][ T5769] netlink: 12 bytes leftover after parsing attributes in process `syz.3.413'. [ 233.506705][ T5769] netlink: 'syz.3.413': attribute type 2 has an invalid length. [ 233.514448][ T5769] netlink: 'syz.3.413': attribute type 1 has an invalid length. [ 233.546243][ T5769] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 233.554669][ T5769] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 233.563314][ T5769] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 233.655893][ T4177] usb 3-1: Using ep0 maxpacket: 8 [ 233.776571][ T4177] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 233.815828][ T4229] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 234.566185][ T4177] usb 3-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 234.582196][ T5775] device syzkaller0 entered promiscuous mode [ 234.588601][ T4177] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.806852][ T4177] usb 3-1: Product: syz [ 234.812764][ T4177] usb 3-1: Manufacturer: syz [ 234.818063][ T4177] usb 3-1: SerialNumber: syz [ 234.818644][ T5775] netlink: 44 bytes leftover after parsing attributes in process `syz.3.414'. [ 234.837238][ T4177] usb 3-1: config 0 descriptor?? [ 234.868663][ T151] block nbd4: Attempted send on invalid socket [ 234.874974][ T151] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 234.886909][ T5783] SQUASHFS error: Failed to read block 0x0: -5 [ 234.893294][ T5783] unable to read squashfs_super_block [ 235.684145][ T4177] msi2500 3-1:0.0: Registered as swradio24 [ 235.690439][ T4177] msi2500 3-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 235.711508][ T4177] usb 3-1: USB disconnect, device number 7 [ 235.742972][ T4229] usb 1-1: unable to get BOS descriptor or descriptor too short [ 235.757660][ T5792] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x0000000000000103' [ 235.830246][ T5795] netlink: 'syz.1.420': attribute type 39 has an invalid length. [ 235.847268][ T4229] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 235.869082][ T4229] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 236.983443][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 236.993510][ T4196] CPU: 0 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 237.001091][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 237.011178][ T4196] Workqueue: hci4 hci_rx_work [ 237.015897][ T4196] Call Trace: [ 237.019194][ T4196] [ 237.022143][ T4196] dump_stack_lvl+0x188/0x250 [ 237.026849][ T4196] ? show_regs_print_info+0x20/0x20 [ 237.032077][ T4196] ? load_image+0x400/0x400 [ 237.036618][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 237.041759][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 237.046452][ T4196] ? process_one_work+0x85f/0x1010 [ 237.051597][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 237.056846][ T4196] kobject_add_internal+0x6e0/0xd90 [ 237.062090][ T4196] kobject_add+0x160/0x230 [ 237.066551][ T4196] ? kobject_init+0x1d0/0x1d0 [ 237.071257][ T4196] ? klist_children_get+0x50/0x50 [ 237.076310][ T4196] ? get_device_parent+0x121/0x3f0 [ 237.081690][ T4196] device_add+0x48c/0x1000 [ 237.086169][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 237.091138][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 237.096465][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 237.101608][ T4196] ? skb_pull+0x44/0x130 [ 237.105877][ T4196] ? __sanitizer_cov_trace_cmp4+0x32/0x80 [ 237.111624][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 237.116500][ T4196] ? hci_event_packet+0x37e/0x1370 [ 237.121637][ T4196] ? __lock_acquire+0x7d10/0x7d10 [ 237.126694][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 237.132787][ T4196] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 237.138445][ T4196] ? mark_lock+0x94/0x320 [ 237.142801][ T4196] ? mutex_unlock+0x10/0x10 [ 237.147333][ T4196] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 237.153344][ T4196] ? lock_chain_count+0x20/0x20 [ 237.158213][ T4196] ? __rwlock_init+0x140/0x140 [ 237.163002][ T4196] hci_event_packet+0xe4b/0x1370 [ 237.167961][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 237.173208][ T4196] ? rcu_lock_release+0x20/0x20 [ 237.178178][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 237.183416][ T4196] hci_rx_work+0x255/0xa10 [ 237.187876][ T4196] process_one_work+0x85f/0x1010 [ 237.192854][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 237.198504][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 237.203824][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 237.208876][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 237.214452][ T4196] ? wq_worker_running+0x97/0x170 [ 237.219503][ T4196] worker_thread+0xaa6/0x1290 [ 237.224220][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 237.229443][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 237.235379][ T4196] kthread+0x436/0x520 [ 237.239467][ T4196] ? rcu_lock_release+0x20/0x20 [ 237.244335][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 237.248948][ T4196] ret_from_fork+0x1f/0x30 [ 237.253404][ T4196] [ 237.309024][ T4196] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 237.324798][ T4196] Bluetooth: hci4: failed to register connection device [ 237.334073][ T4196] Bluetooth: hci4: link tx timeout [ 237.340991][ T4196] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 237.903861][ T4229] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 237.925115][ T4229] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.115168][ T5820] sctp: failed to load transform for md5: -2 [ 239.759293][ T4229] usb 1-1: can't set config #1, error -71 [ 239.805444][ T4229] usb 1-1: USB disconnect, device number 13 [ 241.683454][ T5853] netlink: 'syz.1.434': attribute type 39 has an invalid length. [ 241.895852][ T4229] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 242.605740][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 242.615455][ T4196] CPU: 0 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 242.623037][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 242.633126][ T4196] Workqueue: hci4 hci_rx_work [ 242.637848][ T4196] Call Trace: [ 242.641234][ T4196] [ 242.644205][ T4196] dump_stack_lvl+0x188/0x250 [ 242.648912][ T4196] ? show_regs_print_info+0x20/0x20 [ 242.654219][ T4196] ? load_image+0x400/0x400 [ 242.658756][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 242.663896][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 242.668592][ T4196] ? process_one_work+0x85f/0x1010 [ 242.673728][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 242.678951][ T4196] kobject_add_internal+0x6e0/0xd90 [ 242.684179][ T4196] kobject_add+0x160/0x230 [ 242.688622][ T4196] ? kobject_init+0x1d0/0x1d0 [ 242.693326][ T4196] ? klist_children_get+0x50/0x50 [ 242.698370][ T4196] ? get_device_parent+0x121/0x3f0 [ 242.703508][ T4196] device_add+0x48c/0x1000 [ 242.707966][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 242.713030][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 242.718336][ T4196] ? __switch_to_asm+0x34/0x60 [ 242.723133][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 242.728286][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 242.733166][ T4196] ? mark_lock+0x94/0x320 [ 242.737520][ T4196] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 242.743527][ T4196] ? lock_chain_count+0x20/0x20 [ 242.749039][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 242.755681][ T4196] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 242.761337][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 242.766571][ T4196] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 242.772238][ T4196] ? hci_event_packet+0x5f4/0x1370 [ 242.777375][ T4196] hci_event_packet+0xe4b/0x1370 [ 242.782339][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 242.787661][ T4196] ? rcu_lock_release+0x20/0x20 [ 242.792542][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 242.797776][ T4196] hci_rx_work+0x255/0xa10 [ 242.802235][ T4196] process_one_work+0x85f/0x1010 [ 242.807296][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 242.812973][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 242.818297][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 242.823355][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 242.828925][ T4196] ? wq_worker_running+0x97/0x170 [ 242.834059][ T4196] worker_thread+0xaa6/0x1290 [ 242.838771][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 242.844000][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 242.849945][ T4196] kthread+0x436/0x520 [ 242.854120][ T4196] ? rcu_lock_release+0x20/0x20 [ 242.859000][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 242.863631][ T4196] ret_from_fork+0x1f/0x30 [ 242.868177][ T4196] [ 243.005828][ T4229] usb 1-1: Using ep0 maxpacket: 8 [ 243.218997][ T4196] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 243.257898][ T4196] Bluetooth: hci4: failed to register connection device [ 243.277153][ T4196] Bluetooth: hci4: link tx timeout [ 243.283058][ T4196] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 244.141163][ T5864] CUSE: info not properly terminated [ 244.266287][ T4229] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 245.346005][ T4229] usb 1-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 245.355370][ T4229] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.566264][ T4229] usb 1-1: Product: syz [ 245.570495][ T4229] usb 1-1: Manufacturer: syz [ 245.597753][ T4229] usb 1-1: config 0 descriptor?? [ 245.626454][ T4229] usb 1-1: can't set config #0, error -71 [ 246.055934][ T151] block nbd3: Attempted send on invalid socket [ 246.062251][ T151] blk_update_request: I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 246.073087][ T4229] usb 1-1: USB disconnect, device number 14 [ 246.073805][ T5887] SQUASHFS error: Failed to read block 0x0: -5 [ 246.085459][ T5887] unable to read squashfs_super_block [ 246.150191][ T5890] netlink: 44 bytes leftover after parsing attributes in process `syz.4.447'. [ 246.389754][ T5896] netlink: 'syz.1.449': attribute type 39 has an invalid length. [ 246.469116][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 246.478767][ T4196] CPU: 0 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 246.486353][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 246.496441][ T4196] Workqueue: hci4 hci_rx_work [ 246.501169][ T4196] Call Trace: [ 246.504477][ T4196] [ 246.507429][ T4196] dump_stack_lvl+0x188/0x250 [ 246.512134][ T4196] ? show_regs_print_info+0x20/0x20 [ 246.517357][ T4196] ? load_image+0x400/0x400 [ 246.521894][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 246.527035][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 246.531742][ T4196] ? process_one_work+0x85f/0x1010 [ 246.536967][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 246.542193][ T4196] kobject_add_internal+0x6e0/0xd90 [ 246.547431][ T4196] kobject_add+0x160/0x230 [ 246.551881][ T4196] ? kobject_init+0x1d0/0x1d0 [ 246.556583][ T4196] ? klist_children_get+0x50/0x50 [ 246.561632][ T4196] ? get_device_parent+0x121/0x3f0 [ 246.566774][ T4196] device_add+0x48c/0x1000 [ 246.571229][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 246.576194][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 246.581499][ T4196] ? __switch_to_asm+0x34/0x60 [ 246.586304][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 246.591461][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 246.596348][ T4196] ? hci_event_packet+0x37e/0x1370 [ 246.601574][ T4196] ? __lock_acquire+0x7d10/0x7d10 [ 246.606630][ T4196] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 246.612730][ T4196] ? lock_chain_count+0x20/0x20 [ 246.617607][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 246.623705][ T4196] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 246.629365][ T4196] ? mutex_unlock+0x10/0x10 [ 246.633895][ T4196] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 246.639563][ T4196] hci_event_packet+0xe4b/0x1370 [ 246.644613][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 246.649847][ T4196] ? rcu_lock_release+0x20/0x20 [ 246.654738][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 246.659994][ T4196] hci_rx_work+0x255/0xa10 [ 246.664475][ T4196] process_one_work+0x85f/0x1010 [ 246.669460][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 246.675121][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 246.680526][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 246.685683][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 246.691254][ T4196] ? wq_worker_running+0x97/0x170 [ 246.696303][ T4196] worker_thread+0xaa6/0x1290 [ 246.701022][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 246.706946][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 246.712880][ T4196] kthread+0x436/0x520 [ 246.716971][ T4196] ? rcu_lock_release+0x20/0x20 [ 246.721855][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 246.726467][ T4196] ret_from_fork+0x1f/0x30 [ 246.730923][ T4196] [ 246.818984][ T4196] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 246.867100][ T4196] Bluetooth: hci4: failed to register connection device [ 246.896973][ T4196] Bluetooth: hci4: link tx timeout [ 246.907458][ T4196] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 250.207502][ T5906] CUSE: info not properly terminated [ 250.775995][ T5910] comedi comedi0: Minor 3 could not be opened [ 250.821048][ T5913] netlink: 8 bytes leftover after parsing attributes in process `syz.4.457'. [ 254.657032][ T5933] syz.2.461 (5933) used greatest stack depth: 21040 bytes left [ 254.804898][ T264] block nbd2: Attempted send on invalid socket [ 254.811805][ T264] blk_update_request: I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 254.822883][ T5937] SQUASHFS error: Failed to read block 0x0: -5 [ 254.829158][ T5937] unable to read squashfs_super_block [ 255.007442][ T4196] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 255.017125][ T4196] CPU: 0 PID: 4196 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 255.024720][ T4196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 255.034796][ T4196] Workqueue: hci4 hci_rx_work [ 255.039524][ T4196] Call Trace: [ 255.042833][ T4196] [ 255.045796][ T4196] dump_stack_lvl+0x188/0x250 [ 255.050507][ T4196] ? show_regs_print_info+0x20/0x20 [ 255.055730][ T4196] ? load_image+0x400/0x400 [ 255.060275][ T4196] sysfs_create_dir_ns+0x26a/0x290 [ 255.065413][ T4196] ? sysfs_warn_dup+0xa0/0xa0 [ 255.070114][ T4196] ? process_one_work+0x85f/0x1010 [ 255.075248][ T4196] ? do_raw_spin_unlock+0x11d/0x230 [ 255.080475][ T4196] kobject_add_internal+0x6e0/0xd90 [ 255.085790][ T4196] kobject_add+0x160/0x230 [ 255.090244][ T4196] ? kobject_init+0x1d0/0x1d0 [ 255.095039][ T4196] ? klist_children_get+0x50/0x50 [ 255.100178][ T4196] ? get_device_parent+0x121/0x3f0 [ 255.105322][ T4196] device_add+0x48c/0x1000 [ 255.109949][ T4196] hci_conn_add_sysfs+0xd1/0x1e0 [ 255.115038][ T4196] le_conn_complete_evt+0xc4b/0x15c0 [ 255.120362][ T4196] ? cs_le_create_conn+0x5e0/0x5e0 [ 255.125503][ T4196] ? __mutex_trylock_common+0x155/0x260 [ 255.131222][ T4196] hci_le_meta_evt+0x285/0x3cb0 [ 255.136364][ T4196] ? hci_event_packet+0x37e/0x1370 [ 255.141501][ T4196] ? __lock_acquire+0x7d10/0x7d10 [ 255.146567][ T4196] ? hci_remote_host_features_evt+0x290/0x290 [ 255.152655][ T4196] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 255.158312][ T4196] ? mark_lock+0x94/0x320 [ 255.162668][ T4196] ? mutex_unlock+0x10/0x10 [ 255.167200][ T4196] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 255.173204][ T4196] ? lock_chain_count+0x20/0x20 [ 255.178077][ T4196] ? __rwlock_init+0x140/0x140 [ 255.182866][ T4196] hci_event_packet+0xe4b/0x1370 [ 255.187826][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 255.193056][ T4196] ? rcu_lock_release+0x20/0x20 [ 255.198041][ T4196] ? hci_send_to_monitor+0x9c/0x4a0 [ 255.203266][ T4196] hci_rx_work+0x255/0xa10 [ 255.207794][ T4196] process_one_work+0x85f/0x1010 [ 255.212779][ T4196] ? worker_detach_from_pool+0x240/0x240 [ 255.218433][ T4196] ? lockdep_hardirqs_off+0x70/0x100 [ 255.223744][ T4196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 255.228789][ T4196] ? _raw_spin_lock_irqsave+0x100/0x100 [ 255.234465][ T4196] ? wq_worker_running+0x97/0x170 [ 255.239510][ T4196] worker_thread+0xaa6/0x1290 [ 255.244226][ T4196] ? lockdep_hardirqs_on+0x94/0x140 [ 255.249453][ T4196] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 255.255491][ T4196] kthread+0x436/0x520 [ 255.259583][ T4196] ? rcu_lock_release+0x20/0x20 [ 255.264805][ T4196] ? kthread_blkcg+0xd0/0xd0 [ 255.269505][ T4196] ret_from_fork+0x1f/0x30 [ 255.274085][ T4196] [ 255.296879][ T4196] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 255.312991][ T4196] Bluetooth: hci4: failed to register connection device [ 255.321487][ T4196] Bluetooth: hci4: link tx timeout [ 255.326958][ T4196] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 255.334937][ T4196] Bluetooth: hci4: link tx timeout [ 255.340419][ T4196] Bluetooth: hci4: killing stalled connection 00:00:00:6b:72:61 [ 255.350684][ T4196] Bluetooth: hci4: killing stalled connection 00:00:00:6b:72:61 [ 255.359217][ T4196] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 255.788681][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.795203][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.027657][ T5941] netlink: 'syz.1.463': attribute type 39 has an invalid length. [ 257.824512][ T5956] netlink: 8 bytes leftover after parsing attributes in process `syz.3.468'. [ 257.848539][ T4234] Bluetooth: hci4: command 0x0406 tx timeout [ 259.267449][ T5972] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 259.395801][ T23] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 259.865904][ T4234] Bluetooth: hci4: command 0x0406 tx timeout [ 260.162425][ T5981] netlink: 4 bytes leftover after parsing attributes in process `syz.2.477'. [ 260.222992][ T5981] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 260.350624][ T5981] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 260.494430][ T5981] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 260.501993][ T5981] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 260.627455][ T5985] netlink: 8 bytes leftover after parsing attributes in process `syz.3.478'. [ 260.636415][ T5985] netlink: 4 bytes leftover after parsing attributes in process `syz.3.478'. [ 260.650683][ T5985] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.659972][ T5985] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.668833][ T5985] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.677628][ T5985] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.689750][ T5985] netlink: 8 bytes leftover after parsing attributes in process `syz.3.478'. [ 260.698721][ T5985] netlink: 4 bytes leftover after parsing attributes in process `syz.3.478'. [ 260.735809][ T23] usb 1-1: Using ep0 maxpacket: 8 [ 260.786199][ T5986] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.795221][ T5986] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.804132][ T5986] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.812904][ T5986] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.837728][ T5986] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 260.846754][ T5986] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 260.855641][ T5986] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 260.864574][ T5986] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 261.015977][ T23] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 261.071614][ T5987] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 261.080720][ T5987] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 261.089642][ T5987] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 261.098654][ T5987] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 261.112904][ T5987] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 261.122031][ T5987] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 261.131201][ T5987] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 261.141023][ T5987] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 261.270679][ T23] usb 1-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 261.281155][ T5998] netlink: 'syz.2.483': attribute type 39 has an invalid length. [ 261.293842][ T23] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.316284][ T5997] netlink: 8 bytes leftover after parsing attributes in process `syz.3.482'. [ 261.333107][ T23] usb 1-1: Product: syz [ 261.459939][ T6000] comedi comedi3: board detection failed [ 262.323419][ T4234] Bluetooth: hci4: command 0x0406 tx timeout [ 262.344658][ T23] usb 1-1: config 0 descriptor?? [ 262.415863][ T23] usb 1-1: can't set config #0, error -71 [ 262.425410][ T23] usb 1-1: USB disconnect, device number 15 [ 262.660536][ T6015] netlink: 12 bytes leftover after parsing attributes in process `syz.4.489'. [ 262.669667][ T6015] netlink: 'syz.4.489': attribute type 2 has an invalid length. [ 262.677871][ T6015] netlink: 'syz.4.489': attribute type 1 has an invalid length. [ 262.711270][ T6015] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 262.719734][ T6015] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 262.729154][ T6015] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 263.656848][ T6024] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x000000000000016c' [ 263.944862][ T264] block nbd0: Attempted send on invalid socket [ 263.951229][ T264] blk_update_request: I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 263.965786][ T6035] SQUASHFS error: Failed to read block 0x0: -5 [ 263.972225][ T6035] unable to read squashfs_super_block [ 264.686485][ T6041] netlink: 8 bytes leftover after parsing attributes in process `syz.3.500'. [ 264.696717][ T21] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 265.315987][ T21] usb 5-1: Using ep0 maxpacket: 8 [ 265.696080][ T21] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 265.886063][ T21] usb 5-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 266.773341][ T6061] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0x0000000000000120' [ 266.859103][ T6062] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 266.867714][ T6062] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 266.876819][ T6062] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 267.058717][ T21] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.066893][ T21] usb 5-1: Product: syz [ 267.071093][ T21] usb 5-1: Manufacturer: syz [ 267.075812][ T21] usb 5-1: SerialNumber: syz [ 267.084733][ T21] usb 5-1: config 0 descriptor?? [ 267.105883][ T21] usb 5-1: can't set config #0, error -71 [ 267.125783][ T21] usb 5-1: USB disconnect, device number 7 [ 267.286378][ T264] block nbd4: Attempted send on invalid socket [ 267.292938][ T264] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 267.306415][ T6074] SQUASHFS error: Failed to read block 0x0: -5 [ 267.312681][ T6074] unable to read squashfs_super_block [ 269.330711][ T6099] device syzkaller0 entered promiscuous mode [ 270.523689][ T6109] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 270.532599][ T6109] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 270.541710][ T6109] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 271.136036][ T21] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 271.435888][ T21] usb 2-1: Using ep0 maxpacket: 8 [ 271.518950][ T6117] overlayfs: unrecognized mount option "seclabel" or missing value [ 271.534882][ T6121] tipc: Started in network mode [ 271.550755][ T6121] tipc: Node identity 3e7a81955982, cluster identity 4711 [ 271.570576][ T6121] tipc: Enabled bearer , priority 0 [ 271.604687][ T6121] netlink: 44 bytes leftover after parsing attributes in process `syz.0.526'. [ 271.634940][ T6121] tipc: Resetting bearer [ 271.706537][ T21] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 271.732996][ T6120] tipc: Disabling bearer [ 272.576071][ T21] usb 2-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 272.610969][ T21] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.633475][ T21] usb 2-1: Product: syz [ 272.647980][ T21] usb 2-1: Manufacturer: syz [ 272.652650][ T21] usb 2-1: SerialNumber: syz [ 272.702773][ T21] usb 2-1: config 0 descriptor?? [ 274.236570][ T21] msi2500 2-1:0.0: Registered as swradio24 [ 274.242446][ T21] msi2500 2-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 274.255628][ T21] usb 2-1: USB disconnect, device number 6 [ 278.165807][ T4432] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 279.188569][ T6186] tipc: Enabling of bearer rejected, failed to enable media [ 279.424203][ T4432] usb 1-1: device not accepting address 16, error -71 [ 280.198068][ T13] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 280.465944][ T13] usb 3-1: Using ep0 maxpacket: 8 [ 280.631416][ T13] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 281.056971][ T13] usb 3-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 281.157348][ T13] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.351995][ T13] usb 3-1: Product: syz [ 281.398200][ T13] usb 3-1: Manufacturer: syz [ 281.485821][ T13] usb 3-1: SerialNumber: syz [ 281.521440][ T13] usb 3-1: config 0 descriptor?? [ 282.150713][ T6237] netlink: 16 bytes leftover after parsing attributes in process `syz.0.559'. [ 282.175905][ T4234] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 282.225059][ T13] msi2500 3-1:0.0: Registered as swradio24 [ 282.240405][ T13] msi2500 3-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 282.267901][ T13] usb 3-1: USB disconnect, device number 8 [ 282.333044][ T6243] fuse: Unknown parameter '184467440737095516150xffffffffffffffff0xffffffffffffffff' [ 282.431268][ T4234] usb 2-1: Using ep0 maxpacket: 8 [ 282.556074][ T4234] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 282.727406][ T4234] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 283.146033][ T4234] usb 2-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 283.227197][ T4234] usb 2-1: New USB device strings: Mfr=1, Product=0, SerialNumber=3 [ 283.277048][ T4234] usb 2-1: Manufacturer: syz [ 283.304081][ T4234] usb 2-1: SerialNumber: syz [ 283.414328][ T6263] tipc: Enabling of bearer rejected, failed to enable media [ 284.195997][ T4234] usb 2-1: 0:1 : does not exist [ 284.200965][ T4234] usb 2-1: unit 5 not found! [ 284.205608][ T4234] usb 2-1: unit 0 not found! [ 284.229985][ T4234] usb 2-1: USB disconnect, device number 7 [ 285.453229][ T6279] ODEBUG: Out of memory. ODEBUG disabled [ 285.646342][ T4182] udevd[4182]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 287.025887][ T4177] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 287.037653][ T6304] tipc: Enabling of bearer rejected, failed to enable media [ 287.805745][ T4177] usb 3-1: Using ep0 maxpacket: 8 [ 288.026051][ T4177] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 288.215947][ T4177] usb 3-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 288.225054][ T4177] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.265753][ T4177] usb 3-1: Product: syz [ 288.276629][ T4177] usb 3-1: Manufacturer: syz [ 288.288505][ T4177] usb 3-1: SerialNumber: syz [ 288.315014][ T4177] usb 3-1: config 0 descriptor?? [ 288.363690][ T6332] netlink: 56 bytes leftover after parsing attributes in process `syz.1.583'. [ 288.467723][ T4177] msi2500 3-1:0.0: Registered as swradio24 [ 288.473603][ T4177] msi2500 3-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 288.561135][ T4177] usb 3-1: USB disconnect, device number 9 [ 288.663629][ T6346] ======================================================= [ 288.663629][ T6346] WARNING: The mand mount option has been deprecated and [ 288.663629][ T6346] and is ignored by this kernel. Remove the mand [ 288.663629][ T6346] option from the mount to silence this warning. [ 288.663629][ T6346] ======================================================= [ 288.874229][ T4357] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 289.014926][ T6349] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 289.336271][ T4357] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 289.414244][ T4357] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 289.723488][ T4357] usb 2-1: config 0 descriptor?? [ 290.197997][ T6337] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 290.645675][ C0] sched: RT throttling activated [ 290.661692][ T6337] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 1th superblock [ 290.676321][ T6337] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 290.684211][ T6337] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 2th superblock [ 291.227104][ T4357] ath6kl: Failed to submit usb control message: -110 [ 291.243161][ T4357] ath6kl: unable to send the bmi data to the device: -110 [ 291.673974][ T4357] ath6kl: Unable to send get target info: -110 [ 291.825805][ T4234] Bluetooth: hci5: command 0x1003 tx timeout [ 291.831992][ T4190] Bluetooth: hci5: sending frame failed (-49) [ 292.587988][ T4357] ath6kl: Failed to init ath6kl core: -110 [ 292.617598][ T4357] ath6kl_usb: probe of 2-1:0.0 failed with error -110 [ 293.008052][ T6373] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 293.866185][ T4177] Bluetooth: hci5: command 0x1001 tx timeout [ 293.875949][ T4190] Bluetooth: hci5: sending frame failed (-49) [ 295.320442][ T6407] tipc: Enabling of bearer rejected, failed to enable media [ 295.497022][ T6420] netlink: 44 bytes leftover after parsing attributes in process `syz.0.607'. [ 295.959008][ T13] Bluetooth: hci5: command 0x1009 tx timeout [ 296.831405][ T6441] netlink: 8 bytes leftover after parsing attributes in process `syz.0.615'. [ 298.378365][ T6461] kvm [6460]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc2 data 0x0 [ 298.411271][ T6461] kvm [6460]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc1 data 0x0 [ 298.497219][ T6461] kvm [6460]: vcpu0, guest rIP: 0x1b8 ignored wrmsr: 0x11e data 0xbe702111 [ 298.545787][ T4177] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 298.730869][ T4234] usb 2-1: USB disconnect, device number 8 [ 298.749282][ T13] Bluetooth: hci4: command 0x0405 tx timeout [ 298.795882][ T4177] usb 5-1: Using ep0 maxpacket: 8 [ 298.918705][ T4177] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 299.096136][ T4177] usb 5-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 299.136597][ T4177] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.158189][ T4177] usb 5-1: Product: syz [ 299.162409][ T4177] usb 5-1: Manufacturer: syz [ 299.560213][ T4177] usb 5-1: SerialNumber: syz [ 299.756027][ T4177] usb 5-1: config 0 descriptor?? [ 299.952499][ T6473] ------------[ cut here ]------------ [ 299.975818][ T6473] WARNING: CPU: 1 PID: 6473 at include/linux/fs.h:532 hugetlb_split+0x237/0x2a0 [ 299.984954][ T6473] Modules linked in: [ 300.037908][ T4177] msi2500 5-1:0.0: Registered as swradio24 [ 300.044884][ T4177] msi2500 5-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 300.085552][ T4177] usb 5-1: USB disconnect, device number 8 [ 300.118168][ T6473] CPU: 1 PID: 6473 Comm: syz.1.623 Not tainted syzkaller #0 [ 300.146090][ T6473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 300.207096][ T6473] RIP: 0010:hugetlb_split+0x237/0x2a0 [ 300.212791][ T6473] Code: bf ff 4c 89 f7 48 89 de 4c 89 fa 31 c9 5b 41 5c 41 5d 41 5e 41 5f 5d eb 7a e8 65 ad bf ff 0f 0b e9 62 fe ff ff e8 59 ad bf ff <0f> 0b e9 2d ff ff ff 48 c7 c1 84 3a 8a 8d 80 e1 07 80 c1 03 38 c1 [ 300.235358][ T6473] RSP: 0018:ffffc900036df938 EFLAGS: 00010287 [ 300.244781][ T6473] RAX: ffffffff81b99b97 RBX: 0000200000200000 RCX: 0000000000080000 [ 300.255353][ T6473] RDX: ffffc90003f13000 RSI: 00000000000000ba RDI: 00000000000000bb [ 300.263944][ T6473] RBP: 0000000000000000 R08: ffff88807a479cbf R09: 1ffff1100f48f397 [ 300.285773][ T6473] R10: dffffc0000000000 R11: ffffed100f48f398 R12: ffff8880759fd6d0 [ 300.293855][ T6473] R13: dffffc0000000000 R14: ffff8880759fd630 R15: ffff8880768141c0 [ 300.308612][ T6473] FS: 00007f7ab011b6c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 [ 300.318497][ T6473] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 300.325185][ T6473] CR2: 00007f450c865158 CR3: 0000000073afe000 CR4: 00000000003506f0 [ 300.333687][ T6473] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 300.354830][ T6473] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 300.364299][ T6473] Call Trace: [ 300.369965][ T6473] [ 300.373050][ T6473] __vma_adjust+0x2b6/0x1c10 [ 300.378164][ T6473] ? memset+0x1e/0x40 [ 300.382271][ T6473] __split_vma+0x34b/0x410 [ 300.386988][ T6473] __do_munmap+0x3fe/0xdf0 [ 300.391534][ T6473] mmap_region+0x8b4/0x1650 [ 300.396240][ T6473] ? bpf_lsm_mmap_addr+0x5/0x10 [ 300.401241][ T6473] do_mmap+0x819/0xe90 [ 300.405449][ T6473] vm_mmap_pgoff+0x1c1/0x2d0 [ 300.410334][ T6473] ? account_locked_vm+0xe0/0xe0 [ 300.415520][ T6473] ? __lock_acquire+0x7d10/0x7d10 [ 300.421141][ T6473] ksys_mmap_pgoff+0x140/0x790 [ 300.427664][ T6473] ? acct_account_cputime+0x1a2/0x280 [ 300.433265][ T6473] ? mmap_region+0x1650/0x1650 [ 300.438941][ T6473] ? lockdep_hardirqs_on+0x94/0x140 [ 300.444449][ T6473] do_syscall_64+0x4c/0xa0 [ 300.449146][ T6473] ? clear_bhb_loop+0x30/0x80 [ 300.454037][ T6473] ? clear_bhb_loop+0x30/0x80 [ 300.460216][ T6473] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 300.466372][ T6473] RIP: 0033:0x7f7ab1ec1e59 [ 300.471045][ T6473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 300.490816][ T6473] RSP: 002b:00007f7ab011b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 300.499633][ T6473] RAX: ffffffffffffffda RBX: 00007f7ab213afa0 RCX: 00007f7ab1ec1e59 [ 300.507918][ T6473] RDX: 000000000200000b RSI: 0000000000200000 RDI: 0000200000000000 [ 300.516096][ T6473] RBP: 00007f7ab1f57d6f R08: ffffffffffffffff R09: 00000000ec776000 [ 300.524211][ T6473] R10: 0000000000204031 R11: 0000000000000246 R12: 0000000000000000 [ 300.532397][ T6473] R13: 00007f7ab213b038 R14: 00007f7ab213afa0 R15: 00007ffd65aa40e8 [ 300.540765][ T6473] [ 300.543981][ T6473] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 300.551299][ T6473] CPU: 1 PID: 6473 Comm: syz.1.623 Not tainted syzkaller #0 [ 300.558692][ T6473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 300.568777][ T6473] Call Trace: [ 300.572101][ T6473] [ 300.575030][ T6473] dump_stack_lvl+0x188/0x250 [ 300.579728][ T6473] ? show_regs_print_info+0x20/0x20 [ 300.584925][ T6473] ? load_image+0x400/0x400 [ 300.589447][ T6473] panic+0x2e5/0x810 [ 300.593379][ T6473] ? bpf_jit_dump+0xd0/0xd0 [ 300.598093][ T6473] ? hugetlb_split+0x237/0x2a0 [ 300.602975][ T6473] __warn+0x248/0x2b0 [ 300.606996][ T6473] ? hugetlb_split+0x237/0x2a0 [ 300.611878][ T6473] report_bug+0x1b7/0x2e0 [ 300.616252][ T6473] handle_bug+0x3a/0x70 [ 300.620434][ T6473] exc_invalid_op+0x16/0x40 [ 300.625130][ T6473] asm_exc_invalid_op+0x16/0x20 [ 300.630009][ T6473] RIP: 0010:hugetlb_split+0x237/0x2a0 [ 300.635409][ T6473] Code: bf ff 4c 89 f7 48 89 de 4c 89 fa 31 c9 5b 41 5c 41 5d 41 5e 41 5f 5d eb 7a e8 65 ad bf ff 0f 0b e9 62 fe ff ff e8 59 ad bf ff <0f> 0b e9 2d ff ff ff 48 c7 c1 84 3a 8a 8d 80 e1 07 80 c1 03 38 c1 [ 300.655155][ T6473] RSP: 0018:ffffc900036df938 EFLAGS: 00010287 [ 300.661232][ T6473] RAX: ffffffff81b99b97 RBX: 0000200000200000 RCX: 0000000000080000 [ 300.669221][ T6473] RDX: ffffc90003f13000 RSI: 00000000000000ba RDI: 00000000000000bb [ 300.677226][ T6473] RBP: 0000000000000000 R08: ffff88807a479cbf R09: 1ffff1100f48f397 [ 300.685310][ T6473] R10: dffffc0000000000 R11: ffffed100f48f398 R12: ffff8880759fd6d0 [ 300.693291][ T6473] R13: dffffc0000000000 R14: ffff8880759fd630 R15: ffff8880768141c0 [ 300.701280][ T6473] ? hugetlb_split+0x237/0x2a0 [ 300.706062][ T6473] ? hugetlb_split+0x237/0x2a0 [ 300.710845][ T6473] __vma_adjust+0x2b6/0x1c10 [ 300.715536][ T6473] ? memset+0x1e/0x40 [ 300.719521][ T6473] __split_vma+0x34b/0x410 [ 300.724062][ T6473] __do_munmap+0x3fe/0xdf0 [ 300.728498][ T6473] mmap_region+0x8b4/0x1650 [ 300.733039][ T6473] ? bpf_lsm_mmap_addr+0x5/0x10 [ 300.737899][ T6473] do_mmap+0x819/0xe90 [ 300.741984][ T6473] vm_mmap_pgoff+0x1c1/0x2d0 [ 300.746585][ T6473] ? account_locked_vm+0xe0/0xe0 [ 300.751569][ T6473] ? __lock_acquire+0x7d10/0x7d10 [ 300.756721][ T6473] ksys_mmap_pgoff+0x140/0x790 [ 300.761508][ T6473] ? acct_account_cputime+0x1a2/0x280 [ 300.766888][ T6473] ? mmap_region+0x1650/0x1650 [ 300.771674][ T6473] ? lockdep_hardirqs_on+0x94/0x140 [ 300.776895][ T6473] do_syscall_64+0x4c/0xa0 [ 300.781364][ T6473] ? clear_bhb_loop+0x30/0x80 [ 300.786057][ T6473] ? clear_bhb_loop+0x30/0x80 [ 300.790775][ T6473] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 300.796796][ T6473] RIP: 0033:0x7f7ab1ec1e59 [ 300.801243][ T6473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 300.820973][ T6473] RSP: 002b:00007f7ab011b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 300.829521][ T6473] RAX: ffffffffffffffda RBX: 00007f7ab213afa0 RCX: 00007f7ab1ec1e59 [ 300.837632][ T6473] RDX: 000000000200000b RSI: 0000000000200000 RDI: 0000200000000000 [ 300.845640][ T6473] RBP: 00007f7ab1f57d6f R08: ffffffffffffffff R09: 00000000ec776000 [ 300.853647][ T6473] R10: 0000000000204031 R11: 0000000000000246 R12: 0000000000000000 [ 300.861633][ T6473] R13: 00007f7ab213b038 R14: 00007f7ab213afa0 R15: 00007ffd65aa40e8 [ 300.869616][ T6473] [ 300.872864][ T6473] Kernel Offset: disabled [ 300.877389][ T6473] Rebooting in 86400 seconds..