last executing test programs: 5.807176987s ago: executing program 3 (id=83): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4321, @loopback}, 0x10) r1 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4321, @loopback}}, 0x24) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) recvfrom(r0, &(0x7f0000000300)=""/256, 0x100, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write(r3, &(0x7f0000000500)="00000000000000020200000000000001000800000000000100000000000000010700", 0x22) read(r2, &(0x7f000000030c), 0x22) sendto$inet(r0, &(0x7f0000000300), 0x2e, 0x0, &(0x7f0000000600)={0x2, 0x1234, @loopback}, 0x10) recvmsg(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000780), 0x1}, 0x40) nanosleep(&(0x7f0000000900)={0x0, 0x5f5e100}, 0x0) 5.671494702s ago: executing program 3 (id=84): r0 = socket$nl_generic(0x10, 0x3, 0x10) write(r0, &(0x7f0000000000)="3c0000001000010001000000000000000a01000025", 0x15) write(r0, &(0x7f0000000040), 0x0) write(r0, 0x0, 0x0) write(r0, 0x0, 0x0) write(r0, &(0x7f00000001c0)="3c0000001700010001000000000000000a01000025000100534d4355534552", 0x1f) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000240)="3c0000001900010001000000000000000a01000025000100534d4355", 0x1c) write(r0, &(0x7f0000000280)="3c0000001a00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f00000002c0)="3c0000001b00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f0000000300)="3c0000001c00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f0000000340)="3c0000001d00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f0000000400)="3c0000002000010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000500)={0x2, 0x204e, @loopback}, 0x10) listen(r1, 0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000500)={0x2, 0x204e, @loopback}, 0x10) accept4$inet(r1, 0x0, 0x0, 0x0) write(r2, &(0x7f0000000600)='hello', 0x5) 5.629050847s ago: executing program 3 (id=85): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cproc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./cproc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cproc/1/ns/net\x00', 0x0, 0x0) setns(r0, 0x40000000) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f0000000040), 0x4) 4.416713382s ago: executing program 3 (id=99): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./rpc_pipe\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='rpc_pipefs\x00', &(0x7f0000000000)='./rpc_pipe\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='nfsd\x00', &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000220)='-2 -3 +4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000260)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000002a0)='1\n', 0x2) close(r2) 3.936397859s ago: executing program 2 (id=102): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(r2, &(0x7f0000000400)='PASV\r\n', 0x6) r3 = accept4(r0, 0x0, 0x0, 0x0) write(r3, &(0x7f0000000500)='227 Entering Passive Mode (1,1,1,1,1,1)\r\n', 0x28) 3.656311116s ago: executing program 1 (id=112): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000040)) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r1) 3.598993069s ago: executing program 1 (id=113): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/netdevsim/devices\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000400), 0x1000) 3.560979267s ago: executing program 1 (id=114): r0 = socket$nl_generic(0x10, 0x3, 0x10) write(r0, &(0x7f0000000000)='<\x00\x00\x00', 0x4) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000080)="3c0000001200010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000100)="3c000000140001", 0x7) write(r0, &(0x7f0000000140)="3c0000001500010001000000000000000a01000025000100534d4355534552312020202020202020202020202020202020202020", 0x34) write(r0, 0x0, 0x0) write(r0, &(0x7f00000001c0), 0x0) write(r0, 0x0, 0x0) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000280), 0x0) write(r0, &(0x7f0000000340)="3c0000001d00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000", 0x35) write(r0, &(0x7f00000003c0)="3c0000001f00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f0000000400)="3c0000002000010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000500)={0x2, 0x204e, @loopback}, 0x10) listen(r1, 0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000500)={0x2, 0x204e, @loopback}, 0x10) 3.11434358s ago: executing program 2 (id=116): r0 = socket$nl_generic(0x10, 0x3, 0x10) write(r0, &(0x7f0000000000)="3c0000001000010001000000000000000a01000025", 0x15) write(r0, &(0x7f0000000040), 0x0) write(r0, 0x0, 0x0) write(r0, 0x0, 0x0) write(r0, &(0x7f00000001c0)="3c0000001700010001000000000000000a01000025000100534d4355534552", 0x1f) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000240)="3c0000001900010001000000000000000a01000025000100534d43555345523120202020202020202020", 0x2a) write(r0, &(0x7f0000000280)="3c0000001a00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f00000002c0)="3c0000001b00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f0000000300)="3c0000001c00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f0000000340)="3c0000001d00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f0000000400)="3c0000002000010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000500)={0x2, 0x204e, @loopback}, 0x10) listen(r1, 0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000500)={0x2, 0x204e, @loopback}, 0x10) accept4$inet(r1, 0x0, 0x0, 0x0) write(r2, &(0x7f0000000600)='hello', 0x5) 2.972029181s ago: executing program 3 (id=117): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='-2 -3\n', 0x6) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='udp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000120)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000140)='1\n', 0x2) close(r2) 2.691595857s ago: executing program 1 (id=118): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r1 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./net/netfilter/nfnetlink_queue\x00', 0x0, 0x0) read(r3, &(0x7f0000000400)=""/1024, 0x400) 2.612777242s ago: executing program 1 (id=119): syz_init_net_socket$x25(0x9, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='proc\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/x25/forward\x00', 0x0, 0x0) read(r0, &(0x7f0000000200), 0x1000) 2.612600206s ago: executing program 1 (id=120): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='-2 -3 +4.0\n\x00', 0xb) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='tcp 2049\n\x00', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x0, 0x0) read(r2, &(0x7f0000000200)=""/100, 0x64) close(r2) 2.250493366s ago: executing program 2 (id=122): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000000), r0) sendmsg$NFC_CMD_DEV_UP(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$NFC_CMD_DEV_UP(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0) sendmsg$NFC_CMD_START_POLL(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x24, r1, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x1}, @NFC_ATTR_TM_PROTOCOLS={0x8, 0xe, 0x20}]}, 0x24}}, 0x0) sendmsg$NFC_CMD_START_POLL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x24, r1, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x20}]}, 0x24}}, 0x0) nanosleep(&(0x7f0000000500)={0x0, 0x2faf080}, 0x0) sendmsg$NFC_CMD_DEP_LINK_UP(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_COMM_MODE={0x5, 0xa, 0x1}]}, 0x2c}}, 0x0) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) 1.59232314s ago: executing program 3 (id=124): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(r2, &(0x7f0000000400)='PASV\r\n', 0x6) r3 = accept4(r0, 0x0, 0x0, 0x0) write(r3, &(0x7f0000000500)='227 Entering Passive Mode (1,1,1,1,1,1)\r\n', 0x28) 1.590181153s ago: executing program 2 (id=125): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)='localhost 1 \\x00000000 2147483647 /tmp\n', 0x27) 1.543052974s ago: executing program 2 (id=126): r0 = socket$nl_generic(0x10, 0x3, 0x10) write(r0, &(0x7f0000000000)='<\x00\x00\x00', 0x4) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000080)="3c0000001200010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000100)="3c000000140001", 0x7) write(r0, &(0x7f0000000140)="3c0000001500010001000000000000000a01000025000100534d4355534552312020202020202020202020202020202020202020", 0x34) write(r0, 0x0, 0x0) write(r0, &(0x7f00000001c0), 0x0) write(r0, 0x0, 0x0) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000280), 0x0) write(r0, &(0x7f0000000340)="3c0000001d00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000", 0x35) write(r0, &(0x7f00000003c0)="3c0000001f00010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f0000000400)="3c0000002000010001000000000000000a01000025000100534d435553455231202020202020202020202020202020202020202000000000", 0x3c) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000500)={0x2, 0x204e, @loopback}, 0x10) listen(r1, 0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000500)={0x2, 0x204e, @loopback}, 0x10) 850.820513ms ago: executing program 0 (id=131): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/virtio/drivers/virtio_balloon/virtio0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/virtio/drivers/virtio_blk/virtio0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/virtio/drivers/virtio_console/virtio0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/virtio/drivers/virtio_rng/virtio0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/virtio/drivers/9pnet_virtio/virtio0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/virtio/drivers/virtio_scsi/virtio0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/virtio/devices/virtio1\x00', 0x0, 0x0) 772.437962ms ago: executing program 0 (id=133): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) read$nci(r0, &(0x7f0000000200)=""/100, 0x64) write$nci(r0, &(0x7f0000000280)=@NCI_OP_CORE_RESET_RSP, 0x6) read$nci(r0, &(0x7f00000002c0)=""/100, 0x64) write$nci(r0, &(0x7f0000000340)=@NCI_OP_CORE_INIT_RSP, 0x14) read$nci(r0, &(0x7f0000000380)=""/100, 0x64) write$nci(r0, &(0x7f0000000400)=@NCI_OP_RF_DISCOVER_MAP_RSP, 0x4) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x24, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xffffffff}]}, 0x24}}, 0x0) read$nci(r0, &(0x7f0000000500)=""/100, 0x64) write$nci(r0, &(0x7f0000000580)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r0, &(0x7f00000005c0)=""/100, 0x64) write$nci(r0, &(0x7f0000000640)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r0, &(0x7f0000000680)=""/100, 0x64) write$nci(r0, &(0x7f0000000700)=@NCI_OP_RF_DISCOVER_RSP, 0x4) write$nci(r0, &(0x7f0000000740)=@NCI_OP_RF_DISCOVER_NTF={0x1, 0x0, 0x3, 0x3, 0x0, @b={0x0, 0x1, 0x1, 0x1, {0x1, "aa"}}}, 0xa) sendmsg$NFC_CMD_ACTIVATE_TARGET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x1}]}, 0x2c}}, 0x0) read$nci(r0, &(0x7f0000000840)=""/100, 0x64) write$nci(r0, &(0x7f00000008c0)=@NCI_OP_RF_DISCOVER_SELECT_RSP, 0x4) write$nci(r0, &(0x7f0000000900)=@NCI_OP_RF_INTF_ACTIVATED_NTF={0x0, 0x0, 0x3, 0x5, 0x0, @a={0x0, 0x1, 0x1}}, 0x13) r4 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x1) connect$nfc_raw(r4, &(0x7f0000000940)={0x27, r1, 0x0, 0x1}, 0x10) write(r4, &(0x7f0000000980)="1234", 0x4) 670.615024ms ago: executing program 2 (id=134): r0 = syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001000000010902200001010080320904000002ff0000000705810240000007050202400000"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000140)="0000ffffff0a00f6d7290000000000000003fd00") syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000180)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f00000001c0)="0000ffffff0300fdd72b00fe00") syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000200)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0xe, &(0x7f0000000240)="0000ffffff0400fcd72101070000") nanosleep(&(0x7f0000000280)={0x0, 0x1dcd6500}, 0x0) 310.548052ms ago: executing program 0 (id=135): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) 240.406848ms ago: executing program 0 (id=136): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e20, 0x0, 0x4e20, 0x0, 0xa, 0x80, 0x80}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x6c}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, {0x0, 0x0, 0x0, 0x0, 0x1}, {}, {}, 0x0, 0x0, 0xa, 0x1}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000900)=@flushsa={0x18, 0x1c, 0x1}, 0x18}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) 39.151863ms ago: executing program 0 (id=137): setns(0xc9, 0x0) r0 = socket(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000080), 0x12) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/x25/socket\x00', 0x0, 0x0) read(r1, &(0x7f0000000300), 0x1000) 0s ago: executing program 0 (id=138): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) read$nci(r0, &(0x7f0000000200)=""/100, 0x64) write$nci(r0, &(0x7f0000000280)=@NCI_OP_CORE_RESET_RSP, 0x6) read$nci(r0, &(0x7f0000000340)=""/100, 0x64) write$nci(r0, &(0x7f00000003c0)=@NCI_OP_CORE_INIT_RSP={0x0, 0x0, 0x2, 0x1, 0x0, {{0x0, 0x0, 0x1, "03"}}}, 0x15) read$nci(r0, &(0x7f0000000400)=""/100, 0x64) write$nci(r0, &(0x7f0000000480)=@NCI_OP_RF_DISCOVER_MAP_RSP, 0x4) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x24, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_TM_PROTOCOLS={0x8, 0xe, 0x10}]}, 0x24}}, 0x0) read$nci(r0, &(0x7f0000000580)=""/100, 0x64) write$nci(r0, &(0x7f0000000600)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r0, &(0x7f0000000640)=""/100, 0x64) write$nci(r0, &(0x7f00000006c0)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r0, &(0x7f0000000700)=""/100, 0x64) write$nci(r0, &(0x7f0000000780)=@NCI_OP_RF_DISCOVER_RSP, 0x4) nanosleep(&(0x7f0000000300)={0x1}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.65' (ED25519) to the list of known hosts. [ 71.951038][ T5598] cgroup: Unknown subsys name 'net' [ 72.094734][ T5598] cgroup: Unknown subsys name 'cpuset' [ 72.103829][ T5598] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 73.445179][ T5598] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 75.523729][ T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 75.527335][ T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 75.527863][ T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 75.530246][ T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 75.530817][ T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 75.662113][ T4931] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 75.663223][ T4931] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 75.663679][ T4931] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 75.666576][ T4931] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 75.667818][ T4931] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 75.705578][ T5611] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 75.712658][ T5611] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 75.713309][ T5611] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 75.714616][ T5611] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 75.715458][ T5611] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 75.715789][ T5611] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 75.716619][ T5611] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 75.716982][ T5611] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 75.718522][ T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 75.719295][ T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.066638][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.066805][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.067146][ T5609] bridge_slave_0: entered allmulticast mode [ 77.068943][ T5609] bridge_slave_0: entered promiscuous mode [ 77.119125][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.119265][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.119501][ T5609] bridge_slave_1: entered allmulticast mode [ 77.120468][ T5609] bridge_slave_1: entered promiscuous mode [ 77.177871][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.177971][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.178050][ T5617] bridge_slave_0: entered allmulticast mode [ 77.178946][ T5617] bridge_slave_0: entered promiscuous mode [ 77.182649][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.182743][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.183098][ T5617] bridge_slave_1: entered allmulticast mode [ 77.184964][ T5617] bridge_slave_1: entered promiscuous mode [ 77.231151][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.249469][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.249628][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.249748][ T5620] bridge_slave_0: entered allmulticast mode [ 77.251185][ T5620] bridge_slave_0: entered promiscuous mode [ 77.256848][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.294102][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.294329][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.294420][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.294604][ T5620] bridge_slave_1: entered allmulticast mode [ 77.296003][ T5620] bridge_slave_1: entered promiscuous mode [ 77.307416][ T5619] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.307514][ T5619] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.307624][ T5619] bridge_slave_0: entered allmulticast mode [ 77.309397][ T5619] bridge_slave_0: entered promiscuous mode [ 77.312727][ T5619] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.312827][ T5619] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.313584][ T5619] bridge_slave_1: entered allmulticast mode [ 77.315042][ T5619] bridge_slave_1: entered promiscuous mode [ 77.318804][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.407049][ T5609] team0: Port device team_slave_0 added [ 77.426169][ T5617] team0: Port device team_slave_0 added [ 77.428447][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.430796][ T5609] team0: Port device team_slave_1 added [ 77.434429][ T5619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.437266][ T5617] team0: Port device team_slave_1 added [ 77.462677][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.479399][ T5619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.525931][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.525947][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.525972][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.529257][ T5620] team0: Port device team_slave_0 added [ 77.545330][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.545346][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.545369][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.547702][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.547715][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.547739][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.548723][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.548735][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.548757][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.562383][ T5620] team0: Port device team_slave_1 added [ 77.565101][ T5619] team0: Port device team_slave_0 added [ 77.567376][ T4931] Bluetooth: hci0: command tx timeout [ 77.609543][ T5619] team0: Port device team_slave_1 added [ 77.689901][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.689918][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.689941][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.726489][ T4931] Bluetooth: hci3: command tx timeout [ 77.726594][ T4931] Bluetooth: hci1: command tx timeout [ 77.729372][ T5617] hsr_slave_0: entered promiscuous mode [ 77.730476][ T5617] hsr_slave_1: entered promiscuous mode [ 77.734766][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.734780][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.734803][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.736854][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.736868][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.736891][ T5619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.746386][ T5609] hsr_slave_0: entered promiscuous mode [ 77.747334][ T5609] hsr_slave_1: entered promiscuous mode [ 77.748140][ T5609] debugfs: 'hsr0' already exists in 'hsr' [ 77.748244][ T5609] Cannot create hsr debugfs directory [ 77.805318][ T5623] Bluetooth: hci2: command tx timeout [ 77.932021][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.932036][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.932057][ T5619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.058139][ T5620] hsr_slave_0: entered promiscuous mode [ 78.059222][ T5620] hsr_slave_1: entered promiscuous mode [ 78.059604][ T5620] debugfs: 'hsr0' already exists in 'hsr' [ 78.059616][ T5620] Cannot create hsr debugfs directory [ 78.114060][ T5619] hsr_slave_0: entered promiscuous mode [ 78.114633][ T5619] hsr_slave_1: entered promiscuous mode [ 78.115070][ T5619] debugfs: 'hsr0' already exists in 'hsr' [ 78.115087][ T5619] Cannot create hsr debugfs directory [ 78.416135][ T5617] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 78.424492][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.428509][ T5617] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 78.440499][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.441405][ T5617] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 78.447875][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.452597][ T5617] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 78.466922][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.541019][ T5620] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.550375][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.551109][ T5620] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 78.564473][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.569710][ T5620] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 78.579683][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.580584][ T5620] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 78.595741][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.685445][ T5609] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.689220][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.690172][ T5609] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.696797][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.708272][ T5609] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.723462][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.739867][ T5609] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.745739][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.823656][ T5619] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 78.826188][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.826893][ T5619] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 78.829915][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.844074][ T5619] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 78.849992][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.872779][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.873140][ T5619] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 78.879656][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.926052][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.946197][ T141] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.946321][ T141] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.977813][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.981155][ T141] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.981219][ T141] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.046681][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.078838][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.078899][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.083745][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.095090][ T5617] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 79.130279][ T141] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.130379][ T141] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.176881][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.197517][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.197624][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.241029][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.241129][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.325235][ T5619] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.408785][ T5619] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.430241][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.430366][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.462709][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.462811][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.642621][ T5623] Bluetooth: hci0: command tx timeout [ 79.802604][ T5623] Bluetooth: hci1: command tx timeout [ 79.802616][ T4931] Bluetooth: hci3: command tx timeout [ 79.882792][ T5623] Bluetooth: hci2: command tx timeout [ 79.968875][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.149943][ T5617] veth0_vlan: entered promiscuous mode [ 80.168246][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.186698][ T5617] veth1_vlan: entered promiscuous mode [ 80.270838][ T5617] veth0_macvtap: entered promiscuous mode [ 80.294756][ T5617] veth1_macvtap: entered promiscuous mode [ 80.297896][ T5620] veth0_vlan: entered promiscuous mode [ 80.328655][ T5620] veth1_vlan: entered promiscuous mode [ 80.349774][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.367883][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.386044][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.435622][ T3362] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.435783][ T3362] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.435819][ T3362] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.496609][ T5620] veth0_macvtap: entered promiscuous mode [ 80.525628][ T5619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.546010][ T5620] veth1_macvtap: entered promiscuous mode [ 80.578446][ T5609] veth0_vlan: entered promiscuous mode [ 80.624948][ T5609] veth1_vlan: entered promiscuous mode [ 80.641443][ T3362] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.642050][ T3362] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.651273][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.658412][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.727792][ T5619] veth0_vlan: entered promiscuous mode [ 80.738007][ T3362] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.738028][ T3362] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.756114][ T51] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.756174][ T51] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.756222][ T51] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.756265][ T51] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.818325][ T5619] veth1_vlan: entered promiscuous mode [ 80.880864][ T5617] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 80.891990][ T149] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.910696][ T5609] veth0_macvtap: entered promiscuous mode [ 80.920184][ T141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.920205][ T141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.954864][ T5609] veth1_macvtap: entered promiscuous mode [ 81.028669][ T141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.028689][ T141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.038693][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.049405][ T5619] veth0_macvtap: entered promiscuous mode [ 81.076479][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.097113][ T5619] veth1_macvtap: entered promiscuous mode [ 81.114501][ T149] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.133842][ T141] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.134759][ T51] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.134895][ T51] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.183804][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.218268][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.264611][ T869] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 81.284302][ T141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.284322][ T141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.299860][ T3710] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.300622][ T3710] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.365676][ T149] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.365698][ T149] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.419234][ T869] usb 4-1: New USB device found: idVendor=054c, idProduct=06c1, bcdDevice=1.00 [ 81.433445][ T869] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 81.433478][ T869] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 81.433513][ T869] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.446259][ T3710] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.446575][ T3710] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.494908][ T5762] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 81.495060][ T5762] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 81.516948][ C0] port100 4-1:1.0: NFC: Urb failure (status -71) [ 81.517238][ C0] port100 4-1:1.0: NFC: Urb failure (status -71) [ 81.520526][ T141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.520542][ T141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.535088][ T869] port100 4-1:1.0: NFC: Could not get supported command types [ 81.609088][ T141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.609110][ T141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.721634][ T5623] Bluetooth: hci0: command tx timeout [ 81.881931][ T5623] Bluetooth: hci3: command tx timeout [ 81.881965][ T5623] Bluetooth: hci1: command tx timeout [ 81.901423][ T5772] Bluetooth: MGMT ver 1.23 [ 81.902897][ T5770] Zero length message leads to an empty skb [ 81.961744][ T5623] Bluetooth: hci2: command tx timeout [ 82.227827][ T5690] usb 4-1: USB disconnect, device number 2 [ 82.332334][ T149] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.358394][ T5791] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14'. [ 82.543485][ T5799] FAULT_INJECTION: forcing a failure. [ 82.543485][ T5799] name failslab, interval 1, probability 0, space 0, times 1 [ 82.543528][ T5799] CPU: 1 UID: 0 PID: 5799 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full) [ 82.543552][ T5799] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 82.543573][ T5799] Call Trace: [ 82.543584][ T5799] [ 82.543593][ T5799] dump_stack_lvl+0xe8/0x150 [ 82.543625][ T5799] should_fail_ex+0x3eb/0x540 [ 82.543640][ T5799] should_failslab+0xa8/0x100 [ 82.543655][ T5799] ? create_new_namespaces+0x33/0x6b0 [ 82.543671][ T5799] kmem_cache_alloc_noprof+0x9c/0x600 [ 82.543686][ T5799] ? create_new_namespaces+0x33/0x6b0 [ 82.543703][ T5799] create_new_namespaces+0x33/0x6b0 [ 82.543718][ T5799] ? bpf_lsm_capable+0x9/0x20 [ 82.543734][ T5799] ? security_capable+0x7e/0x2c0 [ 82.543753][ T5799] unshare_nsproxy_namespaces+0x144/0x190 [ 82.543769][ T5799] ksys_unshare+0x53c/0x890 [ 82.543785][ T5799] ? __pfx_ksys_unshare+0x10/0x10 [ 82.543802][ T5799] ? ksys_write+0x242/0x270 [ 82.543814][ T5799] ? __pfx___se_sys_futex+0x10/0x10 [ 82.543830][ T5799] ? __pfx_ksys_write+0x10/0x10 [ 82.543846][ T5799] __x64_sys_unshare+0x38/0x50 [ 82.543860][ T5799] do_syscall_64+0x166/0x520 [ 82.543873][ T5799] ? trace_irq_disable+0x3b/0x140 [ 82.543886][ T5799] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.543896][ T5799] ? clear_bhb_loop+0x70/0xc0 [ 82.543909][ T5799] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.543921][ T5799] RIP: 0033:0x7efcbcb9e159 [ 82.543937][ T5799] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 82.543946][ T5799] RSP: 002b:00007efcbd9b8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 82.543962][ T5799] RAX: ffffffffffffffda RBX: 00007efcbce25fa0 RCX: 00007efcbcb9e159 [ 82.543970][ T5799] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000 [ 82.543976][ T5799] RBP: 00007efcbcc3506b R08: 0000000000000000 R09: 0000000000000000 [ 82.543983][ T5799] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 82.543989][ T5799] R13: 00007efcbce26038 R14: 00007efcbce25fa0 R15: 00007ffdb13ece08 [ 82.544005][ T5799] [ 82.814175][ T5803] svc: failed to register lockdv1 RPC service (errno 111). [ 82.827719][ T5803] lockd_up: makesock failed, error=-111 [ 82.977615][ T5809] nfs: Bad value for 'source' [ 83.066912][ T5803] svc: failed to register nfsdv3 RPC service (errno 111). [ 83.068716][ T5803] svc: failed to register nfsaclv3 RPC service (errno 111). [ 83.068739][ T5803] failed to unregister tcp with rpcbind [ 83.071088][ T5803] svc: failed to register nfsdv3 RPC service (errno 97). [ 83.071109][ T5803] svc: failed to register nfsaclv3 RPC service (errno 97). [ 83.071121][ T5803] failed to unregister tcp with rpcbind [ 83.159877][ T5808] svc: failed to register lockdv1 RPC service (errno 111). [ 83.367923][ T5808] svc: failed to register nfsdv3 RPC service (errno 111). [ 83.378434][ T5808] svc: failed to register nfsaclv3 RPC service (errno 111). [ 83.378456][ T5808] failed to unregister tcp with rpcbind [ 83.378634][ T5808] svc: failed to register nfsdv3 RPC service (errno 97). [ 83.378652][ T5808] svc: failed to register nfsaclv3 RPC service (errno 97). [ 83.378664][ T5808] failed to unregister tcp with rpcbind [ 83.523851][ T5819] netlink: 20 bytes leftover after parsing attributes in process `syz.3.24'. [ 83.656460][ T5827] netlink: 8 bytes leftover after parsing attributes in process `syz.0.28'. [ 83.656493][ T5827] netlink: 8 bytes leftover after parsing attributes in process `syz.0.28'. [ 83.704140][ T5831] tipc: Started in network mode [ 83.704160][ T5831] tipc: Node identity 1001001, cluster identity 4711 [ 83.704168][ T5831] tipc: Node number set to 16781313 [ 83.705876][ T5831] tipc: Enabled bearer , priority 10 [ 83.963257][ T4931] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 84.041613][ T4931] Bluetooth: hci2: command tx timeout [ 84.282216][ T4931] Bluetooth: hci0: command 0x0c1a tx timeout [ 84.602587][ T5814] NFSD: Unable to initialize client recovery tracking! (-110) [ 84.602607][ T5814] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 84.602618][ T5814] NFSD: starting 90-second grace period (net f000045d) [ 84.960495][ T5857] tipc: Started in network mode [ 84.960518][ T5857] tipc: Node identity 1001001, cluster identity 4711 [ 84.960530][ T5857] tipc: Node number set to 16781313 [ 84.974268][ T5857] tipc: Enabled bearer , priority 10 [ 85.018137][ T4931] Bluetooth: hci0: unexpected event for opcode 0x041b [ 85.034982][ T5855] Bluetooth: hci0: Opcode 0x0c1a failed: -112 [ 85.795535][ T5885] tipc: Started in network mode [ 85.795551][ T5885] tipc: Node identity 1001001, cluster identity 4711 [ 85.795559][ T5885] tipc: Node number set to 16781313 [ 85.796584][ T5885] tipc: Enabled bearer , priority 10 [ 86.442293][ T5875] NFSD: Unable to initialize client recovery tracking! (-110) [ 86.442316][ T5875] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 86.442327][ T5875] NFSD: starting 90-second grace period (net f0000462) [ 86.532124][ T5895] netlink: 1 bytes leftover after parsing attributes in process `syz.2.55'. [ 86.768297][ T10] cfg80211: failed to load regulatory.db [ 87.081690][ T5623] Bluetooth: hci0: command 0x0c1a tx timeout [ 87.082176][ T4931] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 87.084858][ T5873] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 87.084879][ T5873] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 87.095903][ T5873] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 87.095925][ T5873] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 87.120824][ T5873] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 87.120846][ T5873] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 87.149448][ T5873] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 87.149471][ T5873] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 87.841602][ T5886] NFSD: Unable to initialize client recovery tracking! (-110) [ 87.841617][ T5886] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 87.841623][ T5886] NFSD: starting 90-second grace period (net f00003c4) [ 88.225310][ T5900] svc: failed to register nfsdv3 RPC service (errno 512). [ 88.225540][ T5900] svc: failed to register nfsaclv3 RPC service (errno 512). [ 88.225555][ T5900] failed to unregister tcp with rpcbind [ 88.225706][ T5900] svc: failed to register nfsdv3 RPC service (errno 97). [ 88.225722][ T5900] svc: failed to register nfsaclv3 RPC service (errno 97). [ 88.225733][ T5900] failed to unregister tcp with rpcbind [ 88.999116][ T5928] netlink: 44 bytes leftover after parsing attributes in process `syz.2.70'. [ 89.401747][ T5907] NFSD: Unable to initialize client recovery tracking! (-110) [ 89.401771][ T5907] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 89.401782][ T5907] NFSD: starting 90-second grace period (net f0000462) [ 89.830898][ T5951] ieee802154 phy0 wpan0: encryption failed: -22 [ 89.996455][ T149] IPVS: starting estimator thread 0... [ 90.091839][ T5956] IPVS: using max 55 ests per chain, 132000 per kthread [ 90.497959][ T5966] lo speed is unknown, defaulting to 1000 [ 90.499264][ T5966] lo speed is unknown, defaulting to 1000 [ 90.500725][ T5966] lo speed is unknown, defaulting to 1000 [ 90.626814][ T5966] infiniband syz0: set active [ 90.627520][ T5704] lo speed is unknown, defaulting to 1000 [ 90.628284][ T5966] infiniband syz0: added lo [ 90.659433][ T5966] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 90.659459][ T5966] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 90.659480][ T5966] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 90.703017][ T5966] RDS/IB: syz0: added [ 90.703400][ T5966] smc: adding ib device syz0 with port count 1 [ 90.703508][ T5966] smc: ib device syz0 port 1 has no pnetid [ 90.704630][ T5704] lo speed is unknown, defaulting to 1000 [ 90.709099][ T5966] lo speed is unknown, defaulting to 1000 [ 90.841648][ T5935] NFSD: Unable to initialize client recovery tracking! (-110) [ 90.841670][ T5935] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 90.841680][ T5935] NFSD: starting 90-second grace period (net f000045d) [ 90.855647][ T5966] lo speed is unknown, defaulting to 1000 [ 90.990756][ T5966] lo speed is unknown, defaulting to 1000 [ 91.149729][ T5977] ieee802154 phy0 wpan0: encryption failed: -22 [ 91.317227][ T149] IPVS: starting estimator thread 0... [ 91.401648][ T5982] IPVS: using max 34 ests per chain, 81600 per kthread [ 91.450478][ T5966] lo speed is unknown, defaulting to 1000 [ 91.748453][ T6004] ieee802154 phy0 wpan0: encryption failed: -22 [ 92.148768][ T149] IPVS: starting estimator thread 0... [ 92.231601][ T6010] IPVS: using max 30 ests per chain, 72000 per kthread [ 92.425619][ T6031] qrtr: Invalid version 2 [ 92.862559][ T6002] NFSD: Unable to initialize client recovery tracking! (-110) [ 92.862575][ T6002] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 92.862580][ T6002] NFSD: starting 90-second grace period (net f000044f) [ 93.614342][ T33] audit: type=1804 audit(1790784030.503:2): pid=6058 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.120" name="/newroot/37/nfsd/portlist" dev="nfsd" ino=13 res=1 errno=0 [ 93.783324][ T6061] netlink: 16 bytes leftover after parsing attributes in process `syz.0.121'. [ 94.301661][ T6049] NFSD: Unable to initialize client recovery tracking! (-110) [ 94.301683][ T6049] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 94.301694][ T6049] NFSD: starting 90-second grace period (net f000044f) [ 94.706795][ T6080] netlink: 4 bytes leftover after parsing attributes in process `syz.0.129'. [ 95.712481][ T27] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 95.745892][ T6086] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 95.841220][ T6102] netlink: 4 bytes leftover after parsing attributes in process `syz.0.136'. [ 95.874103][ T27] usb 3-1: not running at top speed; connect to a high speed hub [ 95.874128][ T27] usb 3-1: New USB device found: idVendor=054c, idProduct=06c1, bcdDevice=1.00 [ 95.874950][ T27] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.290854][ T27] ------------[ cut here ]------------ [ 96.290865][ T27] URB ffff88802b762d00 submitted while active [ 96.290879][ T27] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#1: kworker/1:0/27 [ 96.312863][ T27] Modules linked in: [ 96.316813][ T27] CPU: 1 UID: 0 PID: 27 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(full) [ 96.326103][ T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 96.336237][ T27] Workqueue: usb_hub_wq hub_event [ 96.341321][ T27] RIP: 0010:usb_submit_urb+0x7c/0x18b0 [ 96.346903][ T27] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 69 10 ba fa 49 83 3e 00 74 40 e8 2e 43 48 fa 48 8d 3d c7 61 49 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 13 43 48 fa eb 05 e8 0c 43 [ 96.367207][ T27] RSP: 0018:ffffc90000a1eac0 EFLAGS: 00010283 [ 96.373837][ T27] RAX: ffffffff8780ee22 RBX: ffff88802b762d00 RCX: 0000000000100000 [ 96.381883][ T27] RDX: ffffc900138dc000 RSI: ffff88802b762d00 RDI: ffffffff90ca4ff0 [ 96.390912][ T27] RBP: dffffc0000000000 R08: ffffffff90bc9ebf R09: 1ffffffff21793d7 [ 96.399814][ T27] R10: dffffc0000000000 R11: fffffbfff21793d8 R12: ffff888028c5a858 [ 96.407891][ T27] R13: 1ffff1100518b50b R14: ffff88802b762d08 R15: 0000000000000cc0 [ 96.415944][ T27] FS: 0000000000000000(0000) GS:ffff888124723000(0000) knlGS:0000000000000000 [ 96.424931][ T27] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 96.431592][ T27] CR2: 00007f116f9f3d58 CR3: 000000005cdd4000 CR4: 00000000003526f0 [ 96.439605][ T27] Call Trace: [ 96.443089][ T27] [ 96.446066][ T27] ? __kmalloc_cache_noprof+0x148/0x600 [ 96.451727][ T27] ? port100_send_cmd_async+0xbd/0xcc0 [ 96.457251][ T27] ? skb_put+0x112/0x210 [ 96.461631][ T27] port100_send_cmd_async+0x84f/0xcc0 [ 96.467079][ T27] port100_set_command_type+0x1c8/0x390 [ 96.472765][ T27] ? pcpu_alloc+0x10/0x310 [ 96.477228][ T27] ? __pfx_port100_set_command_type+0x10/0x10 [ 96.483407][ T27] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 96.489261][ T27] port100_probe+0x7b2/0xba0 [ 96.494651][ T27] ? __pfx_port100_probe+0x10/0x10 [ 96.499778][ T27] ? __pm_runtime_set_status+0xa96/0xd80 [ 96.506227][ T27] usb_probe_interface+0x788/0xe50 [ 96.511511][ T27] ? __pfx_usb_probe_interface+0x10/0x10 [ 96.517190][ T27] ? kernfs_create_link+0x1cd/0x240 [ 96.522479][ T27] ? sysfs_do_create_link_sd+0xe0/0x110 [ 96.528097][ T27] ? driver_sysfs_add+0x1fe/0x210 [ 96.533264][ T27] ? __pfx_usb_probe_interface+0x10/0x10 [ 96.538981][ T27] really_probe+0x254/0xae0 [ 96.543578][ T27] __driver_probe_device+0x1e8/0x360 [ 96.548942][ T27] driver_probe_device+0x4f/0x240 [ 96.554083][ T27] __device_attach_driver+0x270/0x410 [ 96.559502][ T27] bus_for_each_drv+0x258/0x2f0 [ 96.564420][ T27] ? __pfx___device_attach_driver+0x10/0x10 [ 96.570392][ T27] ? __pfx_bus_for_each_drv+0x10/0x10 [ 96.575888][ T27] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 96.581787][ T27] __device_attach+0x2c4/0x450 [ 96.586626][ T27] ? __pfx___device_attach+0x10/0x10 [ 96.592016][ T27] ? do_raw_spin_unlock+0xf5/0x200 [ 96.597824][ T27] ? _raw_spin_unlock+0x28/0x50 [ 96.603605][ T27] device_initial_probe+0xa1/0xd0 [ 96.608689][ T27] bus_probe_device+0x12a/0x220 [ 96.613681][ T27] device_add+0x7d7/0xb80 [ 96.618060][ T27] usb_set_configuration+0x1ad8/0x2180 [ 96.623625][ T27] usb_generic_driver_probe+0x8d/0x150 [ 96.629121][ T27] usb_probe_device+0x1c3/0x3b0 [ 96.634047][ T27] ? __pfx_usb_probe_device+0x10/0x10 [ 96.639456][ T27] really_probe+0x254/0xae0 [ 96.644050][ T27] __driver_probe_device+0x1e8/0x360 [ 96.649459][ T27] driver_probe_device+0x4f/0x240 [ 96.654561][ T27] __device_attach_driver+0x270/0x410 [ 96.659988][ T27] bus_for_each_drv+0x258/0x2f0 [ 96.664944][ T27] ? __pfx___device_attach_driver+0x10/0x10 [ 96.670888][ T27] ? __pfx_bus_for_each_drv+0x10/0x10 [ 96.676345][ T27] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 96.682339][ T27] __device_attach+0x2c4/0x450 [ 96.687161][ T27] ? __pfx___device_attach+0x10/0x10 [ 96.692548][ T27] ? do_raw_spin_unlock+0xf5/0x200 [ 96.698668][ T27] ? _raw_spin_unlock+0x28/0x50 [ 96.704234][ T27] device_initial_probe+0xa1/0xd0 [ 96.709318][ T27] bus_probe_device+0x12a/0x220 [ 96.714267][ T27] device_add+0x7d7/0xb80 [ 96.718653][ T27] usb_new_device+0x9aa/0x1690 [ 96.723563][ T27] ? __pfx_usb_new_device+0x10/0x10 [ 96.728806][ T27] ? _raw_spin_unlock_irq+0x23/0x50 [ 96.734107][ T27] hub_event+0x28e8/0x4d30 [ 96.738561][ T27] ? do_raw_spin_unlock+0xf5/0x200 [ 96.743852][ T27] ? __pfx_hub_event+0x10/0x10 [ 96.748769][ T27] ? rcu_is_watching+0x16/0xb0 [ 96.753643][ T27] ? process_scheduled_works+0x97a/0x1630 [ 96.759400][ T27] process_scheduled_works+0xc3d/0x1630 [ 96.765340][ T27] ? __pfx_process_scheduled_works+0x10/0x10 [ 96.771403][ T27] ? assign_work+0x3cf/0x5d0 [ 96.776126][ T27] worker_thread+0xa47/0xfb0 [ 96.780831][ T27] kthread+0x38b/0x480 [ 96.784999][ T27] ? __pfx_worker_thread+0x10/0x10 [ 96.790165][ T27] ? __pfx_kthread+0x10/0x10 [ 96.794885][ T27] ret_from_fork+0x514/0xb70 [ 96.800550][ T27] ? __pfx_ret_from_fork+0x10/0x10 [ 96.806470][ T27] ? __switch_to+0xc78/0x1410 [ 96.811221][ T27] ? __pfx_kthread+0x10/0x10 [ 96.815939][ T27] ret_from_fork_asm+0x1a/0x30 [ 96.820753][ T27] [ 96.823837][ T27] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 96.831148][ T27] CPU: 1 UID: 0 PID: 27 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(full) [ 96.840331][ T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 96.850381][ T27] Workqueue: usb_hub_wq hub_event [ 96.855419][ T27] Call Trace: [ 96.858730][ T27] [ 96.861655][ T27] vpanic+0x26f/0x710 [ 96.865640][ T27] panic+0xc5/0xd0 [ 96.869359][ T27] ? __pfx_panic+0x10/0x10 [ 96.873783][ T27] ? ret_from_fork_asm+0x1a/0x30 [ 96.878731][ T27] __warn+0x315/0x4c0 [ 96.882719][ T27] ? usb_submit_urb+0x79/0x18b0 [ 96.887600][ T27] ? usb_submit_urb+0x79/0x18b0 [ 96.892466][ T27] __report_bug+0x276/0x570 [ 96.896985][ T27] ? usb_submit_urb+0x79/0x18b0 [ 96.901847][ T27] ? __pfx___report_bug+0x10/0x10 [ 96.906896][ T27] ? usb_submit_urb+0x81/0x18b0 [ 96.911770][ T27] report_bug_entry+0x19b/0x290 [ 96.916631][ T27] ? usb_submit_urb+0x7c/0x18b0 [ 96.921491][ T27] ? usb_submit_urb+0x81/0x18b0 [ 96.926352][ T27] handle_bug+0xce/0x200 [ 96.930626][ T27] exc_invalid_op+0x1a/0x50 [ 96.935151][ T27] asm_exc_invalid_op+0x1a/0x20 [ 96.940007][ T27] RIP: 0010:usb_submit_urb+0x7c/0x18b0 [ 96.945491][ T27] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 69 10 ba fa 49 83 3e 00 74 40 e8 2e 43 48 fa 48 8d 3d c7 61 49 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 13 43 48 fa eb 05 e8 0c 43 [ 96.965139][ T27] RSP: 0018:ffffc90000a1eac0 EFLAGS: 00010283 [ 96.971219][ T27] RAX: ffffffff8780ee22 RBX: ffff88802b762d00 RCX: 0000000000100000 [ 96.979205][ T27] RDX: ffffc900138dc000 RSI: ffff88802b762d00 RDI: ffffffff90ca4ff0 [ 96.987206][ T27] RBP: dffffc0000000000 R08: ffffffff90bc9ebf R09: 1ffffffff21793d7 [ 96.995186][ T27] R10: dffffc0000000000 R11: fffffbfff21793d8 R12: ffff888028c5a858 [ 97.003163][ T27] R13: 1ffff1100518b50b R14: ffff88802b762d08 R15: 0000000000000cc0 [ 97.011149][ T27] ? usb_submit_urb+0x72/0x18b0 [ 97.016026][ T27] ? __kmalloc_cache_noprof+0x148/0x600 [ 97.021570][ T27] ? port100_send_cmd_async+0xbd/0xcc0 [ 97.027027][ T27] ? skb_put+0x112/0x210 [ 97.031271][ T27] port100_send_cmd_async+0x84f/0xcc0 [ 97.036665][ T27] port100_set_command_type+0x1c8/0x390 [ 97.042230][ T27] ? pcpu_alloc+0x10/0x310 [ 97.046657][ T27] ? __pfx_port100_set_command_type+0x10/0x10 [ 97.052739][ T27] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 97.058570][ T27] port100_probe+0x7b2/0xba0 [ 97.063162][ T27] ? __pfx_port100_probe+0x10/0x10 [ 97.068274][ T27] ? __pm_runtime_set_status+0xa96/0xd80 [ 97.073916][ T27] usb_probe_interface+0x788/0xe50 [ 97.079034][ T27] ? __pfx_usb_probe_interface+0x10/0x10 [ 97.084661][ T27] ? kernfs_create_link+0x1cd/0x240 [ 97.089860][ T27] ? sysfs_do_create_link_sd+0xe0/0x110 [ 97.095405][ T27] ? driver_sysfs_add+0x1fe/0x210 [ 97.100432][ T27] ? __pfx_usb_probe_interface+0x10/0x10 [ 97.106061][ T27] really_probe+0x254/0xae0 [ 97.110573][ T27] __driver_probe_device+0x1e8/0x360 [ 97.115869][ T27] driver_probe_device+0x4f/0x240 [ 97.120899][ T27] __device_attach_driver+0x270/0x410 [ 97.126273][ T27] bus_for_each_drv+0x258/0x2f0 [ 97.131118][ T27] ? __pfx___device_attach_driver+0x10/0x10 [ 97.137007][ T27] ? __pfx_bus_for_each_drv+0x10/0x10 [ 97.142384][ T27] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 97.148192][ T27] __device_attach+0x2c4/0x450 [ 97.152954][ T27] ? __pfx___device_attach+0x10/0x10 [ 97.158240][ T27] ? do_raw_spin_unlock+0xf5/0x200 [ 97.163354][ T27] ? _raw_spin_unlock+0x28/0x50 [ 97.168240][ T27] device_initial_probe+0xa1/0xd0 [ 97.173267][ T27] bus_probe_device+0x12a/0x220 [ 97.178117][ T27] device_add+0x7d7/0xb80 [ 97.182444][ T27] usb_set_configuration+0x1ad8/0x2180 [ 97.187922][ T27] usb_generic_driver_probe+0x8d/0x150 [ 97.193408][ T27] usb_probe_device+0x1c3/0x3b0 [ 97.198260][ T27] ? __pfx_usb_probe_device+0x10/0x10 [ 97.203622][ T27] really_probe+0x254/0xae0 [ 97.208132][ T27] __driver_probe_device+0x1e8/0x360 [ 97.213421][ T27] driver_probe_device+0x4f/0x240 [ 97.218453][ T27] __device_attach_driver+0x270/0x410 [ 97.223828][ T27] bus_for_each_drv+0x258/0x2f0 [ 97.228673][ T27] ? __pfx___device_attach_driver+0x10/0x10 [ 97.234566][ T27] ? __pfx_bus_for_each_drv+0x10/0x10 [ 97.239933][ T27] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 97.245736][ T27] __device_attach+0x2c4/0x450 [ 97.250502][ T27] ? __pfx___device_attach+0x10/0x10 [ 97.255786][ T27] ? do_raw_spin_unlock+0xf5/0x200 [ 97.260909][ T27] ? _raw_spin_unlock+0x28/0x50 [ 97.265752][ T27] device_initial_probe+0xa1/0xd0 [ 97.270779][ T27] bus_probe_device+0x12a/0x220 [ 97.275628][ T27] device_add+0x7d7/0xb80 [ 97.279959][ T27] usb_new_device+0x9aa/0x1690 [ 97.284739][ T27] ? __pfx_usb_new_device+0x10/0x10 [ 97.289983][ T27] ? _raw_spin_unlock_irq+0x23/0x50 [ 97.295204][ T27] hub_event+0x28e8/0x4d30 [ 97.299619][ T27] ? do_raw_spin_unlock+0xf5/0x200 [ 97.304771][ T27] ? __pfx_hub_event+0x10/0x10 [ 97.309624][ T27] ? rcu_is_watching+0x16/0xb0 [ 97.314388][ T27] ? process_scheduled_works+0x97a/0x1630 [ 97.320109][ T27] process_scheduled_works+0xc3d/0x1630 [ 97.325679][ T27] ? __pfx_process_scheduled_works+0x10/0x10 [ 97.331684][ T27] ? assign_work+0x3cf/0x5d0 [ 97.336292][ T27] worker_thread+0xa47/0xfb0 [ 97.340913][ T27] kthread+0x38b/0x480 [ 97.344978][ T27] ? __pfx_worker_thread+0x10/0x10 [ 97.350090][ T27] ? __pfx_kthread+0x10/0x10 [ 97.354676][ T27] ret_from_fork+0x514/0xb70 [ 97.359271][ T27] ? __pfx_ret_from_fork+0x10/0x10 [ 97.364404][ T27] ? __switch_to+0xc78/0x1410 [ 97.369080][ T27] ? __pfx_kthread+0x10/0x10 [ 97.373673][ T27] ret_from_fork_asm+0x1a/0x30 [ 97.378457][ T27] [ 97.381761][ T27] Kernel Offset: disabled [ 97.386080][ T27] Rebooting in 86400 seconds..