last executing test programs: 6.52638587s ago: executing program 1 (id=15): socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x23, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) socket$inet_mptcp(0x2, 0x1, 0x106) socket$l2tp6(0xa, 0x2, 0x73) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000000)) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) socket$tipc(0x1e, 0x5, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r2], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x4048000) 5.583647159s ago: executing program 1 (id=17): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xff, 0x7fff0000}]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000003600)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32=r1], 0x18, 0x40044}}], 0x1, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg$inet(r3, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 5.031382678s ago: executing program 1 (id=22): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setuid(0xee00) setrlimit(0x40000000000008, &(0x7f0000000000)) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r4, 0x0, &(0x7f000004c000/0x1000)=nil, 0x1000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r5, 0x0, 0x10001, 0x0, 0xfffffffd, 0x7eac0, 0x3d3b4e}) 3.914567535s ago: executing program 1 (id=31): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_4={0x3, 0x1, 0x0, "78af67c6"}, @local=@item_012={0x0, 0x2, 0x2}, @global=@item_4={0x3, 0x1, 0x7, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, '\x00\x00'}, @local=@item_4={0x3, 0x2, 0x7, "ce25b645"}, @main=@item_4={0x3, 0x0, 0xb}, @local=@item_4, @main=@item_4={0x3, 0x0, 0xb, "fa5e444b"}]}}, 0x0}, 0x0) 3.451286115s ago: executing program 3 (id=36): socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x23, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000000)) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) socket$tipc(0x1e, 0x5, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r2], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x4048000) 2.871626343s ago: executing program 3 (id=40): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xff, 0x7fff0000}]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000003600)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="140000000000000001000000", @ANYRES32=r1], 0x18, 0x40044}}], 0x1, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg$inet(r3, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.763490213s ago: executing program 3 (id=41): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) sendmmsg$inet6(r0, &(0x7f0000000a80), 0x0, 0x4c040) 2.643212056s ago: executing program 3 (id=42): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg(r0, 0x0, 0x0, 0x300) timer_create(0xb, 0x0, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x22581) ioctl$CEC_RECEIVE(r1, 0xc0386106, &(0x7f0000000000)={0x4, 0xb, 0x80005, 0xfffffffe, 0x8, 0x16, "260000000000000754439400", 0xc, 0x0, 0x5, 0x2, 0x0, 0x0, 0x9e}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) 2.415920898s ago: executing program 0 (id=46): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x4, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x240007ed, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000a40)="6e1be7cad520a0841d111ea6e5331394badbf041eb1ff738c4cdc2518094edf6fb75990e5de4c5465ea2bb07dfb97fe0b2ea473e7db53d9719facd8dc99d1484be1803ed2d3aea2a3e80262113bf835e96682018a4a5aede22d0febc6347ee2c7c52313f8a7ad65f002e37c09736574e6bea88f9c8f7eb8bed4ed9ec49661e806d92ba5c0ba5c533c391bcc6b1f7980992806a80fab3fbd0e88c3ae46e60ca4e966f7358f198243a012f76b9706aaef378891b965e758afb2986f07f277431ce8eef068f0be7cd8d059784764685575beb44ee91494e1e6da2f322a3736c13894927de0bd5009f2cdc", 0xe9}, {&(0x7f0000000b40)="5051a8c0982b3b2dde64310aa3c76b31d1807add88136c7893922aa2aa40f1e81d2b13012b09bfceb3c97c458382f6bfe1a8c4e8309e32a6938bdf171cca83729eaf4fd561b352b1b4a456c168a3b4dd4d542388717f53f228eb78d512236cef90ef3a3f5d04988103c4e72f8d4ebfaf3c1e40e8b1e93db6", 0x78}, {&(0x7f0000000bc0)="05859a90752395d69c69e05a460931b3296c9f0e7bae5ca3bceb496491e5b49e2bf9e4134d2b1082af07c96d1456dc3ddd83f7e553f53b0aa1466a18b3d50ae74a17091fa8c74fc4ab3dd2390f95aeaac9573404ec941427c9c8d9d21b225dc218fcbf67f3e0490a27af620f2b51d92643d3c96599064a4340c96ce9a5", 0x7d}], 0x3}}, {{0x0, 0x0, &(0x7f0000003d40)=[{&(0x7f0000002b00)="9bb6070844984ef2b734ee2b740e32647974b7cfb8150605a2c635efcbc832fa56569acc96052ed730ec4473a0af21e1f7881620a9062897d734a7dac3c85d6973f29880e626e5e231b1b4edd98b9363876048487f344b980de2c6f0806915a8bb26e264035f0a378fe6662cfd45296d1cc391c761c06d689dd572f822269ffc2625c6d2a6d4228a91b303f6b9d8b45a6a9f8c7b49ec5bc49acd786101e2308bbaee6d51d8c582fe4bfedd220cae98dc1a86cbe3b3d03636b5c1c2951d9b0f18503ac03e3f52a34b9be308d86ced9df5c42e152849ff5ad87e599f2fd3af561520a835d3222667cb80625d2058ea5dcec77b644cb4927e43838cb632b09b823885e5729f163bdc6ab9725aa575d034c67d1985e0d1ac60f597a2747c3d6d6a366b9ab1f791d0ef4196371671865ad407d3d21586847479d116ebcd97848f0d846b4995eeb5aeed68a3b391c9b3005d6ab1ba83b799a7b1fc0cfbd5f17b87636f1fb152d26fd6e587c346ec7328af785abb3c79900f200031c65c088747256aa4e7375159471d2a1acc15dd6b1ea1ffd7360414542b7a9756ecdfd603447c657c792953f5870ae3459d19713abdb0d87c65c3aadd315f937cdbfdeb424745b4e856fbc6a5d8796cf0fc9ee7825d8fbddf5f781a87a3013e4d6b6d0706b633f96772f094fac96ab13446b4332916986d918ad6b97e87b016aab1e4176aa5fb26f22aa8e6b1c1213b68854ed35873bd8ff7b8dfe29850b8ef803af5ba20b31f8156a1be352c65c5e4f94690fe2042958847db79a25b7ae2c6cda84e07aeb33e332f39a7c43122", 0x245}], 0x1}}], 0x2, 0x42054) 2.325083402s ago: executing program 0 (id=48): openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi1\x00', 0x80042, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$int_in(r0, 0x5421, 0x0) listen(r0, 0xec) socket$netlink(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x141302) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) 1.404264543s ago: executing program 3 (id=52): connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000e80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@timestamping={{0x14, 0x1, 0x25, 0x8}}], 0x18}}], 0x2, 0x0) 991.268229ms ago: executing program 2 (id=53): syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="0200"], 0x1d) 976.828594ms ago: executing program 3 (id=54): syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000010085c40b4040200b16a0102030109021b0001000000000904"], 0x0) creat(0x0, 0x109) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000000440)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$cgroup_pid(r0, &(0x7f00000000c0)=r1, 0x12) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) 836.353397ms ago: executing program 2 (id=55): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) sendmmsg$inet(r1, &(0x7f0000001cc0)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000480)="0f", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000680)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000049c0)='{', 0x1}], 0x1}}], 0x3, 0x448c0) close_range(r0, 0xffffffffffffffff, 0x0) 759.762523ms ago: executing program 0 (id=56): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x4, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x240007ed, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000a40)="6e1be7cad520a0841d111ea6e5331394badbf041eb1ff738c4cdc2518094edf6fb75990e5de4c5465ea2bb07dfb97fe0b2ea473e7db53d9719facd8dc99d1484be1803ed2d3aea2a3e80262113bf835e96682018a4a5aede22d0febc6347ee2c7c52313f8a7ad65f002e37c09736574e6bea88f9c8f7eb8bed4ed9ec49661e806d92ba5c0ba5c533c391bcc6b1f7980992806a80fab3fbd0e88c3ae46e60ca4e966f7358f198243a012f76b9706aaef378891b965e758afb2986f07f277431ce8eef068f0be7cd8d059784764685575beb44ee91494e1e6da2f322a3736c13894927de0bd5009f2cdc", 0xe9}, {&(0x7f0000000b40)="5051a8c0982b3b2dde64310aa3c76b31d1807add88136c7893922aa2aa40f1e81d2b13012b09bfceb3c97c458382f6bfe1a8c4e8309e32a6938bdf171cca83729eaf4fd561b352b1b4a456c168a3b4dd4d542388717f53f228eb78d512236cef90ef3a3f5d04988103c4e72f8d4ebfaf3c1e40e8b1e93db6", 0x78}, {&(0x7f0000000bc0)="05859a90752395d69c69e05a460931b3296c9f0e7bae5ca3bceb496491e5b49e2bf9e4134d2b1082af07c96d1456dc3ddd83f7e553f53b0aa1466a18b3d50ae74a17091fa8c74fc4ab3dd2390f95aeaac9573404ec941427c9c8d9d21b225dc218fcbf67f3e0490a27af620f2b51d92643d3c96599064a4340c96ce9a5", 0x7d}], 0x3}}, {{0x0, 0x0, &(0x7f0000003d40)=[{&(0x7f0000002b00)="9bb6070844984ef2b734ee2b740e32647974b7cfb8150605a2c635efcbc832fa56569acc96052ed730ec4473a0af21e1f7881620a9062897d734a7dac3c85d6973f29880e626e5e231b1b4edd98b9363876048487f344b980de2c6f0806915a8bb26e264035f0a378fe6662cfd45296d1cc391c761c06d689dd572f822269ffc2625c6d2a6d4228a91b303f6b9d8b45a6a9f8c7b49ec5bc49acd786101e2308bbaee6d51d8c582fe4bfedd220cae98dc1a86cbe3b3d03636b5c1c2951d9b0f18503ac03e3f52a34b9be308d86ced9df5c42e152849ff5ad87e599f2fd3af561520a835d3222667cb80625d2058ea5dcec77b644cb4927e43838cb632b09b823885e5729f163bdc6ab9725aa575d034c67d1985e0d1ac60f597a2747c3d6d6a366b9ab1f791d0ef4196371671865ad407d3d21586847479d116ebcd97848f0d846b4995eeb5aeed68a3b391c9b3005d6ab1ba83b799a7b1fc0cfbd5f17b87636f1fb152d26fd6e587c346ec7328af785abb3c79900f200031c65c088747256aa4e7375159471d2a1acc15dd6b1ea1ffd7360414542b7a9756ecdfd603447c657c792953f5870ae3459d19713abdb0d87c65c3aadd315f937cdbfdeb424745b4e856fbc6a5d8796cf0fc9ee7825d8fbddf5f781a87a3013e4d6b6d0706b633f96772f094fac96ab13446b4332916986d918ad6b97e87b016aab1e4176aa5fb26f22aa8e6b1c1213b68854ed35873bd8ff7b8dfe29850b8ef803af5ba20b31f8156a1be352c65c5e4f94690fe2042958847db79a25b7ae2c6cda84e07aeb33e332f39a7c43122", 0x245}], 0x1}}], 0x2, 0x42054) 615.942148ms ago: executing program 1 (id=57): syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40), 0x0, 0x20000044) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 612.646886ms ago: executing program 2 (id=58): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xff, 0x7fff0000}]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000003600)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1400000000000000010000000100", @ANYRES32=r1], 0x18, 0x40044}}], 0x1, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg$inet(r3, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 560.848132ms ago: executing program 0 (id=59): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) sendmmsg$inet6(r0, &(0x7f0000000a80), 0x0, 0x4c040) 424.015348ms ago: executing program 1 (id=60): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg(r0, 0x0, 0x0, 0x300) timer_create(0xb, 0x0, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x22581) ioctl$CEC_RECEIVE(r1, 0xc0386106, &(0x7f0000000000)={0x4, 0xb, 0x80005, 0xfffffffe, 0x8, 0x16, "260000000000000754439400", 0xc, 0x0, 0x5, 0x2, 0x0, 0x0, 0x9e}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) 386.861898ms ago: executing program 2 (id=61): socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x23, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) socket$l2tp6(0xa, 0x2, 0x73) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000000)) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) socket$tipc(0x1e, 0x5, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r2], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x4048000) 312.40492ms ago: executing program 0 (id=62): connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000e80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@timestamping={{0x14, 0x1, 0x25, 0x8}}], 0x18}}], 0x2, 0x0) 217.950515ms ago: executing program 2 (id=63): syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="0200"], 0x1d) 169.967698ms ago: executing program 0 (id=64): sched_setscheduler(0x0, 0x1, 0x0) getpid() sched_setaffinity(0x0, 0x0, 0x0) r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102400, 0x19000) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) sendmmsg(r0, &(0x7f0000000680)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000000d00), 0xf000, 0x10002, 0x0) 0s ago: executing program 2 (id=65): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x4, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000640)="80220ebd910ac0089289bf7c00bca5962c5bfb1a716ddd4cb96d929560eff333276dafb9550ec99b1b442aecb50f40d5615c1fd482b394607e18b1db2a25c0404c3080f22f3b96c8e3cd04ea9f341f890e916f7b230d9f969ed11b3ec826f08e85af851f034de92684a3e1ac76", 0x6d}, {&(0x7f0000000740)="c5feaad002b474cb445c115793ac31043a4a6d9136f100b15c698e05d9a7f48773c3abaa067fc4519b13d66280447d4f963718f208f2ad650dad5d5a4865683f38e37fa4e4a73ae8987df1fd506f637df8e2347b7639f0aada640e8b719fb9c14ad514ed72a31b902c381727c4678ff674c54f44c0480afff63af04314340ecaabd6d77de9d90ed937033c437f94", 0x8e}], 0x2}}], 0x1, 0x800) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000003e80)=[{{0x0, 0x0, &(0x7f0000002800)=[{&(0x7f00000014c0)="cd5927a8b2a00ee8cc111509a5dcf0343c2c5b667c514bb3055b96ebda11b4c8308aef587ef82686dc7f027c402a00582f1b338d80160b21beef66b139a7061ff65ea9c6ed4de3c272fcce0b257c322f54ca01000000bb318d29a96c5035fd713f02f959dc5e55bd518d2ce967", 0x6d}], 0x1}}, {{0x0, 0x0, &(0x7f0000003d40)=[{&(0x7f0000002b00)="9bb6070844984ef2b734ee2b740e32647974b7cfb8150605a2c635efcbc832fa56569acc96052ed730ec4473a0af21e1f7881620a9062897d734a7dac3c85d6973f29880e626e5e231b1b4edd98b9363876048487f344b980de2c6f0806915a8bb26e264035f0a378fe6662cfd45296d1cc391c761c06d689dd572f822269ffc2625c6d2a6d4228a91b303f6b9d8b45a6a9f8c7b49ec5bc49acd786101e2308bbaee6d51d8c582fe4bfedd220cae98dc1a86cbe3b3d03636b5c1c2951d9b0f18503ac03e3f52a34b9be308d86ced9df5c42e152849ff5ad87e599f2fd3af561520a835d3222667cb80625d2058ea5dcec77b644cb4927e43838cb632b09b823885e5729f163bdc6ab9725aa575d034c67d1985e0d1ac60f597a2747c3d6d6a366b9ab1f791d0ef4196371671865ad407d3d21586847479d116ebcd97848f0d846b4995eeb5aeed68a3b391c9b3005d6ab1ba83b799a7b1fc0cfbd5f17b87636f1fb152d26fd6e587c346ec7328af785abb3c79900f200031c65c088747256aa4e7375159471d2a1acc15dd6b1ea1ffd7360414542b7a9756ecdfd603447c657c792953f5870ae3459d19713abdb0d87c65c3aadd315f937cdbfdeb424745b4e856fbc6a5d8796cf0fc9ee7825d8fbddf5f781a87a3013e4d6b6d0706b633f96772f094fac96ab13446b4332916986d918ad6b97e87b016aab1e4176aa5fb26f22aa8e6b1c1213b68854ed35873bd8ff7b8dfe29850b8ef803af5ba20b31f8156a1be352c65c5e4f94690fe2042958847db79a25b7ae2c6cda84e07aeb33e332f39a7c43122261e9eec6eb5e9edce83ea6a570bade1332e4e68d7bc60551a2af820b9c3c74fe8996930fb274900aeecdd", 0x270}], 0x1}}], 0x2, 0x42054) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x1000806d, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.16' (ED25519) to the list of known hosts. [ 81.817363][ T5599] cgroup: Unknown subsys name 'net' [ 82.058323][ T5599] cgroup: Unknown subsys name 'cpuset' [ 82.114294][ T5599] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 84.127361][ T5599] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 87.017894][ T10] cfg80211: failed to load regulatory.db [ 87.899135][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 87.916265][ T5621] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.946941][ T5623] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 87.947851][ T5623] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 87.956960][ T5623] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 87.957336][ T5623] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 87.961155][ T5623] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 87.964525][ T5621] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 87.965338][ T5623] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 87.966173][ T5621] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 87.969324][ T5623] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 87.993141][ T5628] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 87.995214][ T5628] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.000738][ T5628] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.001949][ T5628] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.014041][ T4927] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 88.046253][ T4927] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.054405][ T4927] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.089828][ T5626] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.189765][ T5628] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 90.035935][ T4927] Bluetooth: hci0: command tx timeout [ 90.203689][ T4927] Bluetooth: hci3: command tx timeout [ 90.274334][ T4927] Bluetooth: hci1: command tx timeout [ 90.274454][ T4927] Bluetooth: hci2: command tx timeout [ 90.328629][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.329583][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.329781][ T5613] bridge_slave_0: entered allmulticast mode [ 90.331995][ T5613] bridge_slave_0: entered promiscuous mode [ 90.397515][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.397736][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.397919][ T5613] bridge_slave_1: entered allmulticast mode [ 90.399907][ T5613] bridge_slave_1: entered promiscuous mode [ 90.537648][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.537872][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.538082][ T5612] bridge_slave_0: entered allmulticast mode [ 90.540231][ T5612] bridge_slave_0: entered promiscuous mode [ 90.552973][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.614225][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.614620][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.614937][ T5612] bridge_slave_1: entered allmulticast mode [ 90.619161][ T5612] bridge_slave_1: entered promiscuous mode [ 90.625248][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.625832][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.626155][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.626396][ T5615] bridge_slave_0: entered allmulticast mode [ 90.629616][ T5615] bridge_slave_0: entered promiscuous mode [ 90.713872][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.714183][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.714743][ T5615] bridge_slave_1: entered allmulticast mode [ 90.716773][ T5615] bridge_slave_1: entered promiscuous mode [ 90.718449][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.718646][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.718801][ T5614] bridge_slave_0: entered allmulticast mode [ 90.720808][ T5614] bridge_slave_0: entered promiscuous mode [ 90.883820][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.884069][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.884241][ T5614] bridge_slave_1: entered allmulticast mode [ 90.886392][ T5614] bridge_slave_1: entered promiscuous mode [ 90.921996][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.927343][ T5613] team0: Port device team_slave_0 added [ 90.976094][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.979103][ T5613] team0: Port device team_slave_1 added [ 90.998486][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.056324][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.060918][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.125088][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.128245][ T5612] team0: Port device team_slave_0 added [ 91.130315][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.130327][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.130343][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.191074][ T5612] team0: Port device team_slave_1 added [ 91.197286][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.197304][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.197330][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.208546][ T5615] team0: Port device team_slave_0 added [ 91.286877][ T5615] team0: Port device team_slave_1 added [ 91.289857][ T5614] team0: Port device team_slave_0 added [ 91.345550][ T5614] team0: Port device team_slave_1 added [ 91.346918][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.346928][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.346945][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.424571][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.424586][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.424606][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.449264][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.449283][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.449309][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.535694][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.535708][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.535724][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.537805][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.537816][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.537831][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.557862][ T5613] hsr_slave_0: entered promiscuous mode [ 91.561548][ T5613] hsr_slave_1: entered promiscuous mode [ 91.580969][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.580986][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.581011][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.728764][ T5612] hsr_slave_0: entered promiscuous mode [ 91.730331][ T5612] hsr_slave_1: entered promiscuous mode [ 91.731667][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 91.731745][ T5612] Cannot create hsr debugfs directory [ 91.809377][ T5615] hsr_slave_0: entered promiscuous mode [ 91.810793][ T5615] hsr_slave_1: entered promiscuous mode [ 91.811891][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 91.811917][ T5615] Cannot create hsr debugfs directory [ 92.123580][ T60] Bluetooth: hci0: command tx timeout [ 92.273569][ T60] Bluetooth: hci3: command tx timeout [ 92.297671][ T5614] hsr_slave_0: entered promiscuous mode [ 92.299024][ T5614] hsr_slave_1: entered promiscuous mode [ 92.300035][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 92.300060][ T5614] Cannot create hsr debugfs directory [ 92.354778][ T60] Bluetooth: hci2: command tx timeout [ 92.354812][ T60] Bluetooth: hci1: command tx timeout [ 93.008636][ T5613] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.048592][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.057683][ T5613] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.097368][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 93.107984][ T5613] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 93.139826][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 93.163823][ T5613] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 93.209118][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 93.356710][ T5612] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 93.389625][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.396747][ T5612] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 93.438403][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 93.450840][ T5612] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 93.486113][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 93.521956][ T5612] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 93.542611][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 93.687753][ T5614] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 93.718015][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.732939][ T5614] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 93.779879][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 93.801438][ T5614] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 93.827877][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 93.856625][ T5614] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 93.892507][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.057272][ T5615] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 94.090055][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.109059][ T5615] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 94.139013][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.147167][ T5615] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 94.177538][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.193761][ T4927] Bluetooth: hci0: command tx timeout [ 94.195786][ T5615] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 94.240828][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.353681][ T4927] Bluetooth: hci3: command tx timeout [ 94.369334][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.434328][ T4927] Bluetooth: hci1: command tx timeout [ 94.434363][ T4927] Bluetooth: hci2: command tx timeout [ 94.497237][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.529971][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.583104][ T1399] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.589535][ T1399] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.652210][ T773] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.652381][ T773] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.725479][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.764877][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.782383][ T1417] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.782558][ T1417] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.840796][ T1417] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.840906][ T1417] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.910974][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.976729][ T773] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.976885][ T773] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.010265][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.046174][ T1504] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.046423][ T1504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.245639][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.356251][ T1504] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.358285][ T1504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.430444][ T1504] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.430640][ T1504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.275706][ T60] Bluetooth: hci0: command tx timeout [ 96.354373][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.433730][ T60] Bluetooth: hci3: command tx timeout [ 96.514670][ T60] Bluetooth: hci2: command tx timeout [ 96.514705][ T60] Bluetooth: hci1: command tx timeout [ 96.895922][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.937934][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.949658][ T5613] veth0_vlan: entered promiscuous mode [ 97.021577][ T5613] veth1_vlan: entered promiscuous mode [ 97.332829][ T5612] veth0_vlan: entered promiscuous mode [ 97.341803][ T5613] veth0_macvtap: entered promiscuous mode [ 97.350201][ T5614] veth0_vlan: entered promiscuous mode [ 97.373077][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.388636][ T5613] veth1_macvtap: entered promiscuous mode [ 97.414341][ T5612] veth1_vlan: entered promiscuous mode [ 97.442825][ T5614] veth1_vlan: entered promiscuous mode [ 97.500825][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.545891][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.591515][ T1417] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.626160][ T1417] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.639183][ T1417] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.660123][ T1417] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.680356][ T5612] veth0_macvtap: entered promiscuous mode [ 97.758812][ T5614] veth0_macvtap: entered promiscuous mode [ 97.766024][ T5615] veth0_vlan: entered promiscuous mode [ 97.773233][ T5612] veth1_macvtap: entered promiscuous mode [ 97.818693][ T5614] veth1_macvtap: entered promiscuous mode [ 97.979009][ T5615] veth1_vlan: entered promiscuous mode [ 98.055377][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.109936][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.139584][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.180035][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.189654][ T1504] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.189675][ T1504] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.238743][ T1417] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.257012][ T1417] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.276490][ T1417] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.311219][ T1417] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.357885][ T1417] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.372291][ T1417] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.392035][ T1417] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.446110][ T1417] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.461832][ T773] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.461854][ T773] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.487399][ T5615] veth0_macvtap: entered promiscuous mode [ 98.596612][ T5615] veth1_macvtap: entered promiscuous mode [ 99.157408][ T773] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.157433][ T773] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.177807][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.290435][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.346544][ T1504] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.346566][ T1504] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.379417][ T5765] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 99.446076][ T773] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.448994][ T773] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.449286][ T773] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.449330][ T773] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.596899][ T44] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.596922][ T44] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.750857][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.750880][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.415727][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.415753][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.736656][ T5769] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2'. [ 100.947070][ T60] Bluetooth: Frame is too long (len 24, expected len 4) [ 100.973482][ T5769] hsr_slave_0 (unregistering): left promiscuous mode [ 101.199818][ T1417] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.199842][ T1417] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.238849][ T60] Bluetooth: hci3: command 0x2016 tx timeout [ 103.291646][ T5786] Invalid logical block size (1275) [ 104.845148][ T32] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 104.892690][ T5799] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 105.096121][ T5799] usb 4-1: Using ep0 maxpacket: 16 [ 105.126038][ T5799] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 105.126068][ T5799] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 105.126123][ T5799] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 105.126146][ T5799] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.173938][ T32] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 105.192226][ T32] usb 1-1: New USB device found, idVendor=04b4, idProduct=0002, bcdDevice=6a.b1 [ 105.192249][ T32] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.192261][ T32] usb 1-1: Product: syz [ 105.192270][ T32] usb 1-1: Manufacturer: syz [ 105.192278][ T32] usb 1-1: SerialNumber: syz [ 105.314488][ T4927] Bluetooth: hci3: command 0x2016 tx timeout [ 105.499048][ T5799] usb 4-1: config 0 descriptor?? [ 105.522354][ T32] usb 1-1: config 0 descriptor?? [ 105.861016][ T32] cytherm 1-1:0.0: Cypress thermometer device now attached [ 106.085280][ T32] usb 1-1: USB disconnect, device number 2 [ 106.179065][ T32] cytherm 1-1:0.0: Cypress thermometer now disconnected [ 107.199377][ T1841] usb 4-1: USB disconnect, device number 2 [ 108.334337][ T5723] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 108.489255][ T5723] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 108.511397][ T5723] usb 1-1: New USB device found, idVendor=04b4, idProduct=0002, bcdDevice=6a.b1 [ 108.511432][ T5723] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.511453][ T5723] usb 1-1: Product: syz [ 108.511468][ T5723] usb 1-1: Manufacturer: syz [ 108.511483][ T5723] usb 1-1: SerialNumber: syz [ 108.610472][ T5723] usb 1-1: config 0 descriptor?? [ 108.726385][ T32] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 108.781625][ T5723] cytherm 1-1:0.0: Cypress thermometer device now attached [ 108.914213][ T60] Bluetooth: hci1: command 0x2016 tx timeout [ 108.926208][ T32] usb 2-1: Using ep0 maxpacket: 16 [ 108.949149][ T32] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 108.949212][ T32] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 108.949260][ T32] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 108.949286][ T32] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.018688][ T1841] usb 1-1: USB disconnect, device number 3 [ 109.042187][ T1841] cytherm 1-1:0.0: Cypress thermometer now disconnected [ 109.145973][ T32] usb 2-1: config 0 descriptor?? [ 109.320139][ T32] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 111.000597][ T4927] Bluetooth: hci1: command 0x2016 tx timeout [ 111.522274][ T9] usb 2-1: USB disconnect, device number 2 [ 111.663788][ T1841] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 111.815567][ T1841] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 111.818205][ T1841] usb 4-1: New USB device found, idVendor=04b4, idProduct=0002, bcdDevice=6a.b1 [ 111.818238][ T1841] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.818261][ T1841] usb 4-1: Product: syz [ 111.818277][ T1841] usb 4-1: Manufacturer: syz [ 111.818292][ T1841] usb 4-1: SerialNumber: syz [ 111.892593][ T1841] usb 4-1: config 0 descriptor?? [ 111.934253][ T1841] cytherm 4-1:0.0: Cypress thermometer device now attached [ 112.136630][ T5924] ------------[ cut here ]------------ [ 112.136645][ T5924] task_rq(p) != rq [ 112.136653][ T5924] WARNING: kernel/sched/fair.c:7656 at hrtick_start_fair+0x196/0x1f0, CPU#1: syz.0.64/5924 [ 112.136693][ T5924] Modules linked in: [ 112.136710][ T5924] CPU: 1 UID: 0 PID: 5924 Comm: syz.0.64 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 112.136729][ T5924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 112.136739][ T5924] RIP: 0010:hrtick_start_fair+0x196/0x1f0 [ 112.136763][ T5924] Code: 42 80 3c 20 00 74 08 4c 89 ff e8 85 f5 97 00 4d 39 37 0f 85 0c ff ff ff 48 89 df 5b 41 5c 41 5d 41 5e 41 5f e9 7b 64 fa ff 90 <0f> 0b 90 e9 d1 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 82 [ 112.136778][ T5924] RSP: 0018:ffffc90005d87520 EFLAGS: 00010006 [ 112.136793][ T5924] RAX: ffff8880b863ba40 RBX: ffff8880b873ba40 RCX: ffffffff8197d8ae [ 112.136806][ T5924] RDX: 0000000000000000 RSI: ffff8880366f9f00 RDI: ffff8880b873ba40 [ 112.136818][ T5924] RBP: dffffc0000000000 R08: ffffffff8fcf390f R09: 1ffffffff1f9e721 [ 112.136830][ T5924] R10: dffffc0000000000 R11: fffffbfff1f9e722 R12: dffffc0000000000 [ 112.136843][ T5924] R13: 1ffff110170e78d6 R14: ffff8880366f9f00 R15: ffffffff8dc257d0 [ 112.136856][ T5924] FS: 00007f80972666c0(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000 [ 112.136871][ T5924] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 112.136883][ T5924] CR2: 00007f8098ff5fc0 CR3: 000000005cc12000 CR4: 00000000003526f0 [ 112.136900][ T5924] Call Trace: [ 112.136907][ T5924] [ 112.136917][ T5924] set_next_task_fair+0xa68/0xce0 [ 112.136944][ T5924] __schedule+0x3e03/0x5550 [ 112.136985][ T5924] ? __pfx___schedule+0x10/0x10 [ 112.137013][ T5924] ? schedule+0x90/0x360 [ 112.137033][ T5924] schedule+0x164/0x360 [ 112.137053][ T5924] schedule_timeout+0xc3/0x2c0 [ 112.137075][ T5924] ? __pfx_schedule_timeout+0x10/0x10 [ 112.137095][ T5924] ? do_raw_spin_lock+0x12b/0x2f0 [ 112.137121][ T5924] ? _raw_spin_unlock_irq+0x23/0x50 [ 112.137141][ T5924] ? wait_for_completion+0x274/0x5e0 [ 112.137163][ T5924] wait_for_completion+0x2cc/0x5e0 [ 112.137192][ T5924] ? __pfx_wait_for_completion+0x10/0x10 [ 112.137218][ T5924] ? generic_exec_single+0x191/0x430 [ 112.137242][ T5924] ? smp_call_function_single_async+0xaa/0x110 [ 112.137266][ T5924] rdmsrq_safe_on_cpu+0x18c/0x240 [ 112.137290][ T5924] ? __pfx_rdmsrq_safe_on_cpu+0x10/0x10 [ 112.137311][ T5924] ? __pfx___rdmsr_safe_on_cpu+0x10/0x10 [ 112.137331][ T5924] ? __might_fault+0xaf/0x130 [ 112.137366][ T5924] msr_read+0x13d/0x240 [ 112.137393][ T5924] ? __pfx_msr_read+0x10/0x10 [ 112.137419][ T5924] ? rw_verify_area+0x2ac/0x4e0 [ 112.137438][ T5924] ? __pfx_msr_read+0x10/0x10 [ 112.137464][ T5924] vfs_read+0x212/0xa80 [ 112.137490][ T5924] ? __pfx_vfs_read+0x10/0x10 [ 112.137518][ T5924] ? __fget_files+0x2a/0x420 [ 112.137537][ T5924] ? __fget_files+0x2a/0x420 [ 112.137553][ T5924] ? __fget_files+0x3a6/0x420 [ 112.137568][ T5924] ? __fget_files+0x2a/0x420 [ 112.137591][ T5924] ksys_read+0x156/0x270 [ 112.137613][ T5924] ? __pfx_ksys_read+0x10/0x10 [ 112.137639][ T5924] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.137657][ T5924] do_syscall_64+0x174/0x580 [ 112.137677][ T5924] ? trace_irq_disable+0x3b/0x140 [ 112.137698][ T5924] ? clear_bhb_loop+0x40/0x90 [ 112.137718][ T5924] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.137735][ T5924] RIP: 0033:0x7f809900ce59 [ 112.137751][ T5924] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.137763][ T5924] RSP: 002b:00007f8097266028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 112.137779][ T5924] RAX: ffffffffffffffda RBX: 00007f8099285fa0 RCX: 00007f809900ce59 [ 112.137791][ T5924] RDX: 0000000000019000 RSI: 0000200000000300 RDI: 0000000000000004 [ 112.137802][ T5924] RBP: 00007f80990a2e6f R08: 0000000000000000 R09: 0000000000000000 [ 112.137812][ T5924] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.137821][ T5924] R13: 00007f8099286038 R14: 00007f8099285fa0 R15: 00007ffe263225f8 [ 112.137846][ T5924] [ 112.137855][ T5924] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 112.137868][ T5924] CPU: 1 UID: 0 PID: 5924 Comm: syz.0.64 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 112.137886][ T5924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 112.137896][ T5924] Call Trace: [ 112.137902][ T5924] [ 112.137909][ T5924] vpanic+0x56c/0xa60 [ 112.137933][ T5924] ? __pfx__printk+0x10/0x10 [ 112.137950][ T5924] ? __pfx_vpanic+0x10/0x10 [ 112.137972][ T5924] ? is_bpf_text_address+0x292/0x2b0 [ 112.137994][ T5924] ? is_bpf_text_address+0x26/0x2b0 [ 112.138024][ T5924] panic+0xc5/0xd0 [ 112.138046][ T5924] ? __pfx_panic+0x10/0x10 [ 112.138082][ T5924] __warn+0x315/0x4c0 [ 112.138104][ T5924] ? hrtick_start_fair+0x196/0x1f0 [ 112.138128][ T5924] ? hrtick_start_fair+0x196/0x1f0 [ 112.138151][ T5924] __report_bug+0x339/0x540 [ 112.138177][ T5924] ? hrtick_start_fair+0x196/0x1f0 [ 112.138199][ T5924] ? __pfx___report_bug+0x10/0x10 [ 112.138220][ T5924] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 112.138249][ T5924] ? hrtick_start_fair+0x196/0x1f0 [ 112.138270][ T5924] report_bug+0x16a/0x220 [ 112.138291][ T5924] ? hrtick_start_fair+0x196/0x1f0 [ 112.138311][ T5924] ? hrtick_start_fair+0x198/0x1f0 [ 112.138331][ T5924] handle_bug+0x9c/0x200 [ 112.138355][ T5924] exc_invalid_op+0x1a/0x50 [ 112.138397][ T5924] asm_exc_invalid_op+0x1a/0x20 [ 112.138414][ T5924] RIP: 0010:hrtick_start_fair+0x196/0x1f0 [ 112.138435][ T5924] Code: 42 80 3c 20 00 74 08 4c 89 ff e8 85 f5 97 00 4d 39 37 0f 85 0c ff ff ff 48 89 df 5b 41 5c 41 5d 41 5e 41 5f e9 7b 64 fa ff 90 <0f> 0b 90 e9 d1 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 82 [ 112.138449][ T5924] RSP: 0018:ffffc90005d87520 EFLAGS: 00010006 [ 112.138462][ T5924] RAX: ffff8880b863ba40 RBX: ffff8880b873ba40 RCX: ffffffff8197d8ae [ 112.138475][ T5924] RDX: 0000000000000000 RSI: ffff8880366f9f00 RDI: ffff8880b873ba40 [ 112.138486][ T5924] RBP: dffffc0000000000 R08: ffffffff8fcf390f R09: 1ffffffff1f9e721 [ 112.138498][ T5924] R10: dffffc0000000000 R11: fffffbfff1f9e722 R12: dffffc0000000000 [ 112.138517][ T5924] R13: 1ffff110170e78d6 R14: ffff8880366f9f00 R15: ffffffff8dc257d0 [ 112.138536][ T5924] ? set_next_task_fair+0xa4e/0xce0 [ 112.138561][ T5924] set_next_task_fair+0xa68/0xce0 [ 112.138585][ T5924] __schedule+0x3e03/0x5550 [ 112.138624][ T5924] ? __pfx___schedule+0x10/0x10 [ 112.138650][ T5924] ? schedule+0x90/0x360 [ 112.138671][ T5924] schedule+0x164/0x360 [ 112.138690][ T5924] schedule_timeout+0xc3/0x2c0 [ 112.138711][ T5924] ? __pfx_schedule_timeout+0x10/0x10 [ 112.138730][ T5924] ? do_raw_spin_lock+0x12b/0x2f0 [ 112.138755][ T5924] ? _raw_spin_unlock_irq+0x23/0x50 [ 112.138774][ T5924] ? wait_for_completion+0x274/0x5e0 [ 112.138795][ T5924] wait_for_completion+0x2cc/0x5e0 [ 112.138824][ T5924] ? __pfx_wait_for_completion+0x10/0x10 [ 112.138846][ T5924] ? generic_exec_single+0x191/0x430 [ 112.138869][ T5924] ? smp_call_function_single_async+0xaa/0x110 [ 112.138892][ T5924] rdmsrq_safe_on_cpu+0x18c/0x240 [ 112.138916][ T5924] ? __pfx_rdmsrq_safe_on_cpu+0x10/0x10 [ 112.138938][ T5924] ? __pfx___rdmsr_safe_on_cpu+0x10/0x10 [ 112.138959][ T5924] ? __might_fault+0xaf/0x130 [ 112.138994][ T5924] msr_read+0x13d/0x240 [ 112.139021][ T5924] ? __pfx_msr_read+0x10/0x10 [ 112.139047][ T5924] ? rw_verify_area+0x2ac/0x4e0 [ 112.139066][ T5924] ? __pfx_msr_read+0x10/0x10 [ 112.139092][ T5924] vfs_read+0x212/0xa80 [ 112.139117][ T5924] ? __pfx_vfs_read+0x10/0x10 [ 112.139138][ T5924] ? __fget_files+0x2a/0x420 [ 112.139157][ T5924] ? __fget_files+0x2a/0x420 [ 112.139172][ T5924] ? __fget_files+0x3a6/0x420 [ 112.139188][ T5924] ? __fget_files+0x2a/0x420 [ 112.139211][ T5924] ksys_read+0x156/0x270 [ 112.139232][ T5924] ? __pfx_ksys_read+0x10/0x10 [ 112.139258][ T5924] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.139275][ T5924] do_syscall_64+0x174/0x580 [ 112.139295][ T5924] ? trace_irq_disable+0x3b/0x140 [ 112.139315][ T5924] ? clear_bhb_loop+0x40/0x90 [ 112.139335][ T5924] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.139351][ T5924] RIP: 0033:0x7f809900ce59 [ 112.139365][ T5924] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.139378][ T5924] RSP: 002b:00007f8097266028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 112.139394][ T5924] RAX: ffffffffffffffda RBX: 00007f8099285fa0 RCX: 00007f809900ce59 [ 112.139405][ T5924] RDX: 0000000000019000 RSI: 0000200000000300 RDI: 0000000000000004 [ 112.139416][ T5924] RBP: 00007f80990a2e6f R08: 0000000000000000 R09: 0000000000000000 [ 112.139426][ T5924] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.139437][ T5924] R13: 00007f8099286038 R14: 00007f8099285fa0 R15: 00007ffe263225f8 [ 112.139462][ T5924] [ 113.274390][ T5924] Shutting down cpus with NMI [ 113.274817][ T5924] Kernel Offset: disabled