last executing test programs: 3.956634949s ago: executing program 1 (id=2): add_key$keyring(&(0x7f0000000100), &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, 0xfffffffd) r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000900)='syz \x00', 0x5) bind$rxrpc(r0, &(0x7f0000000300)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0xc351, @loopback}}, 0x24) listen(r0, 0xa) r1 = socket$rxrpc(0x21, 0x2, 0x2) add_key(&(0x7f0000000400)='rxrpc\x00', &(0x7f0000000500)={'syz', 0x0}, &(0x7f0000000600)="0100000002000800ffffff7f010000000011223344556677aabbccddeeff0011", 0x20, 0xfffffffd) setsockopt$RXRPC_SECURITY_KEY(r1, 0x110, 0x1, &(0x7f0000000a00)='syz \x00', 0x5) connect$rxrpc(r1, &(0x7f0000000700)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0xc351, @loopback}}, 0x24) sendmsg(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000d00)='hello', 0x5}], 0x1, &(0x7f0000000e00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0) recvmsg(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000001100)=[{&(0x7f0000001200)=""/100, 0x64}], 0x1}, 0x0) nanosleep(&(0x7f0000000f00)={0x0, 0x1dcd6500}, 0x0) 3.645407684s ago: executing program 0 (id=1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@code={0xa, 0x19, {"48c7c4000004009d"}}], 0x19}) r4 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r3, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_memcpy_off$KVM_EXIT_MMIO(r4, 0x20, &(0x7f0000000000), 0x0, 0x10) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.249675973s ago: executing program 0 (id=6): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) sched_yield() nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000200)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000200)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000200)={0x2, 0xab}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000200)={0x2, 0x83}, 0x2) sched_yield() nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) 3.160886628s ago: executing program 3 (id=4): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000100)={0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) 2.958576435s ago: executing program 1 (id=7): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000080)=[@wrmsr={0x65, 0x0, {0x1b, 0xfee00c00}}, @wrmsr={0x65, 0x0, {0x808}}, @rdmsr={0x66, 0x0, {0x808}}]}) ioctl$KVM_TPR_ACCESS_REPORTING(r3, 0xc028ae92, &(0x7f0000000100)={0x1}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000180)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x200000}]}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x1b, 0x0, 0xfee00c00}]}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.866051566s ago: executing program 3 (id=8): syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x4b4, 0x2102, 0x0, 0x1, 0x2, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x40}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 2.619588497s ago: executing program 2 (id=3): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='file0\x00', 0x42, 0x1ff) quotactl_fd$Q_GETNEXTQUOTA(r0, 0x80002800, 0x0, &(0x7f00000000c0)) quotactl_fd$Q_GETNEXTQUOTA(r0, 0x80002801, 0x0, &(0x7f0000000140)) quotactl_fd$Q_GETNEXTQUOTA(r0, 0x80002802, 0x0, &(0x7f00000001c0)) 2.521369712s ago: executing program 1 (id=9): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_normal', 0x1, 0x0) write(r0, &(0x7f0000000080)='gadget.0\x00', 0x8) close(r0) 2.331497827s ago: executing program 2 (id=10): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source\x00', &(0x7f0000000040)='127.0.0.1:6789:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b80)='secret\x00', &(0x7f0000000080)='invalid_secret\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) close(r0) 2.331291256s ago: executing program 0 (id=11): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000080)=[@code={0xa, 0x13, {"ebfe"}}], 0x13}) r4 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000180)=[@code={0xa, 0x13, {"ebfe"}}], 0x13}) ioctl$KVM_SET_TSC_KHZ_cpu(r3, 0xaea2, 0x186a0) ioctl$KVM_SET_TSC_KHZ_cpu(r4, 0xaea2, 0x186a0) ioctl$KVM_CAP_XEN_HVM(r1, 0x4068aea3, &(0x7f0000000100)={0x26, 0x0, 0x2}) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x0, 0x1000}) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) 2.331166025s ago: executing program 1 (id=12): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b41801100000010200010902240002010080fa0904000000000000000904010000ff000000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x10, &(0x7f0000000200)={0xc0, 0x1, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x2}, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000400), 0x1, 0x2) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000500)={&(0x7f0000000600)=[{0xff, 0x0, 0x1, &(0x7f0000000700)='3'}, {0xff, 0x1, 0x1, &(0x7f0000000800)='\v'}], 0x2}) r2 = syz_open_dev$I2C(&(0x7f0000000400), 0x1, 0x2) ioctl$I2C_RDWR(r2, 0x707, &(0x7f0000000500)={&(0x7f0000000600)=[{0xff, 0x0, 0x1, &(0x7f0000000700)='3'}, {0xff, 0x1, 0x1, &(0x7f0000000800)='\v'}], 0x2}) r3 = syz_open_dev$I2C(&(0x7f0000000400), 0x2, 0x2) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000500)={&(0x7f0000000600)=[{0xff, 0x0, 0x1, &(0x7f0000000700)='3'}, {0xff, 0x1, 0x1, &(0x7f0000000800)='\v'}], 0x2}) r4 = syz_open_dev$I2C(&(0x7f0000000400), 0x2, 0x2) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000500)={&(0x7f0000000600)=[{0xff, 0x0, 0x1, &(0x7f0000000700)='3'}, {0xff, 0x1, 0x1, &(0x7f0000000800)='\v'}], 0x2}) 1.92790051s ago: executing program 2 (id=13): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r3, 0x3, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000080)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x8000}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x345, 0x0, 0x2000}]}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000000c0)="e680", 0x2}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x345}]}) 1.820991826s ago: executing program 0 (id=14): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x200}]}) ioctl$KVM_GET_LAPIC(r2, 0x8400ae8e, &(0x7f0000000200)) ioctl$KVM_SET_LAPIC(r2, 0x4038ae8e, &(0x7f0000000200)={"ff00"}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x6e0, 0x0, 0x1}]}) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.33625712s ago: executing program 0 (id=15): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480)) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0x68, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @key_params=[@NL80211_ATTR_KEY_IDX={0x5}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP40={0x9}, @NL80211_ATTR_KEY_TYPE={0x8}], @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x68}}, 0x0) 1.304169939s ago: executing program 2 (id=16): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_to_batadv\x00', 0x0}) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, &(0x7f0000000040)="000f32000000000100112233446600112233445500ff0000", 0x18, 0x0, &(0x7f0000000200)={0x11, 0x543, r2, 0x1, 0x1, 0x6, @broadcast}, 0x14) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@dellink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}}, 0x20}}, 0x0) 910.534006ms ago: executing program 4 (id=18): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000400)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000500)={{&(0x7f0000d00000/0x1000)=nil, 0x1000}, 0x1}) r3 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@wrmsr={0x0, 0x0, {0x4b564d02, 0x9}}, @code={0x0, 0x0, {"48b80000100000000000488b00"}}, @uexit={0x0, 0x0, 0x1}]}) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r5, 0x3, 0x11, r4, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000600)={{&(0x7f0000d00000/0x1000)=nil, 0x1000}}) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x4b564d02, 0x0, 0x9}]}) close(r2) 728.401651ms ago: executing program 4 (id=19): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000)=nil) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000100)={0x2, 0x40000000, 0x0, 0x0}) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000200)={0x0, &(0x7f0000000300)=[@wrmsr={0x65, 0x18, {0x40000000, 0x1}}, @code={0x0, 0x20, {"4831c04883c01d4831bf0f01c1"}}], 0x3e}) r4 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000400)={0x0, &(0x7f0000000500)=[@uexit={0x0, 0x10, 0x1234}], 0x18}) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r5, 0x3, 0x11, r3, 0x0) mmap$KVM_VCPU(&(0x7f000000a000/0x1000)=nil, r5, 0x3, 0x11, r4, 0x0) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f0000000600)=0x3) ioctl$KVM_RUN(r3, 0xae80, 0x0) 609.341312ms ago: executing program 2 (id=20): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, 0x0) 467.193001ms ago: executing program 0 (id=21): clock_nanosleep(0x0, 0x0, &(0x7f0000001400)={0x1}, 0x0) 434.056497ms ago: executing program 2 (id=22): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000100)={0x2, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, {0x40000001, 0x0, 0x0, 0x1000}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d05, 0x0, 0x1}]}) ioctl$KVM_CAP_HALT_POLL(r1, 0x4068aea3, &(0x7f0000000300)={0xb6, 0x0, 0x30d40}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040ae80, &(0x7f0000000040)) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000500)=0x3) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040ae80, &(0x7f0000000080)) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000500)=0x3) ioctl$KVM_RUN(r2, 0xae80, 0x0) 392.007663ms ago: executing program 4 (id=23): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000040)={0x1000}) ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x40a0ae49, &(0x7f0000000080)={0x0, 0x4, 0x10000, 0x1000, 0x0, 0x0, r2}) close(r2) ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x40a0ae49, &(0x7f0000000080)={0x0, 0x0, 0x10000}) 282.20009ms ago: executing program 3 (id=24): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000100)=""/1000, 0x3e8) 248.364212ms ago: executing program 4 (id=25): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000500), 0xc, &(0x7f0000000140)={&(0x7f0000000180)=@ipv6_newroute={0x0, 0x18, 0x401, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x4, 0x0, 0x1}, [@RTA_GATEWAY={0x0, 0x5, @dev={0xfe, 0x80, '\x00', 0xa}}, @RTA_OIF={0x0, 0x4, 0x1}, @RTA_PRIORITY={0x0, 0x6, 0x64}]}}}, 0x0) 107.31822ms ago: executing program 4 (id=26): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x800, 0x800], 0x0, 0x2}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000400)={{0x0, 0xffff, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x0, 0xffff, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x0, 0xffff, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x0, 0xffff, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x0, 0xffff, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x0, 0xffff, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x0, 0xffff, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x0, 0xffff, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1}, {}, {}, 0x0, 0x0, 0x0, 0x10}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 4 (id=27): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x43, 0x3, 0x4d8, 0xc002, 0x0, 0x0, "05010900a10185110901150026ff0075089502810285210902150026ff0075089501810285910904150026ff0075089501910285920903150026ff00750895019102c0"}}, 0x15b) nanosleep(&(0x7f0000000200)={0x0, 0xbebc200}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.81' (ED25519) to the list of known hosts. [ 80.771531][ T5604] cgroup: Unknown subsys name 'net' [ 80.887937][ T5604] cgroup: Unknown subsys name 'cpuset' [ 80.897139][ T5604] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 82.646081][ T5604] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.010773][ T5626] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.016525][ T5628] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 85.020313][ T5627] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 85.034179][ T5626] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.041706][ T5628] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 85.048504][ T5627] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 85.055637][ T5628] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.059196][ T5628] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 85.068525][ T5626] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.076580][ T5628] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.083159][ T5626] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.093024][ T5627] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.100502][ T5626] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 85.105361][ T5628] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 85.110098][ T5627] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.116513][ T5628] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 85.130029][ T5627] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.130078][ T5628] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 85.144986][ T5627] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 85.146427][ T5628] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.162856][ T5626] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 85.171860][ T5626] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 85.179306][ T5626] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 85.187945][ T5627] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 85.195542][ T5626] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 86.323690][ T5635] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.331103][ T5635] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.338710][ T5635] bridge_slave_0: entered allmulticast mode [ 86.346187][ T5635] bridge_slave_0: entered promiscuous mode [ 86.401624][ T5635] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.408911][ T5635] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.416534][ T5635] bridge_slave_1: entered allmulticast mode [ 86.424271][ T5635] bridge_slave_1: entered promiscuous mode [ 86.449531][ T5632] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.456792][ T5632] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.464110][ T5632] bridge_slave_0: entered allmulticast mode [ 86.471651][ T5632] bridge_slave_0: entered promiscuous mode [ 86.519073][ T5632] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.526783][ T5632] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.534358][ T5632] bridge_slave_1: entered allmulticast mode [ 86.541695][ T5632] bridge_slave_1: entered promiscuous mode [ 86.548904][ T5638] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.556124][ T5638] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.563309][ T5638] bridge_slave_0: entered allmulticast mode [ 86.571098][ T5638] bridge_slave_0: entered promiscuous mode [ 86.590162][ T5634] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.597469][ T5634] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.605146][ T5634] bridge_slave_0: entered allmulticast mode [ 86.612547][ T5634] bridge_slave_0: entered promiscuous mode [ 86.638900][ T5638] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.646259][ T5638] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.653513][ T5638] bridge_slave_1: entered allmulticast mode [ 86.661150][ T5638] bridge_slave_1: entered promiscuous mode [ 86.671972][ T5635] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.681360][ T5634] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.689272][ T5634] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.696581][ T5634] bridge_slave_1: entered allmulticast mode [ 86.704706][ T5634] bridge_slave_1: entered promiscuous mode [ 86.752577][ T5635] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.788775][ T5632] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.832134][ T5637] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.839533][ T5637] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.846878][ T5637] bridge_slave_0: entered allmulticast mode [ 86.854387][ T5637] bridge_slave_0: entered promiscuous mode [ 86.865708][ T5632] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.896862][ T5638] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.909417][ T5638] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.937796][ T5634] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.947299][ T5637] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.956119][ T5637] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.963451][ T5637] bridge_slave_1: entered allmulticast mode [ 86.971881][ T5637] bridge_slave_1: entered promiscuous mode [ 87.014948][ T5635] team0: Port device team_slave_0 added [ 87.023438][ T5634] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.052042][ T5632] team0: Port device team_slave_0 added [ 87.076158][ T5635] team0: Port device team_slave_1 added [ 87.086704][ T5638] team0: Port device team_slave_0 added [ 87.127063][ T5632] team0: Port device team_slave_1 added [ 87.151799][ T5638] team0: Port device team_slave_1 added [ 87.192190][ T5637] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.260763][ T5634] team0: Port device team_slave_0 added [ 87.271466][ T5637] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.280950][ T50] Bluetooth: hci1: command tx timeout [ 87.287225][ T5625] Bluetooth: hci3: command tx timeout [ 87.287260][ T5626] Bluetooth: hci4: command tx timeout [ 87.294493][ T50] Bluetooth: hci2: command tx timeout [ 87.299281][ T5627] Bluetooth: hci0: command tx timeout [ 87.322635][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.330030][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.356937][ T5635] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.369723][ T5638] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.376847][ T5638] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.403000][ T5638] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.416845][ T5634] team0: Port device team_slave_1 added [ 87.434246][ T5632] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.441329][ T5632] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.467787][ T5632] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.479778][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.486934][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.512978][ T5635] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.532756][ T5638] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.539902][ T5638] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.565979][ T5638] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.601486][ T5632] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.608631][ T5632] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.634617][ T5632] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.675572][ T5637] team0: Port device team_slave_0 added [ 87.685519][ T5637] team0: Port device team_slave_1 added [ 87.714152][ T5634] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.721184][ T5634] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.747877][ T5634] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.798649][ T5635] hsr_slave_0: entered promiscuous mode [ 87.805661][ T5635] hsr_slave_1: entered promiscuous mode [ 87.812915][ T5634] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.820060][ T5634] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.846145][ T5634] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.887529][ T5637] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.894648][ T5637] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.921092][ T5637] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.933731][ T5637] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.940981][ T5637] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.966980][ T5637] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.995273][ T5632] hsr_slave_0: entered promiscuous mode [ 88.001943][ T5632] hsr_slave_1: entered promiscuous mode [ 88.008804][ T5632] debugfs: 'hsr0' already exists in 'hsr' [ 88.014877][ T5632] Cannot create hsr debugfs directory [ 88.083613][ T5638] hsr_slave_0: entered promiscuous mode [ 88.091092][ T5638] hsr_slave_1: entered promiscuous mode [ 88.098270][ T5638] debugfs: 'hsr0' already exists in 'hsr' [ 88.104180][ T5638] Cannot create hsr debugfs directory [ 88.189130][ T5637] hsr_slave_0: entered promiscuous mode [ 88.196310][ T5637] hsr_slave_1: entered promiscuous mode [ 88.202583][ T5637] debugfs: 'hsr0' already exists in 'hsr' [ 88.208450][ T5637] Cannot create hsr debugfs directory [ 88.228244][ T5634] hsr_slave_0: entered promiscuous mode [ 88.235345][ T5634] hsr_slave_1: entered promiscuous mode [ 88.241651][ T5634] debugfs: 'hsr0' already exists in 'hsr' [ 88.247688][ T5634] Cannot create hsr debugfs directory [ 88.835986][ T5635] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.849922][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.860349][ T5635] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.872270][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.881637][ T5635] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.893222][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.911728][ T5635] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.921400][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.987820][ T5637] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 89.002027][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.011020][ T5637] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 89.021693][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.029969][ T5637] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 89.042084][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.051166][ T5637] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 89.060813][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.176278][ T5632] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 89.187141][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.197973][ T5632] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 89.215091][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.223114][ T5632] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 89.232773][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.241175][ T5632] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 89.251141][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.354988][ T5626] Bluetooth: hci4: command tx timeout [ 89.361246][ T5627] Bluetooth: hci0: command tx timeout [ 89.367422][ T5626] Bluetooth: hci2: command tx timeout [ 89.367882][ T5623] Bluetooth: hci1: command tx timeout [ 89.378897][ T50] Bluetooth: hci3: command tx timeout [ 89.411866][ T5638] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 89.432808][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.456736][ T5638] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 89.467986][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.477995][ T5638] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 89.488387][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.498036][ T5638] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 89.509798][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.562974][ T5635] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.643066][ T5634] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 89.656296][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.671638][ T5635] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.681416][ T5634] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 89.691841][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.700179][ T5634] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 89.710177][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.718875][ T5634] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.728633][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.762282][ T5637] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.774671][ T3289] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.782097][ T3289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.806728][ T3289] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.814090][ T3289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.893360][ T5637] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.920928][ T3289] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.928167][ T3289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.952775][ T5632] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.986203][ T1104] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.993422][ T1104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.060431][ T5632] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.102458][ T5638] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.113481][ T1158] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.120658][ T1158] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.166080][ T1104] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.173263][ T1104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.214419][ T5638] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.228983][ T5635] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.268255][ T3289] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.275469][ T3289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.316400][ T5634] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.325822][ T3289] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.333057][ T3289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.376617][ T5637] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.419018][ T5634] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.447534][ T1158] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.454740][ T1158] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.491400][ T5635] veth0_vlan: entered promiscuous mode [ 90.507752][ T1158] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.514996][ T1158] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.535869][ T5635] veth1_vlan: entered promiscuous mode [ 90.647853][ T5637] veth0_vlan: entered promiscuous mode [ 90.674908][ T5632] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.685543][ T5637] veth1_vlan: entered promiscuous mode [ 90.713806][ T5638] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.723287][ T5635] veth0_macvtap: entered promiscuous mode [ 90.752139][ T5635] veth1_macvtap: entered promiscuous mode [ 90.832877][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.860153][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.893260][ T5637] veth0_macvtap: entered promiscuous mode [ 90.902056][ T5638] veth0_vlan: entered promiscuous mode [ 90.912021][ T5632] veth0_vlan: entered promiscuous mode [ 90.931653][ T5637] veth1_macvtap: entered promiscuous mode [ 90.952462][ T5634] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.969325][ T5638] veth1_vlan: entered promiscuous mode [ 90.995006][ T5632] veth1_vlan: entered promiscuous mode [ 91.005747][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.031751][ T5637] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.075092][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.105703][ T5637] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.126026][ T3289] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.135208][ T3289] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.199276][ T5638] veth0_macvtap: entered promiscuous mode [ 91.220767][ T1158] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.230896][ T1104] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.239448][ T1158] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.262843][ T5638] veth1_macvtap: entered promiscuous mode [ 91.283773][ T5632] veth0_macvtap: entered promiscuous mode [ 91.309878][ T5632] veth1_macvtap: entered promiscuous mode [ 91.321318][ T5634] veth0_vlan: entered promiscuous mode [ 91.354493][ T3289] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.381039][ T3289] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.390158][ T5634] veth1_vlan: entered promiscuous mode [ 91.392708][ T3289] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.417177][ T1171] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.431338][ T5638] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.439765][ T50] Bluetooth: hci2: command tx timeout [ 91.445624][ T5623] Bluetooth: hci0: command tx timeout [ 91.451327][ T5625] Bluetooth: hci4: command tx timeout [ 91.451377][ T5627] Bluetooth: hci1: command tx timeout [ 91.462933][ T5626] Bluetooth: hci3: command tx timeout [ 91.486749][ T5638] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.503194][ T5632] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.573161][ T5635] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 91.589797][ T5632] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.604408][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.619472][ T1158] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.634656][ T1158] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.654280][ T1171] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.778761][ T3321] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.792717][ T3321] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.815259][ T5634] veth0_macvtap: entered promiscuous mode [ 91.847462][ T3289] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.858447][ T5634] veth1_macvtap: entered promiscuous mode [ 91.875458][ T3289] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.967701][ T3321] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.981113][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.990078][ T3321] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.026179][ T24] cfg80211: failed to load regulatory.db [ 92.051167][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.093671][ T5726] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 92.124703][ T1171] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.177859][ T1171] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.186561][ T1171] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.216182][ T3289] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.288449][ T1171] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.298724][ T1171] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.324118][ T3321] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.351524][ T3321] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.444318][ T3289] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.544003][ T3289] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.570262][ T3289] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.585694][ T1158] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.587507][ T3289] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.656856][ T3321] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.761542][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.780090][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.894645][ T1158] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.903663][ T1158] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.975218][ T1104] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.994495][ T5702] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.145583][ T5691] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 93.157246][ T5702] usb 5-1: Using ep0 maxpacket: 8 [ 93.173843][ T5702] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 93.207710][ T5702] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 93.232920][ T5702] usb 5-1: config 0 has no interface number 0 [ 93.252926][ T5702] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.304780][ T5702] usb 5-1: config 0 descriptor?? [ 93.336230][ T5691] usb 4-1: New USB device found, idVendor=04b4, idProduct=2102, bcdDevice= 0.00 [ 93.387812][ T5691] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 93.428108][ T5691] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 93.442458][ T5691] usb 4-1: Product: syz [ 93.453445][ T5691] usb 4-1: Manufacturer: syz [ 93.495068][ T5739] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 93.498356][ T5702] viperboard 5-1:0.143: version 0.00 found at bus 005 address 002 [ 93.518102][ T5627] Bluetooth: hci1: command tx timeout [ 93.524581][ T5626] Bluetooth: hci2: command tx timeout [ 93.526320][ T50] Bluetooth: hci3: command tx timeout [ 93.530485][ T5627] Bluetooth: hci0: command tx timeout [ 93.541660][ T5626] Bluetooth: hci4: command tx timeout [ 93.590732][ T5734] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 93.612041][ T5702] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 93.630219][ T5691] dvb-usb: found a 'DVBWorld DVB-S 2102 USB2.0' in cold state, will try to load a firmware [ 93.645113][ T5702] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 93.680952][ T5734] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 93.688986][ T1217] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 93.781200][ T5691] usb 4-1: Direct firmware load for dvb-usb-dw2102.fw failed with error -2 [ 93.804836][ T5691] usb 4-1: Falling back to sysfs fallback for: dvb-usb-dw2102.fw [ 93.876166][ T1217] usb 2-1: New USB device found, idVendor=18b4, idProduct=1001, bcdDevice= 0.00 [ 93.901340][ T1217] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.939730][ T1217] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 93.954457][ T5702] usb 5-1: USB disconnect, device number 2 [ 93.969552][ T1217] usb 2-1: Product: syz [ 93.980806][ T1217] usb 2-1: Manufacturer: syz [ 94.235179][ T1217] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 94.271247][ T1217] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 94.282769][ T1217] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 94.293154][ T1217] usb 2-1: media controller created [ 94.327257][ T1217] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 94.442599][ T5767] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 94.489626][ T5770] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 94.497235][ T5770] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 94.511926][ T5770] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 94.520625][ T5770] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 94.529294][ T5767] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 94.627183][ T5775] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 94.659373][ T5774] kvm: kvm [5773]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc1) = 0x100 [ 95.459482][ T5798] Zero length message leads to an empty skb [ 95.515869][ T1217] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 95.571194][ T5801] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 95.707273][ T5710] input: syz0 as /devices/virtual/misc/uhid/0003:04D8:C002.0001/input/input7 [ 95.794123][ T5710] rc_core: IR keymap rc-rc6-mce not found [ 95.800771][ T5710] Registered IR keymap rc-empty [ 95.807604][ T5710] rc rc0: syz0 as /devices/virtual/misc/uhid/0003:04D8:C002.0001/rc/rc0 [ 95.819239][ T5710] input: syz0 as /devices/virtual/misc/uhid/0003:04D8:C002.0001/rc/rc0/input8 [ 95.842075][ T5710] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:323 [ 95.851977][ T5710] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 5710, name: kworker/0:6 [ 95.861128][ T5710] preempt_count: 1, expected: 0 [ 95.866021][ T5710] RCU nest depth: 0, expected: 0 [ 95.870994][ T5710] 4 locks held by kworker/0:6/5710: [ 95.876205][ T5710] #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 95.887302][ T5710] #1: ffffc90004b57c40 ((work_completion)(&uhid->worker)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 95.899297][ T5710] #2: ffff888053795a58 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 95.908626][ T5710] #3: ffff888035105970 (&data->lock){....}-{3:3}, at: picolcd_set_contrast+0x135/0x300 [ 95.918482][ T5710] irq event stamp: 14346 [ 95.922876][ T5710] hardirqs last enabled at (14345): [] finish_task_switch+0x412/0xc60 [ 95.932734][ T5710] hardirqs last disabled at (14346): [] _raw_spin_lock_irqsave+0x1a/0x60 [ 95.942759][ T5710] softirqs last enabled at (14308): [] __alloc_skb+0x189/0x7a0 [ 95.952051][ T5710] softirqs last disabled at (14306): [] __alloc_skb+0x189/0x7a0 [ 95.961325][ T5710] Preemption disabled at: [ 95.961338][ T5710] [<0000000000000000>] 0x0 [ 95.970137][ T5710] CPU: 0 UID: 0 PID: 5710 Comm: kworker/0:6 Not tainted syzkaller #0 PREEMPT(full) [ 95.970158][ T5710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 95.970169][ T5710] Workqueue: events uhid_device_add_worker [ 95.970207][ T5710] Call Trace: [ 95.970216][ T5710] [ 95.970223][ T5710] dump_stack_lvl+0xe8/0x150 [ 95.970254][ T5710] __might_resched+0x378/0x4d0 [ 95.970281][ T5710] __kmalloc_noprof+0xef/0x720 [ 95.970303][ T5710] ? __hid_request+0xb2/0x490 [ 95.970324][ T5710] ? __hid_request+0xb2/0x490 [ 95.970351][ T5710] __hid_request+0xb2/0x490 [ 95.970379][ T5710] picolcd_set_contrast+0x208/0x300 [ 95.970408][ T5710] picolcd_init_lcd+0x1f9/0x2f0 [ 95.970434][ T5710] picolcd_probe+0xbb1/0x16c0 [ 95.970460][ T5710] hid_device_probe+0x42c/0x7c0 [ 95.970492][ T5710] ? __pfx_hid_device_probe+0x10/0x10 [ 95.970516][ T5710] really_probe+0x254/0xae0 [ 95.970541][ T5710] __driver_probe_device+0x1e8/0x360 [ 95.970564][ T5710] driver_probe_device+0x4f/0x240 [ 95.970587][ T5710] __device_attach_driver+0x270/0x410 [ 95.970611][ T5710] bus_for_each_drv+0x258/0x2f0 [ 95.970637][ T5710] ? __pfx___device_attach_driver+0x10/0x10 [ 95.970657][ T5710] ? __pfx_bus_for_each_drv+0x10/0x10 [ 95.970682][ T5710] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.970746][ T5710] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.970767][ T5710] __device_attach+0x2c4/0x450 [ 95.970788][ T5710] ? __pfx___device_attach+0x10/0x10 [ 95.970811][ T5710] ? _raw_spin_unlock+0x28/0x50 [ 95.970829][ T5710] device_initial_probe+0xa1/0xd0 [ 95.970851][ T5710] bus_probe_device+0x12a/0x220 [ 95.970879][ T5710] device_add+0x7d7/0xb80 [ 95.970899][ T5710] hid_add_device+0x272/0x3e0 [ 95.970922][ T5710] ? uhid_device_add_worker+0x1e/0xf0 [ 95.970949][ T5710] uhid_device_add_worker+0x43/0xf0 [ 95.970973][ T5710] ? process_scheduled_works+0xa20/0x14e0 [ 95.970992][ T5710] process_scheduled_works+0xa8e/0x14e0 [ 95.971043][ T5710] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.971066][ T5710] ? assign_work+0x3cf/0x5d0 [ 95.971088][ T5710] worker_thread+0xa47/0xfb0 [ 95.971129][ T5710] kthread+0x388/0x470 [ 95.971152][ T5710] ? __pfx_worker_thread+0x10/0x10 [ 95.971169][ T5710] ? __pfx_kthread+0x10/0x10 [ 95.971193][ T5710] ret_from_fork+0x514/0xb70 [ 95.971219][ T5710] ? __pfx_ret_from_fork+0x10/0x10 [ 95.971241][ T5710] ? __switch_to+0xc89/0x1420 [ 95.971269][ T5710] ? __pfx_kthread+0x10/0x10 [ 95.971293][ T5710] ret_from_fork_asm+0x1a/0x30 [ 95.971331][ T5710] [ 96.238089][ T5710] hid-picolcd 0003:04D8:C002.0001: No report with id 0x94 found [ 96.247398][ T5710] hid-picolcd 0003:04D8:C002.0001: failed to configure display [ 96.472026][ T1217] usb 2-1: USB disconnect, device number 2