last executing test programs: 8.865828916s ago: executing program 3 (id=4): syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c39000101020301010902200001010080fa0904000002ffffff000705010200020007058102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x2}, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000180), 0x0, 0x0) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1}) r1 = syz_open_dev$I2C(&(0x7f0000000180), 0xa, 0x0) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1}) 6.676272141s ago: executing program 0 (id=9): pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0) pipe2$9p(&(0x7f0000000010)={0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount$9p_fd(0x0, &(0x7f0000000200)='./mnt\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) (async) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x2000, 0x8, '9P2000.L'}, 0x15) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$P9_RATTACH(r1, &(0x7f0000000080)={0x14, 0x69, 0x0, {0x80}}, 0x14) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x1, {0x3fff, {0x80}, 0x41ed, 0x0, 0x0, 0x1, 0x0, 0x1000, 0x1000, 0x8}}, 0xa0) nanosleep(&(0x7f0000000400)={0x1}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/file\x00', 0x42, 0x1ff) write(r3, &(0x7f0000000300)='data', 0x4) 5.676012916s ago: executing program 3 (id=11): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000100)={0x34, &(0x7f0000000140)={0xc0, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000200)={0x34, &(0x7f0000000240)={0xc0, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000340)={0x40, 0xa0}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000400)={0x34, &(0x7f0000000440)={0xc0, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000540)={0xc0, 0xa1, 0x4, '\x00\x00\x00x'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000600)={0x34, &(0x7f0000000640)={0xc0, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000700)={0x34, &(0x7f0000000740)={0xc0, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000800)={0x34, &(0x7f0000000840)={0xc0, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000a00)={0x34, &(0x7f0000000a40)={0xc0, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000b00)={0x34, &(0x7f0000000b40)={0x40, 0xa0}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000c00)={0x34, &(0x7f0000000c40)={0xc0, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000d00)={0x34, &(0x7f0000000d40)={0xc0, 0xa1, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000002000)={0x1}, 0x0) 5.5378575s ago: executing program 0 (id=12): r0 = memfd_create(&(0x7f0000000000)='syzkaller\x00', 0x0) ftruncate(r0, 0x10000) pwrite64(r0, &(0x7f0000001000)='\b\x00\x00\x00\n\x00\x00\x00\v\x00\x00\x00\f\x00'/24, 0x18, 0x2008) pwrite64(r0, &(0x7f0000001020)="80000000800000000100000000100000000400000400000005000000", 0x1c, 0x2024) pwrite64(r0, &(0x7f0000001040)="00f0ffff00fcffff0c0000000a00000000000000000000000200000001000000", 0x20, 0x2048) pwrite64(r0, &(0x7f0000001060)="00080000000000000000000000040000200000000200000000000000", 0x1c, 0x2068) pwrite64(r0, &(0x7f0000001080)="0100000000000000", 0x8, 0x2088) pwrite64(r0, &(0x7f0000001090)="0d000000000400000004000001000000010000000100000001000000010000008000000080000000", 0x28, 0x2098) pwrite64(r0, &(0x7f00000010c0)="01000000640000006400000064000000", 0x10, 0x20c0) pwrite64(r0, &(0x7f00000010d0)="01010101010101010101010101010101", 0x10, 0x20cc) pwrite64(r0, &(0x7f00000011b0)="389d267c389d267c389d267c389d267c389d267c", 0x14, 0x24e0) pwrite64(r0, &(0x7f00000010e0)="5419010054190100541901005419010054190100", 0x14, 0x2554) pwrite64(r0, &(0x7f00000010f0)="55020900", 0x4, 0x2804) pwrite64(r0, &(0x7f0000001100)="000000000100800080000000", 0xc, 0x280c) pwrite64(r0, &(0x7f0000001110)="01000000640000006400000064000000", 0x10, 0x2818) pwrite64(r0, &(0x7f0000001120)='\x00'/12, 0xc, 0x2828) pwrite64(r0, &(0x7f0000001130)="80000000a0000000c0000000e000000000010000", 0x14, 0x2854) pwrite64(r0, &(0x7f00000011a0)="04", 0x1, 0x28c0) pwrite64(r0, &(0x7f0000001150)="0000ffffffffffffffffffffffffffff", 0x10, 0x28e0) pwrite64(r0, &(0x7f0000001160)="ed410200", 0x4, 0x2d00) pwrite64(r0, &(0x7f0000001170)="0004000000000000", 0x8, 0x2d08) pwrite64(r0, &(0x7f0000001180)='\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00', 0x30, 0x2d28) pwrite64(r0, &(0x7f0000001190)="020000000c0001002e00000002000000f40102002e2e0000", 0x18, 0x3000) r1 = syz_open_dev$loop(&(0x7f0000002000), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000003000)='./mnt\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./mnt/file\x00', 0x42, 0x1ff) write(r2, &(0x7f0000007000)='A', 0x1) 5.403739623s ago: executing program 0 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)="ff00", 0x2) write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7) write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf) write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf) write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd) write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa) write(r0, &(0x7f0000000380)="040e05010f200001", 0x8) write(r0, &(0x7f00000003c0)="040e05012a200001", 0x8) write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf) write(r0, &(0x7f0000000440)="040e05013b200001", 0x8) 3.148482s ago: executing program 1 (id=20): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff) sendfile(r1, r0, 0x0, 0xc00) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x42, 0x1ff) sendfile(r2, r0, 0x0, 0xc00) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./mnt/f3\x00', 0x42, 0x1ff) sendfile(r3, r0, 0x0, 0xc00) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./mnt/f4\x00', 0x42, 0x1ff) sendfile(r4, r0, 0x0, 0xc00) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x42, 0x1ff) sendfile(r5, r0, 0x0, 0xc00) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001300)='./mnt/f4\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) 2.978627855s ago: executing program 2 (id=22): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f00000000c0)="0200", 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/resource0\x00', 0x2, 0x0) pwrite64(r1, &(0x7f0000000140)="00000080", 0x4, 0x0) 2.947024905s ago: executing program 0 (id=23): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x1234\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x5678\n', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/midi2.0\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1/midi2.0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='dummy_udc.0\n', 0xc) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2625a00}, 0x0) r3 = syz_open_dev$midi(&(0x7f0000000400), 0x0, 0x2) write$midi(r3, &(0x7f0000000440)='hello', 0x5) r4 = syz_open_dev$midi(&(0x7f0000000480), 0x1, 0x2) write$midi(r4, &(0x7f00000004c0)='hello', 0x5) r5 = syz_open_dev$midi(&(0x7f0000000500), 0x2, 0x2) write$midi(r5, &(0x7f0000000540)='hello', 0x5) 2.682170262s ago: executing program 2 (id=24): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000800), 0x0, 0x3f6, &(0x7f0000000200)="$eJzs3c9PHFUcAPDvDL9qf1hs66/GA2piiEYQliaSaCKePRg1niVCC3FbtKAtnNpE7z146NXEmwc5NV5MPGviVRMvHk0j8U9YM8MMbGEXWBecZPfzSQbemzeb92Ye771h5j0IoG+NRcSdiBiOiMWIOF/sT4ot3tresuPu1TaXsi2JRuP9f5I8/VZtcymaPpM5k31JI17Pvn2ZxECLfFfXNz6Zr9cXbxbxybXrn06urm+8unx9/tritcUbtdkrV2amatMzx3eu67+8PLAx+/bz928/mPj9+x/+zMp7tkhrPo/jMhZjO9dkf1pvOdsUTgYrLAgdSSPy9jmYt//zMRAqDwB6XaPRGNkTBwB6XmLMB4A+U/7ef6u2uVRulTyIoBJbcxFxarv+y/e72ymDO2+Chva83ztOYxFx/4XlZ7ItTug9LAAAu+7cjYiPRsf23/8nXc8EunSEY/bOg3P/BwAn76e5yCfq7x//03iu6bhzEfF4sT5gNCKeiIgLEXGxy/wPH//Th11mwQG25iLeaFrbca+p/gujA0XsXF73Q8nV5fria8XPw3gMjWTxqQPy+PGzdz9sl9b8/C/bsvzLZ4FFOR4Ojjz6mYX5tfluzpldW3cjLg+2qv/d+/8kIp7sIo+Vi9/+3C7t8PrnJDW+iXipZfvfXbmUHLg+azLvDibLTqGFr/640LZ7UP/Vytr/6YPrP+//d9brrXaex3ezv7V9lPBf+//h5IO8gMPFvtvza2s3pyKGk3f275/uvMy9qrwe5fXK6n/8xdbjf/n8JrugT0XE0xGRVcyzEXG5gzzrf//6Xrs07b9aWf0vHNL+k0faf+eBNx98UW+X/9Ha/0xemPFij/u/wx21gqouJwAAAAAAAADHI83XdifpxE44TScmtv+G96U4ndZXVtdeubry+Y2F7TXgozGUllO9zjfNB50q5gWX8ek98VoxZ/jrkcfy+MTHK/WFqk8eAPrUmTbjf+avkapLBwCcmFNVFwAA+N8Z/wGg/xj/AaD/GP8BoP8Y/wGg/xj/AQAAoKd18399BAQEejVQdc8EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0Fv+DQAA//8HkrFs") mkdirat(0xffffffffffffff9c, &(0x7f0000003000)='./file0/d\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004000)='./file0/d/A11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004200)='./file0/d/B11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004400)='./file0/d/C11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004600)='./file0/d/D11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004800)='./file0/d/E11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004a00)='./file0/d/F11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004c00)='./file0/d/G11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004e00)='./file0/d/H11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000005000)='./file0/d/I11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000005200)='./file0/d/J11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000005600)='./file0/d/L11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000005800)='./file0/d/M11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) 2.663518403s ago: executing program 1 (id=25): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000240)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a00000014000780050015000000000008001240"], 0x60}}, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000540)='\xfb\x06\x00', 0x380246, &(0x7f0000000380)={@align=0xdd43, {0x800, 0x1, 0x0, 0x5}}, 0x2, &(0x7f0000000500)={@_ha_fsid}, &(0x7f00000003c0)=0x80000002}) getpid() socket(0x28, 0x801, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001080)=ANY=[@ANYBLOB="380000000114010000000000000000000900020073797a3045b7"], 0x38}, 0x1, 0x0, 0x0, 0x80c9}, 0x20000000) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000340)}], 0x1}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000080a00000a1c000000080a0103000000000000"], 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) nanosleep(&(0x7f0000000000)={0x1}, 0x0) 2.052672478s ago: executing program 2 (id=26): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff) sendfile(r1, r0, 0x0, 0xc00) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x42, 0x1ff) sendfile(r2, r0, 0x0, 0xc00) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./mnt/f3\x00', 0x42, 0x1ff) sendfile(r3, r0, 0x0, 0xc00) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./mnt/f4\x00', 0x42, 0x1ff) sendfile(r4, r0, 0x0, 0xc00) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x42, 0x1ff) sendfile(r5, r0, 0x0, 0xc00) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001200)='./mnt/f3\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) 1.504337072s ago: executing program 1 (id=27): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff) sendfile(r1, r0, 0x0, 0xc00) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x42, 0x1ff) sendfile(r2, r0, 0x0, 0xc00) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./mnt/f3\x00', 0x42, 0x1ff) sendfile(r3, r0, 0x0, 0xc00) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./mnt/f4\x00', 0x42, 0x1ff) sendfile(r4, r0, 0x0, 0xc00) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x42, 0x1ff) sendfile(r5, r0, 0x0, 0xc00) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001300)='./mnt/f4\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) 1.402302854s ago: executing program 0 (id=28): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff) sendfile(r1, r0, 0x0, 0xc00) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x42, 0x1ff) sendfile(r2, r0, 0x0, 0xc00) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./mnt/f3\x00', 0x42, 0x1ff) sendfile(r3, r0, 0x0, 0xc00) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./mnt/f4\x00', 0x42, 0x1ff) sendfile(r4, r0, 0x0, 0xc00) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x42, 0x1ff) sendfile(r5, r0, 0x0, 0xc00) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001200)='./mnt/f3\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) 1.062712313s ago: executing program 1 (id=29): r0 = memfd_create(&(0x7f0000000000)='syzkaller\x00', 0x0) ftruncate(r0, 0x1000000) r1 = syz_open_dev$loop(&(0x7f0000000100), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) r2 = memfd_create(&(0x7f0000000000)='syzkaller\x00', 0x0) ftruncate(r2, 0x1000000) r3 = syz_open_dev$loop(&(0x7f0000000100), 0x1, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r2) r4 = memfd_create(&(0x7f0000000000)='syzkaller\x00', 0x0) ftruncate(r4, 0x1000000) r5 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2) ioctl$LOOP_SET_FD(r5, 0x4c00, r4) r6 = memfd_create(&(0x7f0000000000)='syzkaller\x00', 0x0) ftruncate(r6, 0x1000000) r7 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x2) ioctl$LOOP_SET_FD(r7, 0x4c00, r6) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./md0\x00', 0x8180, 0x900) r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./md0\x00', 0x0, 0x0) ioctl(r8, 0x40486d23, &(0x7f0000001000)="000000005a00000000000000000000000600000010270000040000000400000000000000010000000000000000000000000000000000000000000000000000000000000000100000") ioctl(r8, 0x40146d21, &(0x7f0000002000)="0000000007000000000000000000000006000000") ioctl(r8, 0x40146d21, &(0x7f0000002000)="0100000007000000010000000100000006000000") ioctl(r8, 0x40146d21, &(0x7f0000002000)="0200000007000000020000000200000006000000") ioctl(r8, 0x40146d21, &(0x7f0000002000)="0300000007000000030000000300000006000000") ioctl(r8, 0x400c6d30, &(0x7f0000003000)="000000000010000000000000") ioctl(r8, 0x6d29, &(0x7f0000700000)) ioctl(r8, 0x6d29, &(0x7f0000700001)) pread64(r8, &(0x7f0000004000), 0x1000, 0x0) 1.057459053s ago: executing program 2 (id=30): r0 = memfd_create(&(0x7f0000000000)='syzkaller\x00', 0x0) ftruncate(r0, 0x10000) pwrite64(r0, &(0x7f0000001000)='\b\x00\x00\x00\n\x00\x00\x00\v\x00\x00\x00\f\x00'/24, 0x18, 0x2008) pwrite64(r0, &(0x7f0000001020)="80000000800000000100000000100000000400000400000005000000", 0x1c, 0x2024) pwrite64(r0, &(0x7f0000001040)="00f0ffff00fcffff0c0000000a00000000000000000000000200000001000000", 0x20, 0x2048) pwrite64(r0, &(0x7f0000001060)="00080000000000000000000000040000200000000200000000000000", 0x1c, 0x2068) pwrite64(r0, &(0x7f0000001080)="0100000000000000", 0x8, 0x2088) pwrite64(r0, &(0x7f0000001090)="0d000000000400000004000001000000010000000100000001000000010000008000000080000000", 0x28, 0x2098) pwrite64(r0, &(0x7f00000010c0)="01000000640000006400000064000000", 0x10, 0x20c0) pwrite64(r0, &(0x7f00000010d0)="01010101010101010101010101010101", 0x10, 0x20cc) pwrite64(r0, &(0x7f00000011b0)="389d267c389d267c389d267c389d267c389d267c", 0x14, 0x24e0) pwrite64(r0, &(0x7f00000010e0)="5419010054190100541901005419010054190100", 0x14, 0x2554) pwrite64(r0, &(0x7f00000010f0)="55020900", 0x4, 0x2804) pwrite64(r0, &(0x7f0000001100)="000000000100800080000000", 0xc, 0x280c) pwrite64(r0, &(0x7f0000001110)="01000000640000006400000064000000", 0x10, 0x2818) pwrite64(r0, &(0x7f0000001120)='\x00'/12, 0xc, 0x2828) pwrite64(r0, &(0x7f0000001130)="80000000a0000000c0000000e000000000010000", 0x14, 0x2854) pwrite64(r0, &(0x7f00000011a0)="04", 0x1, 0x28c0) pwrite64(r0, &(0x7f0000001150)="0000ffffffffffffffffffffffffffff", 0x10, 0x28e0) pwrite64(r0, &(0x7f0000001160)="ed410200", 0x4, 0x2d00) pwrite64(r0, &(0x7f0000001170)="0004000000000000", 0x8, 0x2d08) pwrite64(r0, &(0x7f0000001180)='\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00', 0x30, 0x2d28) pwrite64(r0, &(0x7f0000001190)="020000000c0001002e00000002000000f40102002e2e0000", 0x18, 0x3000) r1 = syz_open_dev$loop(&(0x7f0000002000), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) close(r1) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000003000)='./mnt\x00', &(0x7f0000004000)='ufs\x00', 0x0, &(0x7f0000005000)='ufstype=sun\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./mnt/file\x00', 0x42, 0x1ff) write(r2, &(0x7f0000007000)='A', 0x1) 1.043158243s ago: executing program 0 (id=31): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)="ff00", 0x2) write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7) write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf) write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf) write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd) write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa) write(r0, &(0x7f0000000380)="040e05010f200001", 0x8) write(r0, &(0x7f00000003c0)="040e05012a200001", 0x8) write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf) write(r0, &(0x7f0000000440)="040e05013b200001", 0x8) 815.962659ms ago: executing program 2 (id=32): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff) sendfile(r1, r0, 0x0, 0xc00) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x42, 0x1ff) sendfile(r2, r0, 0x0, 0xc00) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./mnt/f3\x00', 0x42, 0x1ff) sendfile(r3, r0, 0x0, 0xc00) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./mnt/f4\x00', 0x42, 0x1ff) sendfile(r4, r0, 0x0, 0xc00) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x42, 0x1ff) sendfile(r5, r0, 0x0, 0xc00) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001300)='./mnt/f4\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) 528.616366ms ago: executing program 1 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x42, 0x1ff) sendfile(r1, r0, 0x0, 0xc00) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x42, 0x1ff) sendfile(r2, r0, 0x0, 0xc00) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./mnt/f3\x00', 0x42, 0x1ff) sendfile(r3, r0, 0x0, 0xc00) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./mnt/f4\x00', 0x42, 0x1ff) sendfile(r4, r0, 0x0, 0xc00) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x42, 0x1ff) sendfile(r5, r0, 0x0, 0xc00) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001300)='./mnt/f4\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt/f5\x00', 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) sendfile(r6, r0, 0x0, 0x20000) 493.693487ms ago: executing program 2 (id=34): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000800), 0x0, 0x3f6, &(0x7f0000000200)="$eJzs3c9PHFUcAPDvDL9qf1hs66/GA2piiEYQliaSaCKePRg1niVCC3FbtKAtnNpE7z146NXEmwc5NV5MPGviVRMvHk0j8U9YM8MMbGEXWBecZPfzSQbemzeb92Ye771h5j0IoG+NRcSdiBiOiMWIOF/sT4ot3tresuPu1TaXsi2JRuP9f5I8/VZtcymaPpM5k31JI17Pvn2ZxECLfFfXNz6Zr9cXbxbxybXrn06urm+8unx9/tritcUbtdkrV2amatMzx3eu67+8PLAx+/bz928/mPj9+x/+zMp7tkhrPo/jMhZjO9dkf1pvOdsUTgYrLAgdSSPy9jmYt//zMRAqDwB6XaPRGNkTBwB6XmLMB4A+U/7ef6u2uVRulTyIoBJbcxFxarv+y/e72ymDO2+Chva83ztOYxFx/4XlZ7ItTug9LAAAu+7cjYiPRsf23/8nXc8EunSEY/bOg3P/BwAn76e5yCfq7x//03iu6bhzEfF4sT5gNCKeiIgLEXGxy/wPH//Th11mwQG25iLeaFrbca+p/gujA0XsXF73Q8nV5fria8XPw3gMjWTxqQPy+PGzdz9sl9b8/C/bsvzLZ4FFOR4Ojjz6mYX5tfluzpldW3cjLg+2qv/d+/8kIp7sIo+Vi9/+3C7t8PrnJDW+iXipZfvfXbmUHLg+azLvDibLTqGFr/640LZ7UP/Vytr/6YPrP+//d9brrXaex3ezv7V9lPBf+//h5IO8gMPFvtvza2s3pyKGk3f275/uvMy9qrwe5fXK6n/8xdbjf/n8JrugT0XE0xGRVcyzEXG5gzzrf//6Xrs07b9aWf0vHNL+k0faf+eBNx98UW+X/9Ha/0xemPFij/u/wx21gqouJwAAAAAAAADHI83XdifpxE44TScmtv+G96U4ndZXVtdeubry+Y2F7TXgozGUllO9zjfNB50q5gWX8ek98VoxZ/jrkcfy+MTHK/WFqk8eAPrUmTbjf+avkapLBwCcmFNVFwAA+N8Z/wGg/xj/AaD/GP8BoP8Y/wGg/xj/AQAAoKd18399BAQEejVQdc8EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0Fv+DQAA//8HkrFs") mkdirat(0xffffffffffffff9c, &(0x7f0000003000)='./file0/d\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004000)='./file0/d/A11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004200)='./file0/d/B11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004400)='./file0/d/C11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004600)='./file0/d/D11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004800)='./file0/d/E11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004a00)='./file0/d/F11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004c00)='./file0/d/G11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004e00)='./file0/d/H11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000005000)='./file0/d/I11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000005200)='./file0/d/J11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000005600)='./file0/d/L11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000005800)='./file0/d/M11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111\x00', 0x42, 0x1ff) 493.160777ms ago: executing program 3 (id=35): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000240)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a00000014000780050015000000000008001240"], 0x60}}, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000540)='\xfb\x06\x00', 0x380246, &(0x7f0000000380)={@align=0xdd43, {0x800, 0x1, 0x0, 0x5}}, 0x2, &(0x7f0000000500)={@_ha_fsid}, &(0x7f00000003c0)=0x80000002}) getpid() socket(0x28, 0x801, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001080)=ANY=[@ANYBLOB="380000000114010000000000000000000900020073797a3045b7"], 0x38}, 0x1, 0x0, 0x0, 0x80c9}, 0x20000000) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000340)}], 0x1}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000080a00000a1c000000080a0103000000000000"], 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) nanosleep(&(0x7f0000000000)={0x1}, 0x0) 0s ago: executing program 1 (id=36): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='0000:00:03.0\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='snd_hda_intel\x00', 0xe) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/pci/drivers/snd_hda_intel/bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000200)='0000:00:03.0\x00', 0xd) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.69' (ED25519) to the list of known hosts. [ 84.127831][ T5761] cgroup: Unknown subsys name 'net' [ 84.299191][ T5761] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 86.031943][ T5761] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 87.892464][ T5778] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.913060][ T5787] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 87.920867][ T5787] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.929862][ T5787] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 87.937156][ T5787] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 87.945339][ T5787] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 87.953768][ T5787] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 87.961593][ T5787] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 87.969033][ T5787] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 87.999352][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.008020][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.017385][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.026192][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.034531][ T5788] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.034922][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 88.049474][ T5788] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.057300][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 88.065834][ T5788] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 88.081247][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.127308][ T5085] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 88.136773][ T5085] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 88.150195][ T5085] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 88.159967][ T5085] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 88.168397][ T5085] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 88.527812][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 88.737449][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 88.766754][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.774983][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.784086][ T5773] bridge_slave_0: entered allmulticast mode [ 88.792107][ T5773] bridge_slave_0: entered promiscuous mode [ 88.848675][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.858315][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.865710][ T5773] bridge_slave_1: entered allmulticast mode [ 88.873672][ T5773] bridge_slave_1: entered promiscuous mode [ 88.881469][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 88.933353][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.976886][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.998008][ T5785] chnl_net:caif_netlink_parms(): no params data found [ 89.064487][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.074247][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.081991][ T5776] bridge_slave_0: entered allmulticast mode [ 89.089264][ T5776] bridge_slave_0: entered promiscuous mode [ 89.100688][ T5773] team0: Port device team_slave_0 added [ 89.106996][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.114618][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.122252][ T5776] bridge_slave_1: entered allmulticast mode [ 89.129302][ T5776] bridge_slave_1: entered promiscuous mode [ 89.156642][ T5773] team0: Port device team_slave_1 added [ 89.248179][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.261592][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.271889][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.278892][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.305183][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.318747][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.326213][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.353421][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.367402][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.374986][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.382733][ T5774] bridge_slave_0: entered allmulticast mode [ 89.390320][ T5774] bridge_slave_0: entered promiscuous mode [ 89.424753][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.432425][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.439809][ T5774] bridge_slave_1: entered allmulticast mode [ 89.447488][ T5774] bridge_slave_1: entered promiscuous mode [ 89.510860][ T5776] team0: Port device team_slave_0 added [ 89.525251][ T5785] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.532705][ T5785] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.540276][ T5785] bridge_slave_0: entered allmulticast mode [ 89.547488][ T5785] bridge_slave_0: entered promiscuous mode [ 89.568736][ T5776] team0: Port device team_slave_1 added [ 89.613479][ T5773] hsr_slave_0: entered promiscuous mode [ 89.620904][ T5773] hsr_slave_1: entered promiscuous mode [ 89.629126][ T5785] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.636378][ T5785] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.650400][ T5785] bridge_slave_1: entered allmulticast mode [ 89.657522][ T5785] bridge_slave_1: entered promiscuous mode [ 89.678690][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.692042][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.713957][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.721261][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.747544][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.761012][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.768014][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.794463][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.848802][ T5774] team0: Port device team_slave_0 added [ 89.858623][ T5785] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.872173][ T5785] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.902882][ T5774] team0: Port device team_slave_1 added [ 89.979361][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.986850][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.013867][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.035539][ T5785] team0: Port device team_slave_0 added [ 90.042222][ T5782] Bluetooth: hci2: command tx timeout [ 90.052950][ T5785] team0: Port device team_slave_1 added [ 90.071247][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.078266][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.104730][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.145668][ T5776] hsr_slave_0: entered promiscuous mode [ 90.152349][ T5776] hsr_slave_1: entered promiscuous mode [ 90.158802][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.167693][ T5776] Cannot create hsr debugfs directory [ 90.199864][ T5782] Bluetooth: hci3: command tx timeout [ 90.199930][ T5085] Bluetooth: hci1: command tx timeout [ 90.205986][ T5782] Bluetooth: hci0: command tx timeout [ 90.237859][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.245095][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.271786][ T5785] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.320554][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.327574][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.353954][ T5785] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.431625][ T5774] hsr_slave_0: entered promiscuous mode [ 90.438227][ T5774] hsr_slave_1: entered promiscuous mode [ 90.445743][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.453427][ T5774] Cannot create hsr debugfs directory [ 90.573459][ T5785] hsr_slave_0: entered promiscuous mode [ 90.580785][ T5785] hsr_slave_1: entered promiscuous mode [ 90.587105][ T5785] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.595191][ T5785] Cannot create hsr debugfs directory [ 90.773918][ T5773] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 90.799591][ T5773] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 90.836159][ T5773] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 90.847656][ T5773] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 90.980081][ T5776] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.995307][ T5776] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 91.018683][ T5776] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 91.032553][ T5776] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 91.089468][ T5785] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 91.117402][ T5785] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 91.165821][ T5785] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 91.181707][ T5785] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 91.275560][ T5774] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 91.287135][ T5774] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 91.299580][ T5774] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 91.317637][ T5774] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 91.391678][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.444385][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.489110][ T142] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.496976][ T142] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.511433][ T142] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.518628][ T142] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.565134][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.602524][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.657819][ T3484] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.665112][ T3484] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.703646][ T142] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.710877][ T142] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.728124][ T5785] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.749227][ T5773] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 91.872283][ T5785] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.915251][ T142] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.922550][ T142] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.963484][ T3484] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.970770][ T3484] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.003335][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.115877][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.130458][ T5782] Bluetooth: hci2: command tx timeout [ 92.133244][ T28] cfg80211: failed to load regulatory.db [ 92.165804][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.173171][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.222787][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.230030][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.280651][ T5782] Bluetooth: hci1: command tx timeout [ 92.281200][ T5085] Bluetooth: hci3: command tx timeout [ 92.286126][ T5782] Bluetooth: hci0: command tx timeout [ 92.443658][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.521169][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.658360][ T5773] veth0_vlan: entered promiscuous mode [ 92.694867][ T5773] veth1_vlan: entered promiscuous mode [ 92.712864][ T5776] veth0_vlan: entered promiscuous mode [ 92.805701][ T5785] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.828314][ T5776] veth1_vlan: entered promiscuous mode [ 92.857674][ T5773] veth0_macvtap: entered promiscuous mode [ 92.889535][ T5773] veth1_macvtap: entered promiscuous mode [ 92.933178][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.951679][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.981996][ T5773] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.994462][ T5773] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.004791][ T5773] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.015232][ T5773] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.035542][ T5776] veth0_macvtap: entered promiscuous mode [ 93.049175][ T5776] veth1_macvtap: entered promiscuous mode [ 93.092405][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.112662][ T5785] veth0_vlan: entered promiscuous mode [ 93.142716][ T5785] veth1_vlan: entered promiscuous mode [ 93.158413][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.170851][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.182619][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.226880][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.238696][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.256348][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.269152][ T5776] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.278587][ T5776] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.288307][ T5776] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.297478][ T5776] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.380454][ T3428] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.388787][ T3428] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.415833][ T5785] veth0_macvtap: entered promiscuous mode [ 93.475058][ T5785] veth1_macvtap: entered promiscuous mode [ 93.484117][ T5774] veth0_vlan: entered promiscuous mode [ 93.531457][ T3428] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.544695][ T3428] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.571144][ T5774] veth1_vlan: entered promiscuous mode [ 93.591742][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.603981][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.619658][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.633492][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.647041][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.688518][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.706555][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.718846][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.739863][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.753775][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.767453][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.780549][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.833109][ T5785] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.846884][ T5785] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.859549][ T5785] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.870676][ T5785] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.887481][ T5774] veth0_macvtap: entered promiscuous mode [ 93.893482][ T142] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.930187][ T142] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.963401][ T5774] veth1_macvtap: entered promiscuous mode [ 94.045736][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 94.059390][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.070546][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 94.085777][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.096034][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 94.107022][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.121538][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.152735][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 94.180169][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.193201][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 94.205346][ T5782] Bluetooth: hci2: command tx timeout [ 94.212940][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.224268][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 94.235050][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.246786][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.325632][ T5843] syz.2.5[5843]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 94.362937][ T5782] Bluetooth: hci3: command tx timeout [ 94.364411][ T51] Bluetooth: hci0: command tx timeout [ 94.369349][ T5774] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.374269][ T5085] Bluetooth: hci1: command tx timeout [ 94.399609][ T5774] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.419662][ T5774] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.438374][ T5774] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.481556][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.489470][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.636814][ T3484] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.675818][ T3484] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.882006][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.916717][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.987314][ T5843] loop2: detected capacity change from 0 to 32768 [ 95.042556][ T5843] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop2 scanned by syz.2.5 (5843) [ 95.101619][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.136727][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.152324][ T5843] BTRFS info (device loop2): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 95.212668][ T5843] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm [ 95.269520][ T5843] BTRFS info (device loop2): using free space tree [ 95.380635][ T5779] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 95.492285][ T5843] BTRFS info (device loop2): enabling ssd optimizations [ 95.514775][ T5843] BTRFS info (device loop2): auto enabling async discard [ 95.636181][ T5779] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice= 1.01 [ 95.659861][ T5779] usb 4-1: New USB device strings: Mfr=2, Product=3, SerialNumber=1 [ 95.682973][ T5779] usb 4-1: Product: syz [ 95.687230][ T5779] usb 4-1: Manufacturer: syz [ 95.708313][ T5779] usb 4-1: SerialNumber: syz [ 95.742656][ T8] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 95.768818][ T5779] pvrusb2: Hardware description: Terratec Grabster AV400 [ 95.787793][ T5779] pvrusb2: ********** [ 95.797941][ T5779] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 95.838854][ T5779] pvrusb2: Important functionality might not be entirely working. [ 95.849831][ T5779] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 95.885495][ T5779] pvrusb2: ********** [ 95.960951][ T8] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 95.981804][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.999331][ T5773] BTRFS info (device loop2): last unmount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 96.012549][ T8] usb 2-1: Product: syz [ 96.024419][ T8] usb 2-1: Manufacturer: syz [ 96.033113][ T8] usb 2-1: SerialNumber: syz [ 96.182929][ T5872] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 96.284676][ T5085] Bluetooth: hci2: command tx timeout [ 96.444009][ T5085] Bluetooth: hci3: command tx timeout [ 96.449556][ T5085] Bluetooth: hci1: command tx timeout [ 96.455645][ T51] Bluetooth: hci0: command tx timeout [ 96.621612][ T5879] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 96.643802][ T5879] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 96.784192][ T5865] NFSD: attempt to initialize umh client tracking in a container ignored. [ 96.798935][ T5865] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 96.821159][ T5865] NFSD: Unable to initialize client recovery tracking! (-22) [ 96.842021][ T5865] NFSD: starting 90-second grace period (net f00003c8) [ 97.422137][ T27] audit: type=1800 audit(1785883199.350:2): pid=5888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.10" name="idVendor" dev="configfs" ino=6697 res=0 errno=0 [ 97.451737][ T27] audit: type=1800 audit(1785883199.380:3): pid=5888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.10" name="idProduct" dev="configfs" ino=6698 res=0 errno=0 [ 97.495595][ T5888] Config c/1 of g1 needs at least one function. [ 97.503167][ T27] audit: type=1800 audit(1785883199.410:4): pid=5888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.10" name="UDC" dev="configfs" ino=7857 res=0 errno=0 [ 97.523667][ T5888] udc dummy_udc.0: failed to start g1: -22 [ 97.532431][ T5888] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 97.548004][ T5888] UDC core: g1: couldn't find an available UDC or it's busy [ 97.720183][ T5872] usb 2-1: Service connection timeout for: 257 [ 97.728479][ T5872] ath9k_htc 2-1:1.0: ath9k_htc: Unable to initialize HTC services [ 97.767264][ T5872] ath9k_htc: Failed to initialize the device [ 97.786278][ T5872] usb 2-1: ath9k_htc: USB layer deinitialized [ 98.058228][ T2322] pvrusb2: Failed to submit write-control URB status=-2 [ 98.092059][ T5779] usb 4-1: USB disconnect, device number 2 [ 98.099991][ T2322] pvrusb2: Device being rendered inoperable [ 98.106364][ T2322] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 98.133117][ T2322] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 98.300664][ T5894] loop0: detected capacity change from 0 to 128 [ 98.507382][ T5896] loop2: detected capacity change from 0 to 512 [ 98.515359][ T174] usb 2-1: USB disconnect, device number 2 [ 98.591443][ T5896] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 98.605132][ T5779] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 98.655889][ T51] Bluetooth: hci4: unexpected event for opcode 0x2002 [ 98.669469][ T51] Bluetooth: hci4: unexpected event for opcode 0x200f [ 98.686098][ T51] Bluetooth: hci4: unexpected event for opcode 0x202a [ 98.746085][ T51] Bluetooth: hci4: unexpected event for opcode 0x202f [ 98.757342][ T51] Bluetooth: hci4: unexpected event for opcode 0x203b [ 98.825930][ T5779] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 98.854279][ T5779] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.899015][ T5779] usb 4-1: Product: syz [ 98.909816][ T5779] usb 4-1: Manufacturer: syz [ 98.929826][ T5779] usb 4-1: SerialNumber: syz [ 98.999970][ T5905] Zero length message leads to an empty skb [ 99.595964][ T5773] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 99.770319][ T5907] jffs2: notice: (5907) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 100.493662][ T5916] jffs2: notice: (5916) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 100.680847][ T5085] Bluetooth: hci4: Opcode 0x1002 failed: -110 [ 100.740288][ T5922] loop0: detected capacity change from 0 to 128 [ 100.815683][ T5923] jffs2: notice: (5923) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 100.978435][ T27] audit: type=1800 audit(1785883202.900:5): pid=5929 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.23" name="idVendor" dev="configfs" ino=7915 res=0 errno=0 [ 100.999440][ T27] audit: type=1800 audit(1785883202.900:6): pid=5929 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.23" name="idProduct" dev="configfs" ino=7916 res=0 errno=0 [ 101.044726][ T27] audit: type=1800 audit(1785883202.970:7): pid=5929 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.23" name="UDC" dev="configfs" ino=7918 res=0 errno=0 [ 101.242684][ T5933] loop2: detected capacity change from 0 to 512 [ 101.456057][ T5933] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 101.468788][ T28] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 101.700107][ T28] usb 1-1: Dual-Role OTG device on HNP port [ 101.746442][ T28] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 6.06 [ 101.883310][ T28] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.959793][ T5773] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 102.448637][ T5944] jffs2: notice: (5944) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 102.823102][ T5951] loop0: detected capacity change from 0 to 32768 [ 102.854409][ T5951] loop1: detected capacity change from 0 to 32768 [ 102.886797][ T5951] loop2: detected capacity change from 0 to 32768 [ 102.913704][ T5951] loop3: detected capacity change from 0 to 32768 [ 103.074111][ T5957] jffs2: notice: (5957) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 103.251739][ T5779] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000044. ret = -71 [ 103.314786][ T5779] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -71 [ 103.374664][ T5779] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001004. ret = -71 [ 103.405984][ T5961] jffs2: notice: (5961) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 103.439879][ T5779] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001008. ret = -71 [ 103.508203][ T5779] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001020. ret = -71 [ 103.525001][ T5779] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001028. ret = -71 [ 103.561993][ T5779] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001030. ret = -71 [ 103.610713][ T5779] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001018. ret = -71 [ 103.637227][ T5779] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -71 [ 103.680693][ T5779] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 103.699662][ T5967] loop2: detected capacity change from 0 to 512 [ 103.717853][ T5779] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 103.765299][ T5779] lan78xx: probe of 4-1:1.0 failed with error -71 [ 103.878371][ T5779] usb 4-1: USB disconnect, device number 3 [ 103.892207][ T5967] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 105.080685][ T5085] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 105.080758][ T51] Bluetooth: hci4: command 0x1003 tx timeout [ 133.089578][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.099361][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.525743][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.533636][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 211.972909][ T5788] Bluetooth: hci1: command 0x0406 tx timeout [ 211.979024][ T5788] Bluetooth: hci3: command 0x0406 tx timeout [ 211.985181][ T5787] Bluetooth: hci0: command 0x0406 tx timeout [ 211.991334][ T5788] Bluetooth: hci2: command 0x0406 tx timeout [ 247.640228][ T29] INFO: task syz.3.35:5962 blocked for more than 143 seconds. [ 247.648098][ T29] Not tainted syzkaller #0 [ 247.661527][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 247.671276][ T29] task:syz.3.35 state:D stack:25384 pid:5962 ppid:5785 flags:0x00004004 [ 247.688248][ T29] Call Trace: [ 247.691883][ T29] [ 247.694911][ T29] __schedule+0x15ae/0x4660 [ 247.699572][ T29] ? lock_chain_count+0x20/0x20 [ 247.709757][ T29] ? asan.module_dtor+0x20/0x20 [ 247.716206][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 247.721685][ T29] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 247.727959][ T29] ? _raw_spin_unlock_irqrestore+0xc0/0x120 [ 247.740942][ T29] schedule+0xbd/0x170 [ 247.745693][ T29] io_schedule+0x80/0xd0 [ 247.754319][ T29] bit_wait_io+0x11/0xd0 [ 247.759389][ T29] __wait_on_bit+0x9f/0x2c0 [ 247.764224][ T29] ? bit_wait+0xd0/0xd0 [ 247.768482][ T29] out_of_line_wait_on_bit+0x13c/0x190 [ 247.775944][ T29] ? bit_wait+0xd0/0xd0 [ 247.780308][ T29] ? __wait_on_bit+0x2c0/0x2c0 [ 247.785336][ T29] ? do_raw_spin_lock+0x11f/0x2b0 [ 247.790600][ T29] ? bit_waitqueue+0x30/0x30 [ 247.795292][ T29] ? do_raw_spin_unlock+0x121/0x230 [ 247.800661][ T29] do_get_write_access+0x5c9/0xe00 [ 247.805887][ T29] jbd2_journal_get_write_access+0x10c/0x140 [ 247.811988][ T29] __ext4_journal_get_write_access+0x208/0x6d0 [ 247.818254][ T29] ? __ext4_journal_ensure_credits+0x450/0x450 [ 247.825808][ T29] ? __might_sleep+0xe0/0xe0 [ 247.833208][ T29] ext4_reserve_inode_write+0x205/0x2a0 [ 247.838914][ T29] __ext4_mark_inode_dirty+0x13f/0x6d0 [ 247.847120][ T29] ext4_dirty_inode+0xcb/0x110 [ 247.853495][ T29] ? __ext4_expand_extra_isize+0x400/0x400 [ 247.859529][ T29] __mark_inode_dirty+0x2cc/0xc90 [ 247.864834][ T29] file_update_time+0x187/0x1a0 [ 247.869863][ T29] ext4_page_mkwrite+0x1f9/0x11a0 [ 247.877058][ T29] ? filemap_fault+0x103c/0x1540 [ 247.882465][ T29] ? mapping_seek_hole_data+0x1330/0x1330 [ 247.888321][ T29] ? ext4_change_inode_journal_flag+0x8a0/0x8a0 [ 247.894724][ T29] ? __lock_acquire+0x7d80/0x7d80 [ 247.899885][ T29] ? __pte_offset_map+0x20d/0x280 [ 247.905077][ T29] do_page_mkwrite+0x153/0x3f0 [ 247.911228][ T29] handle_mm_fault+0x1a2c/0x4a50 [ 247.916334][ T29] ? handle_mm_fault+0xe6/0x4a50 [ 247.921443][ T29] ? numa_migrate_prep+0x350/0x350 [ 247.926683][ T29] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 247.932186][ T29] do_user_addr_fault+0x736/0x12d0 [ 247.937416][ T29] exc_page_fault+0x64/0x100 [ 247.947927][ T29] asm_exc_page_fault+0x26/0x30 [ 247.954523][ T29] RIP: 0033:0x7fde17c726e0 [ 247.959087][ T29] RSP: 002b:00007ffdf04f3ab0 EFLAGS: 00010202 [ 247.969700][ T29] RAX: 0000001b2dc23000 RBX: ffffffff8464237c RCX: 0000001b2dc22ff8 [ 247.979547][ T29] RDX: 0000001b2d824220 RSI: 0000000000000008 RDI: 00007fde18b55720 [ 247.993381][ T29] RBP: 00000000000001df R08: 00007fde18010000 R09: 00007fde18012000 [ 248.002929][ T29] R10: 0000000084642380 R11: 000000000000000d R12: 00007fde18026218 [ 248.015230][ T29] R13: 0000000000000cf1 R14: ffffffff8464281c R15: 00007fde18b55720 [ 248.023593][ T29] ? __nla_validate_parse+0x1dac/0x2fd0 [ 248.029264][ T29] ? __nla_validate_parse+0x190c/0x2fd0 [ 248.041737][ T29] [ 248.044902][ T29] [ 248.044902][ T29] Showing all locks held in the system: [ 248.055839][ T29] 1 lock held by khungtaskd/29: [ 248.063884][ T29] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 [ 248.074941][ T29] 6 locks held by kworker/u4:3/48: [ 248.081707][ T29] #0: ffff888141a7c138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 248.094084][ T29] #1: ffffc90000b8fd00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 248.107390][ T29] #2: ffff88814ddee0e0 (&type->s_umount_key#31){++++}-{3:3}, at: super_trylock_shared+0x20/0xf0 [ 248.118441][ T29] #3: ffff88814ddf0c58 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x1a4/0x350 [ 248.130770][ T29] #4: ffff88814ddf2990 (jbd2_handle){.+.+}-{0:0}, at: start_this_handle+0x1f3f/0x2170 [ 248.144958][ T29] #5: ffff888078767088 (&ei->i_data_sem){++++}-{3:3}, at: ext4_map_blocks+0x918/0x1a90 [ 248.154967][ T29] 4 locks held by kworker/u4:7/3428: [ 248.160631][ T29] 1 lock held by syslogd/5122: [ 248.166208][ T29] #0: ffff8880b8e3c298 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 [ 248.177012][ T29] 2 locks held by getty/5526: [ 248.183675][ T29] #0: ffff88802dcb40a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 248.194606][ T29] #1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 [ 248.205039][ T29] 3 locks held by syz-executor/5761: [ 248.210658][ T29] #0: ffff888026253aa0 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 [ 248.221224][ T29] #1: ffff88814ddee510 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x1e2/0x11a0 [ 248.232103][ T29] #2: ffff88814ddf2990 (jbd2_handle){.+.+}-{0:0}, at: start_this_handle+0x1f3f/0x2170 [ 248.242257][ T29] 3 locks held by syz.3.35/5962: [ 248.247298][ T29] #0: ffff888026254da0 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 [ 248.258495][ T29] #1: ffff88814ddee510 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x1e2/0x11a0 [ 248.270536][ T29] #2: ffff88814ddf2990 (jbd2_handle){.+.+}-{0:0}, at: start_this_handle+0x1f3f/0x2170 [ 248.286033][ T29] 3 locks held by syz.2.34/5966: [ 248.292403][ T29] #0: ffff888078276a20 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 [ 248.302630][ T29] #1: ffff88814ddee510 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x1e2/0x11a0 [ 248.312633][ T29] #2: ffff88814ddf2990 (jbd2_handle){.+.+}-{0:0}, at: start_this_handle+0x1f3f/0x2170 [ 248.322855][ T29] 3 locks held by syz.1.36/5972: [ 248.327920][ T29] #0: ffff888078273aa0 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 [ 248.338290][ T29] #1: ffff88814ddee510 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x1e2/0x11a0 [ 248.348491][ T29] #2: ffff88814ddf2990 (jbd2_handle){.+.+}-{0:0}, at: start_this_handle+0x1f3f/0x2170 [ 248.358483][ T29] [ 248.361190][ T29] ============================================= [ 248.361190][ T29] [ 248.370244][ T29] NMI backtrace for cpu 1 [ 248.374642][ T29] CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 248.382323][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 248.392487][ T29] Call Trace: [ 248.395795][ T29] [ 248.398919][ T29] dump_stack_lvl+0x18c/0x250 [ 248.403811][ T29] ? __wake_up_klogd+0xd9/0x100 [ 248.408809][ T29] ? show_regs_print_info+0x20/0x20 [ 248.414682][ T29] ? load_image+0x420/0x420 [ 248.419909][ T29] nmi_cpu_backtrace+0x3a6/0x3e0 [ 248.425187][ T29] ? nmi_trigger_cpumask_backtrace+0x2f0/0x2f0 [ 248.431494][ T29] ? load_image+0x420/0x420 [ 248.436076][ T29] ? wq_watchdog_touch+0xef/0x170 [ 248.441152][ T29] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 248.447470][ T29] nmi_trigger_cpumask_backtrace+0x17a/0x2f0 [ 248.455082][ T29] watchdog+0xf59/0xfa0 [ 248.460440][ T29] ? watchdog+0x1e1/0xfa0 [ 248.464902][ T29] kthread+0x2fa/0x390 [ 248.468984][ T29] ? hungtask_pm_notify+0x50/0x50 [ 248.474291][ T29] ? kthread_blkcg+0xd0/0xd0 [ 248.480633][ T29] ret_from_fork+0x48/0x80 [ 248.485475][ T29] ? kthread_blkcg+0xd0/0xd0 [ 248.490104][ T29] ret_from_fork_asm+0x11/0x20 [ 248.494932][ T29] [ 248.499363][ T29] Sending NMI from CPU 1 to CPUs 0: [ 248.505373][ C0] NMI backtrace for cpu 0 [ 248.505385][ C0] CPU: 0 PID: 142 Comm: kworker/u4:5 Not tainted syzkaller #0 [ 248.505401][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 248.505412][ C0] Workqueue: events_unbound nsim_dev_trap_report_work [ 248.505437][ C0] RIP: 0010:deref_stack_reg+0x1bf/0x230 [ 248.505460][ C0] Code: c7 9f 4b 00 49 bf 00 00 00 00 00 fc ff df 48 89 ef e8 b5 07 00 00 49 89 c6 48 8b 5c 24 10 48 89 d8 48 c1 e8 03 42 80 3c 38 00 <74> 08 48 89 df e8 a7 22 a4 00 4c 89 33 b0 01 eb 0e e8 8b 9f 4b 00 [ 248.505473][ C0] RSP: 0018:ffffc90002d17468 EFLAGS: 00000246 [ 248.505486][ C0] RAX: 1ffff920005a2ec5 RBX: ffffc90002d17628 RCX: ffff88801b3e9e00 [ 248.505498][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffc90002d17670 [ 248.505509][ C0] RBP: ffffc90002d17670 R08: ffff88801b3e9e00 R09: 0000000000000003 [ 248.505519][ C0] R10: 0000000000000004 R11: 0000000000000000 R12: ffffc90002d18000 [ 248.505529][ C0] R13: 1ffff920005a2ebf R14: ffffc90002d17720 R15: dffffc0000000000 [ 248.505541][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 248.505554][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 248.505565][ C0] CR2: 0000558ce064f270 CR3: 000000007da00000 CR4: 00000000003506f0 [ 248.505580][ C0] Call Trace: [ 248.505586][ C0] [ 248.505597][ C0] unwind_next_frame+0x1781/0x2990 [ 248.505621][ C0] ? arch_stack_walk+0xf8/0x190 [ 248.505641][ C0] __unwind_start+0x5bb/0x730 [ 248.505658][ C0] ? stack_trace_save+0x100/0x100 [ 248.505679][ C0] arch_stack_walk+0xf8/0x190 [ 248.505699][ C0] ? stack_trace_save+0xaa/0x100 [ 248.505722][ C0] stack_trace_save+0xaa/0x100 [ 248.505746][ C0] ? stack_trace_snprint+0xf0/0xf0 [ 248.505766][ C0] ? __asan_memset+0x22/0x40 [ 248.505790][ C0] ? chacha_block_generic+0x5ea/0xda0 [ 248.505816][ C0] kasan_set_track+0x4e/0x70 [ 248.505860][ C0] ? __kmem_cache_free+0xba/0x1f0 [ 248.505887][ C0] kasan_save_free_info+0x28/0x40 [ 248.505911][ C0] ____kasan_slab_free+0x126/0x1f0 [ 248.505932][ C0] slab_free_freelist_hook+0x130/0x1a0 [ 248.505951][ C0] ? skb_release_data+0x609/0x7f0 [ 248.505969][ C0] __kmem_cache_free+0xba/0x1f0 [ 248.505996][ C0] skb_release_data+0x609/0x7f0 [ 248.506020][ C0] consume_skb+0xb2/0x110 [ 248.506041][ C0] nsim_dev_trap_report_work+0x723/0xa90 [ 248.506065][ C0] ? process_scheduled_works+0x975/0x1600 [ 248.506088][ C0] process_scheduled_works+0xa60/0x1600 [ 248.506123][ C0] ? worker_attach_to_pool+0x370/0x370 [ 248.506147][ C0] ? assign_work+0x3cc/0x5d0 [ 248.506175][ C0] worker_thread+0xa5e/0xfe0 [ 248.506211][ C0] ? _raw_spin_unlock+0x40/0x40 [ 248.506236][ C0] ? __kthread_parkme+0x71/0x1c0 [ 248.506256][ C0] kthread+0x2fa/0x390 [ 248.506271][ C0] ? pr_cont_work+0x550/0x550 [ 248.506292][ C0] ? kthread_blkcg+0xd0/0xd0 [ 248.506310][ C0] ret_from_fork+0x48/0x80 [ 248.506333][ C0] ? kthread_blkcg+0xd0/0xd0 [ 248.506349][ C0] ret_from_fork_asm+0x11/0x20 [ 248.506380][ C0] [ 248.510036][ T29] Kernel panic - not syncing: hung_task: blocked tasks [ 248.510090][ T29] CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 248.510157][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 248.510202][ T29] Call Trace: [ 248.510224][ T29] [ 248.510244][ T29] dump_stack_lvl+0x18c/0x250 [ 248.510318][ T29] ? show_regs_print_info+0x20/0x20 [ 248.510379][ T29] ? load_image+0x420/0x420 [ 248.510484][ T29] panic+0x2ca/0x720 [ 248.510567][ T29] ? bpf_jit_dump+0xd0/0xd0 [ 248.510639][ T29] ? __irq_work_queue_local+0x13a/0x3b0 [ 248.510718][ T29] ? preempt_schedule_thunk+0x1a/0x30 [ 248.510800][ T29] ? nmi_trigger_cpumask_backtrace+0x2a4/0x2f0 [ 248.510883][ T29] watchdog+0xf98/0xfa0 [ 248.510956][ T29] ? watchdog+0x1e1/0xfa0 [ 248.511039][ T29] kthread+0x2fa/0x390 [ 248.511090][ T29] ? hungtask_pm_notify+0x50/0x50 [ 248.511162][ T29] ? kthread_blkcg+0xd0/0xd0 [ 248.511223][ T29] ret_from_fork+0x48/0x80 [ 248.511287][ T29] ? kthread_blkcg+0xd0/0xd0 [ 248.511341][ T29] ret_from_fork_asm+0x11/0x20 [ 248.511446][ T29] [ 248.511710][ T29] Kernel Offset: disabled [ 248.954919][ T29] Rebooting in 86400 seconds..