last executing test programs: 9.752054835s ago: executing program 0 (id=424): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) io_setup(0x1, &(0x7f00000000c0)) r3 = add_key$user(&(0x7f0000000100), &(0x7f0000000580)={'syz', 0x3}, &(0x7f0000000400)="f4", 0x1, 0xfffffffffffffffe) r4 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r3, r4, r4}, &(0x7f0000000480)=""/250, 0xfa, &(0x7f00000001c0)={&(0x7f0000000080)={'rmd160-generic\x00'}}) 9.096465963s ago: executing program 4 (id=430): socket$nl_xfrm(0x10, 0x3, 0x6) socket$packet(0x11, 0x2, 0x300) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) socketpair$unix(0x1, 0x1, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x23, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000026c0)={0x0, 0x0, 0x0}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000001f00)) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0xd, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 'veth1\x00'}}, 0x1e) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x40a40, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x20, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$PPPIOCATTCHAN(r2, 0x40047438, &(0x7f0000000040)=0x2) sendmmsg(r0, &(0x7f0000001640)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) 8.569268374s ago: executing program 4 (id=433): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$NL80211_CMD_GET_MPP(r3, 0x0, 0x40000) shutdown(r3, 0x1) 8.390148182s ago: executing program 4 (id=435): fanotify_mark(0xffffffffffffffff, 0x2, 0xa, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x3}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) io_uring_setup(0x6101, &(0x7f0000000380)={0x0, 0xa36e, 0x4, 0x1, 0x311}) io_uring_setup(0xb5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000300)='\x00', &(0x7f0000000340)='?', 0x1) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)=0x0) timer_settime(r4, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) 7.188632358s ago: executing program 0 (id=442): syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[], 0x4c}}, 0x0) 7.095285012s ago: executing program 3 (id=443): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003b57010203010902"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff000000001d040000000000001c000000000000007504000001ed0a0064000000170000000c040000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29fa9ec35866a96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b49"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='gid_map\x00') preadv(r2, 0x0, 0x0, 0x8, 0x0) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8923, &(0x7f0000000100)={'vlan0\x00', 0x40}) close(0xffffffffffffffff) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = landlock_create_ruleset(&(0x7f0000000140)={0xeb32, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040), 0x181640, 0x0) 7.045768733s ago: executing program 0 (id=444): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendmmsg$inet(r0, &(0x7f0000000040)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) 6.088859694s ago: executing program 0 (id=445): r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, 0x0, 0x0, 0xe921778a4b67075c}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000340)=0x1) syz_usb_control_io(r0, 0x0, &(0x7f0000000bc0)={0x84, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 5.307915019s ago: executing program 2 (id=446): r0 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r0, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) syz_open_dev$cec(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4d, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) r3 = socket$inet(0x2, 0x3, 0x8) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, 0x0, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="020400000a0000000000000000000000020001000000000000002b00000000a0030006000000000002000000ac1414ff0000000000000000030005002b00000002"], 0x50}, 0x1, 0x7}, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe697, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/address_bits', 0x200, 0x3d) lseek(r6, 0xfffffffffffffffd, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) sendmsg$sock(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000280)="8c", 0x1}], 0x1, &(0x7f0000000040)=[@timestamping={{0x14, 0x1, 0x25, 0x2}}], 0x18}, 0x4800) 3.890623867s ago: executing program 4 (id=449): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000440)={@flat=@weak_binder={0x77622a85, 0x1000, 0x2}, @flat=@binder={0x73622a85, 0xa, 0x1}, @flat=@handle={0x73682a85, 0x1, 0x1}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x200000000000000, &(0x7f0000000500)='_'}) 3.600179753s ago: executing program 4 (id=450): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) sendmmsg$inet(r0, &(0x7f0000003cc0)=[{{&(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10, 0x0}}, {{0x0, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}}], 0x2, 0x44008004) syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0200", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0xfffc}}}}}}}, 0x0) write$binfmt_misc(r0, &(0x7f0000000300), 0xfdef) 3.290519947s ago: executing program 3 (id=452): r0 = add_key$user(&(0x7f0000000100), &(0x7f0000000580)={'syz', 0x3}, &(0x7f0000000400)="f4", 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r0, r1, r1}, &(0x7f0000000480)=""/250, 0xfa, &(0x7f00000001c0)={&(0x7f0000000080)={'rmd160-generic\x00'}}) 3.247239824s ago: executing program 4 (id=453): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x4, 0x2, 0x0, 0x1ff, 0x0, 0xfd2, 0x3, 0x3}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) close(0xffffffffffffffff) r2 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000300), 0x2a101, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'lblc\x00', 0x0, 0x0, 0x33}, 0x2c) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r5 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000080)={0x40000002}) write$P9_RSTATu(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000200000005a80000000000000000000004008000000000000000000081030020000000000000000000000003e8001b00046e6f6465767b65766f6f7e0539c60005000037d93a8b92000000b0ff70673effeb09b5351f5bde05"], 0x21e) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r6, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) syz_clone(0x0, 0x0, 0xf5ff, 0x0, 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sm3\x00'}, 0x58) r7 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$kcm(r7, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x483, 0x0, 0x0) write$tcp_mem(r2, 0x0, 0x0) 3.235356092s ago: executing program 2 (id=454): syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[], 0x4c}}, 0x0) 3.180192693s ago: executing program 0 (id=455): syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000580)={0x0, 0x0}) close(r0) syz_open_dev$radio(&(0x7f00000002c0), 0x1, 0x2) pipe2(&(0x7f00000000c0), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) pselect6(0x40, &(0x7f0000000600)={0x11, 0xfffffffffffffffc, 0x2, 0x0, 0xfffffffffffffffe, 0x0, 0x4, 0x8}, 0x0, &(0x7f0000000680)={0x7fc, 0x2, 0x800000, 0x8000000000000001, 0x0, 0xc3ad, 0x0, 0x3}, 0x0, 0x0) pselect6(0x40, &(0x7f0000000600)={0x6, 0x0, 0x0, 0x40, 0x2, 0x7, 0x300, 0x7}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x9, 0x7, 0x4, 0x9, 0xffffffff, 0x7}, 0x0, 0x0) 3.005542825s ago: executing program 2 (id=456): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$NL80211_CMD_GET_MPP(r3, 0x0, 0x40000) shutdown(r3, 0x1) 2.956949335s ago: executing program 1 (id=457): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xe0, 0x32}}}, 0xb8}}, 0x0) 2.76675024s ago: executing program 3 (id=458): setsockopt(0xffffffffffffffff, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000080)={0x0, 0x5, 0x1, "fd"}, 0x9) sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0)="eb", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x23, &(0x7f0000000340)={0x0, 0x5}, 0x8) 2.620612843s ago: executing program 1 (id=459): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x21, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev}, {{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, "0bc0f7", 0x0, "de9560"}}}}}}, 0x0) 2.440070504s ago: executing program 3 (id=460): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000bc0)={0x44, 0x0, &(0x7f0000000a00)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000540)={0x30, 0x30, 0x30}}}], 0x7f, 0x0, &(0x7f0000000b40)="6fefcfe754cee64ba29a8cd64f663d557f8f1f19785a720eeeb60326d02732ffcbc8fd0f02561e7e3ed085294a1fcab6bcadb12a44532d16f11387e41883b76af7c73f89501d517090efa0a8e949102f9a8e0d5b0262bf931bdf9e1046455941757bcfe8131457af5a03679f89dce1711da6708d68d75586839eac11a6bc4a"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x13, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x48, &(0x7f0000000600)={@flat=@weak_binder={0x77622a85, 0x100, 0x2}, @flat=@binder={0x73622a85, 0xa, 0xec, 0x1f}, @fda={0x66646185, 0x9, 0x0, 0x8}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x1000}], 0x1a, 0x0, 0x0}) 2.158475069s ago: executing program 1 (id=461): sched_setscheduler(0x0, 0x2, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendmmsg$inet(r0, &(0x7f0000000040)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) 2.040277429s ago: executing program 0 (id=462): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'dummy0\x00'}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d10402064d8c57ff202030109021b0001000000000904"], 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_DEBUG_SET(r3, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, 0x0, 0x0) ioctl$I2C_RDWR(r2, 0x707, &(0x7f0000002580)={&(0x7f00000000c0)=[{0x0, 0x4001, 0x0, 0x0}], 0x1}) 1.848078699s ago: executing program 2 (id=463): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd010000000000140000006000000001002f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001000088be"], 0xfdef) 1.839048098s ago: executing program 1 (id=464): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)={0x2c, r1, 0x5, 0x100000, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @crypto_settings=[@NL80211_ATTR_CIPHER_SUITES_PAIRWISE={0x4}]]}, 0x2c}}, 0x4000800) 1.748839319s ago: executing program 1 (id=465): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 1.032143441s ago: executing program 1 (id=466): syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000580)={0x0, 0x0}) close(r0) syz_open_dev$radio(&(0x7f00000002c0), 0x1, 0x2) pipe2(&(0x7f00000000c0), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) pselect6(0x40, &(0x7f0000000600)={0x11, 0xfffffffffffffffc, 0x2, 0x0, 0xfffffffffffffffe, 0x0, 0x4, 0x8}, 0x0, &(0x7f0000000680)={0x7fc, 0x2, 0x800000, 0x8000000000000001, 0x0, 0xc3ad, 0x0, 0x3}, 0x0, 0x0) pselect6(0x40, &(0x7f0000000600)={0x6, 0x0, 0x300000000000000, 0x40, 0x2, 0x7, 0x0, 0x7}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x9, 0x7, 0x4, 0x9, 0xffffffff, 0x7}, 0x0, 0x0) 998.496935ms ago: executing program 3 (id=467): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x18, 0x54, 0x1e5, 0x0, 0x0, {0x7, r2}}, 0x18}}, 0x0) 861.348261ms ago: executing program 2 (id=468): r0 = add_key$user(&(0x7f0000000100), &(0x7f0000000580)={'syz', 0x3}, &(0x7f0000000400)="f4", 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r0, r1, r1}, &(0x7f0000000480)=""/250, 0xfa, &(0x7f00000001c0)={&(0x7f0000000080)={'rmd160-generic\x00'}}) 431.639454ms ago: executing program 3 (id=469): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @crypto_settings=[@NL80211_ATTR_AKM_SUITES={0x10, 0x4c, [0x0, 0xfac0c, 0x0]}, @NL80211_ATTR_WPA_VERSIONS={0x8}]]}, 0x40}}, 0x0) 0s ago: executing program 2 (id=470): setsockopt(0xffffffffffffffff, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000080)={0x0, 0x5, 0x1, "fd"}, 0x9) sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0)="eb", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x23, &(0x7f0000000340)={0x0, 0x5}, 0x8) kernel console output (not intermixed with test programs): no interfaces have a carrier [ 58.424803][ T5495] 8021q: adding VLAN 0 to HW filter on device bond0 [ 58.438927][ T5495] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.150' (ED25519) to the list of known hosts. syzkaller login: [ 84.181473][ T5816] cgroup: Unknown subsys name 'net' [ 84.329728][ T5816] cgroup: Unknown subsys name 'cpuset' [ 84.339297][ T5816] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 86.026973][ T5816] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 88.689047][ T5829] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.700828][ T5835] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 88.719239][ T5835] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 88.736077][ T5835] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.752412][ T5834] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 88.764779][ T5834] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.772691][ T5835] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.781497][ T5834] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 88.789253][ T5835] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.793217][ T5837] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 88.797237][ T5835] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.812033][ T5834] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.820761][ T5835] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 88.822136][ T5834] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.830614][ T5835] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.836777][ T5842] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 88.843764][ T5835] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.851190][ T5834] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 88.858375][ T5835] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.870672][ T5842] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.871647][ T5835] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 88.887022][ T5835] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 88.887718][ T5842] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 88.916774][ T55] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 88.924616][ T55] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 89.512938][ T5847] chnl_net:caif_netlink_parms(): no params data found [ 89.661957][ T5846] chnl_net:caif_netlink_parms(): no params data found [ 89.861008][ T5850] chnl_net:caif_netlink_parms(): no params data found [ 89.986095][ T5849] chnl_net:caif_netlink_parms(): no params data found [ 90.033929][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.042122][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.049743][ T5847] bridge_slave_0: entered allmulticast mode [ 90.057980][ T5847] bridge_slave_0: entered promiscuous mode [ 90.071445][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.079181][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.086455][ T5847] bridge_slave_1: entered allmulticast mode [ 90.093989][ T5847] bridge_slave_1: entered promiscuous mode [ 90.126210][ T5851] chnl_net:caif_netlink_parms(): no params data found [ 90.166762][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.173991][ T5846] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.181453][ T5846] bridge_slave_0: entered allmulticast mode [ 90.188748][ T5846] bridge_slave_0: entered promiscuous mode [ 90.197873][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.205036][ T5846] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.212294][ T5846] bridge_slave_1: entered allmulticast mode [ 90.220091][ T5846] bridge_slave_1: entered promiscuous mode [ 90.311211][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.324841][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.396633][ T5846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.409670][ T5846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.511372][ T5850] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.518741][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.526398][ T5850] bridge_slave_0: entered allmulticast mode [ 90.533656][ T5850] bridge_slave_0: entered promiscuous mode [ 90.571435][ T5847] team0: Port device team_slave_0 added [ 90.581299][ T5847] team0: Port device team_slave_1 added [ 90.604718][ T5850] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.612591][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.620590][ T5850] bridge_slave_1: entered allmulticast mode [ 90.630095][ T5850] bridge_slave_1: entered promiscuous mode [ 90.670897][ T5846] team0: Port device team_slave_0 added [ 90.719963][ T5851] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.727518][ T5851] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.734682][ T5851] bridge_slave_0: entered allmulticast mode [ 90.743435][ T5851] bridge_slave_0: entered promiscuous mode [ 90.752460][ T5846] team0: Port device team_slave_1 added [ 90.778711][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.785788][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.811913][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.825707][ T5849] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.832940][ T5849] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.840358][ T5849] bridge_slave_0: entered allmulticast mode [ 90.847671][ T5849] bridge_slave_0: entered promiscuous mode [ 90.858287][ T5850] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.867936][ T5851] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.875344][ T5851] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.883024][ T5851] bridge_slave_1: entered allmulticast mode [ 90.890505][ T5851] bridge_slave_1: entered promiscuous mode [ 90.916503][ T5840] Bluetooth: hci2: command tx timeout [ 90.925883][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.932884][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.958871][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.970368][ T5849] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.977837][ T5849] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.984994][ T5849] bridge_slave_1: entered allmulticast mode [ 90.992491][ T5849] bridge_slave_1: entered promiscuous mode [ 90.998504][ T5140] Bluetooth: hci0: command tx timeout [ 91.004368][ T5140] Bluetooth: hci3: command tx timeout [ 91.010631][ T55] Bluetooth: hci1: command tx timeout [ 91.015781][ T5840] Bluetooth: hci4: command tx timeout [ 91.025243][ T5850] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.062226][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.069361][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.095975][ T5846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.109269][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.116506][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.142544][ T5846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.193156][ T5850] team0: Port device team_slave_0 added [ 91.224330][ T5849] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.238631][ T5850] team0: Port device team_slave_1 added [ 91.247376][ T5849] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.276301][ T5851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.342101][ T5851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.385876][ T5846] hsr_slave_0: entered promiscuous mode [ 91.392768][ T5846] hsr_slave_1: entered promiscuous mode [ 91.414911][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.422572][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.448676][ T5850] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.462319][ T5849] team0: Port device team_slave_0 added [ 91.500357][ T5847] hsr_slave_0: entered promiscuous mode [ 91.507154][ T5847] hsr_slave_1: entered promiscuous mode [ 91.513428][ T5847] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.521749][ T5847] Cannot create hsr debugfs directory [ 91.551818][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.558973][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.585369][ T5850] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.607045][ T5849] team0: Port device team_slave_1 added [ 91.616446][ T5851] team0: Port device team_slave_0 added [ 91.686758][ T5851] team0: Port device team_slave_1 added [ 91.783699][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.791068][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.818038][ T5849] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.839026][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.847006][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.873188][ T5851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.890763][ T10] cfg80211: failed to load regulatory.db [ 91.914085][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.921299][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.947710][ T5849] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.965691][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.972707][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.999271][ T5851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.034483][ T5850] hsr_slave_0: entered promiscuous mode [ 92.042355][ T5850] hsr_slave_1: entered promiscuous mode [ 92.048765][ T5850] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 92.056964][ T5850] Cannot create hsr debugfs directory [ 92.257584][ T5851] hsr_slave_0: entered promiscuous mode [ 92.264048][ T5851] hsr_slave_1: entered promiscuous mode [ 92.270637][ T5851] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 92.278605][ T5851] Cannot create hsr debugfs directory [ 92.312035][ T5849] hsr_slave_0: entered promiscuous mode [ 92.318592][ T5849] hsr_slave_1: entered promiscuous mode [ 92.324727][ T5849] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 92.332597][ T5849] Cannot create hsr debugfs directory [ 92.576279][ T5847] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 92.603561][ T5847] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 92.642051][ T5847] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 92.690108][ T5847] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 92.801790][ T5846] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 92.819635][ T5846] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 92.846085][ T5846] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 92.882526][ T5846] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 92.934893][ T5850] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 92.947317][ T5850] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 92.963912][ T5850] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 92.994776][ T5850] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 92.996466][ T5840] Bluetooth: hci2: command tx timeout [ 93.077070][ T55] Bluetooth: hci1: command tx timeout [ 93.082559][ T55] Bluetooth: hci3: command tx timeout [ 93.088727][ T5140] Bluetooth: hci0: command tx timeout [ 93.094319][ T5840] Bluetooth: hci4: command tx timeout [ 93.163800][ T5849] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.193527][ T5849] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.221574][ T5849] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 93.259967][ T5849] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 93.322587][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.339317][ T5851] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 93.351929][ T5851] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 93.363252][ T5851] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 93.379363][ T5851] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 93.411902][ T5850] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.423516][ T5846] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.473383][ T5847] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.492015][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.499325][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.533310][ T5846] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.554664][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.561906][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.612277][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.619586][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.645195][ T5850] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.664017][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.671219][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.707217][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.714378][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.774222][ T3432] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.781413][ T3432] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.819384][ T5847] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 93.868564][ T5849] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.918957][ T5851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.933976][ T5849] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.988879][ T5846] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.001172][ T3532] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.008382][ T3532] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.024095][ T5850] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 94.042269][ T5851] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.079590][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.089934][ T3532] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.097149][ T3532] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.107065][ T3532] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.114210][ T3532] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.144529][ T3532] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.151776][ T3532] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.192819][ T5850] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.324806][ T5846] veth0_vlan: entered promiscuous mode [ 94.332608][ T5847] veth0_vlan: entered promiscuous mode [ 94.371852][ T5846] veth1_vlan: entered promiscuous mode [ 94.386431][ T5847] veth1_vlan: entered promiscuous mode [ 94.439012][ T5850] veth0_vlan: entered promiscuous mode [ 94.468640][ T5849] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.484417][ T5851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.504623][ T5847] veth0_macvtap: entered promiscuous mode [ 94.534546][ T5850] veth1_vlan: entered promiscuous mode [ 94.549385][ T5846] veth0_macvtap: entered promiscuous mode [ 94.561680][ T5846] veth1_macvtap: entered promiscuous mode [ 94.571162][ T5847] veth1_macvtap: entered promiscuous mode [ 94.621856][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.662921][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.679547][ T5850] veth0_macvtap: entered promiscuous mode [ 94.696514][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.720774][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.732805][ T5850] veth1_macvtap: entered promiscuous mode [ 94.759352][ T5846] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.768510][ T5846] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.778697][ T5846] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.787605][ T5846] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.808743][ T5851] veth0_vlan: entered promiscuous mode [ 94.815091][ T5847] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.824427][ T5847] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.833431][ T5847] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.844182][ T5847] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.888018][ T5849] veth0_vlan: entered promiscuous mode [ 94.929457][ T5851] veth1_vlan: entered promiscuous mode [ 94.952256][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.975086][ T5849] veth1_vlan: entered promiscuous mode [ 95.025017][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.076132][ T5840] Bluetooth: hci2: command tx timeout [ 95.101446][ T5850] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.111815][ T5850] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.122203][ T5850] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.130979][ T5850] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.147277][ T5851] veth0_macvtap: entered promiscuous mode [ 95.156389][ T5840] Bluetooth: hci4: command tx timeout [ 95.161834][ T5840] Bluetooth: hci3: command tx timeout [ 95.167828][ T55] Bluetooth: hci0: command tx timeout [ 95.173256][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.173276][ T55] Bluetooth: hci1: command tx timeout [ 95.187270][ T5849] veth0_macvtap: entered promiscuous mode [ 95.203390][ T5849] veth1_macvtap: entered promiscuous mode [ 95.209287][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.260478][ T5851] veth1_macvtap: entered promiscuous mode [ 95.265668][ T3532] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.274112][ T3532] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.298584][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.310735][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.383187][ T5847] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 95.415042][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.428657][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.442678][ T3432] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.456562][ T3432] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.483065][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.495326][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.542084][ T5849] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.573237][ T5849] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.583941][ T5849] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.597575][ T5849] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.642222][ T5851] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.665949][ T5851] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.674858][ T5851] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.684369][ T5851] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.711086][ T3532] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.766642][ T3532] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.862095][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.896986][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.972471][ T5897] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 96.228268][ T5896] delete_channel: no stack [ 96.262755][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.274239][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 96.292774][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.536266][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 96.608060][ T1239] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.654568][ T1239] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.714635][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.789671][ T3432] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.806925][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.876700][ T3432] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.099621][ T5910] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7'. [ 97.157983][ T55] Bluetooth: hci2: command tx timeout [ 97.237581][ T55] Bluetooth: hci1: command tx timeout [ 97.243061][ T55] Bluetooth: hci3: command tx timeout [ 97.248718][ T5140] Bluetooth: hci0: command tx timeout [ 97.254132][ T5140] Bluetooth: hci4: command tx timeout [ 97.480777][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 97.489924][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 97.496116][ T0] NOHZ tick-stop error: local softirq work is pending, handler #242!!! [ 97.507716][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 97.596440][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 97.604959][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 97.614633][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 97.646088][ T5910] syz.2.7 uses obsolete (PF_INET,SOCK_PACKET) [ 97.697873][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 98.303941][ T5918] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8'. [ 98.308902][ T5927] netlink: 44 bytes leftover after parsing attributes in process `syz.3.8'. [ 98.348213][ T5890] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 98.697048][ T5890] usb 5-1: config 0 has no interfaces? [ 98.709445][ T5890] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 98.719258][ T5890] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.742557][ T5890] usb 5-1: Product: syz [ 98.747735][ T5890] usb 5-1: Manufacturer: syz [ 98.760209][ T5890] usb 5-1: SerialNumber: syz [ 98.804256][ T5890] usb 5-1: config 0 descriptor?? [ 100.549729][ T30] audit: type=1326 audit(1748189211.502:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5931 comm="syz.1.9" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8faef8e969 code=0x0 [ 101.087207][ T5937] netlink: 'syz.2.10': attribute type 3 has an invalid length. [ 101.125698][ T5937] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.10'. [ 101.238505][ T5937] vivid-000: disconnect [ 101.334883][ T5888] usb 5-1: USB disconnect, device number 2 [ 101.388050][ T5929] vivid-000: reconnect [ 101.579784][ T5946] binder: 5944:5946 ioctl c0306201 200000000700 returned -14 [ 101.581960][ T5947] netlink: 16 bytes leftover after parsing attributes in process `syz.3.13'. [ 101.855139][ T5949] netlink: 'syz.2.14': attribute type 1 has an invalid length. [ 102.148007][ T5955] veth3: entered promiscuous mode [ 103.551049][ T5890] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 103.595684][ T5890] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 103.838844][ T5997] fido_id[5997]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 104.301619][ T6016] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 104.308393][ T6016] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 104.346433][ T6016] vhci_hcd vhci_hcd.0: Device attached [ 104.362321][ T6017] vhci_hcd: connection closed [ 104.374305][ T13] vhci_hcd: stop threads [ 104.394368][ T13] vhci_hcd: release socket [ 104.414665][ T13] vhci_hcd: disconnect device [ 104.604033][ T6021] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 104.616434][ T6021] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 104.653488][ T6021] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 104.718439][ T6021] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 104.724884][ T6021] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 104.750265][ T6021] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 104.792553][ T6021] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 104.806163][ T6021] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 104.834101][ T6021] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 104.862246][ T6021] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 104.888936][ T6021] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 104.928837][ T6021] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 104.948896][ T6021] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 104.954990][ T6021] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 105.008386][ T6021] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 105.913302][ T6053] binder: 6051:6053 ioctl c0306201 200000000700 returned -14 [ 105.942915][ T6054] netlink: 4 bytes leftover after parsing attributes in process `syz.2.52'. [ 106.610540][ T5140] Bluetooth: hci0: command 0x0c1a tx timeout [ 106.674018][ T6070] netlink: 'syz.1.59': attribute type 2 has an invalid length. [ 106.755805][ T5140] Bluetooth: hci1: command 0x0c1a tx timeout [ 106.843780][ T5140] Bluetooth: hci2: command 0x0c1a tx timeout [ 106.916071][ T5140] Bluetooth: hci3: command 0x0c1a tx timeout [ 106.967526][ T6073] vlan2: entered promiscuous mode [ 106.983675][ T6073] bridge0: entered promiscuous mode [ 106.995685][ T5140] Bluetooth: hci4: command 0x0c1a tx timeout [ 107.005203][ T6073] vlan2: entered allmulticast mode [ 107.056089][ T6073] bridge0: entered allmulticast mode [ 107.373611][ T6082] binder: 6081:6082 ioctl c0306201 200000000700 returned -14 [ 107.556120][ T6091] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 107.746529][ T5140] Bluetooth: hci1: unexpected event for opcode 0x0c25 [ 107.995875][ T6104] netlink: 8 bytes leftover after parsing attributes in process `syz.4.75'. [ 108.025764][ T6104] netlink: 'syz.4.75': attribute type 30 has an invalid length. [ 108.095077][ T6104] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.104207][ T6104] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.113064][ T6104] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.121915][ T6104] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.200147][ T6104] netlink: 8 bytes leftover after parsing attributes in process `syz.4.75'. [ 108.225312][ T6104] netlink: 'syz.4.75': attribute type 30 has an invalid length. [ 108.244496][ T6104] Zero length message leads to an empty skb [ 108.533165][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.1.77'. [ 108.574809][ T6114] veth0_vlan: entered allmulticast mode [ 108.621304][ T6116] binder: 6115:6116 ioctl c0306201 200000000700 returned -14 [ 108.675844][ T5140] Bluetooth: hci0: command 0x0c1a tx timeout [ 108.927833][ T5140] Bluetooth: hci2: command 0x0c1a tx timeout [ 108.995960][ T5140] Bluetooth: hci3: command 0x0c1a tx timeout [ 109.076668][ T5140] Bluetooth: hci4: command 0x0c1a tx timeout [ 109.514568][ T30] audit: type=1326 audit(1748189220.482:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6140 comm="syz.1.91" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8faef8e969 code=0x0 [ 109.631117][ T6142] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 110.755707][ T5140] Bluetooth: hci0: command 0x0c1a tx timeout [ 111.000720][ T5140] Bluetooth: hci2: command 0x0c1a tx timeout [ 111.032911][ T6168] netlink: 12 bytes leftover after parsing attributes in process `syz.3.101'. [ 111.078903][ T5140] Bluetooth: hci3: command 0x0c1a tx timeout [ 111.155594][ T5140] Bluetooth: hci4: command 0x0c1a tx timeout [ 113.451505][ T6193] syz.4.104 (6193): drop_caches: 2 [ 115.159672][ T6251] binder: 6250:6251 ioctl c0306201 2000000001c0 returned -14 [ 116.480395][ T6270] binder: 6269:6270 ioctl c0306201 200000000700 returned -14 [ 117.151292][ T6280] netlink: 28 bytes leftover after parsing attributes in process `syz.3.146'. [ 117.196445][ T6280] netlink: 28 bytes leftover after parsing attributes in process `syz.3.146'. [ 117.263421][ T6280] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 117.298425][ T6280] ip6gretap0: entered promiscuous mode [ 117.853950][ T6296] binder: 6295:6296 ioctl c0306201 200000000700 returned -14 [ 117.910977][ T6298] netlink: 4 bytes leftover after parsing attributes in process `syz.3.155'. [ 118.821179][ T6320] netlink: 104 bytes leftover after parsing attributes in process `syz.3.166'. [ 118.890246][ T6323] binder: 6322:6323 ioctl c0306201 200000000700 returned -14 [ 118.982030][ T30] audit: type=1400 audit(1748189229.952:4): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=2626200D3A5B pid=6309 comm="syz.4.161" [ 119.065158][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807ce6c800: rx timeout, send abort [ 119.208099][ T6326] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.216800][ T6326] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.351969][ T6326] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 119.374312][ T6326] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 119.498867][ T6326] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.510781][ T6326] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.520624][ T6326] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.530528][ T6326] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.566026][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807ce6d000: rx timeout, send abort [ 119.574440][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807ce6c800: abort rx timeout. Force session deactivation [ 119.996096][ T6340] capability: warning: `syz.3.174' uses deprecated v2 capabilities in a way that may be insecure [ 120.074383][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807ce6d000: abort rx timeout. Force session deactivation [ 120.314998][ T6348] binder_alloc: 6347: binder_alloc_buf, no vma [ 120.324234][ T6348] binder: 6347:6348 ioctl c0306201 200000000700 returned -14 [ 121.322295][ T6368] bridge0: port 3(gretap0) entered blocking state [ 121.399223][ T6368] bridge0: port 3(gretap0) entered disabled state [ 121.533401][ T6368] gretap0: entered allmulticast mode [ 121.599952][ T6368] gretap0: entered promiscuous mode [ 121.623744][ T6368] bridge0: port 3(gretap0) entered blocking state [ 121.630612][ T6368] bridge0: port 3(gretap0) entered forwarding state [ 122.121642][ T6378] binder: 6377:6378 ioctl c0306201 2000000001c0 returned -14 [ 122.781785][ T6388] binder: BINDER_SET_CONTEXT_MGR already set [ 122.820183][ T6388] binder: 6387:6388 ioctl 4018620d 200000000040 returned -16 [ 122.836810][ T6391] binder: 6387:6391 ioctl c0306201 200000000700 returned -14 [ 123.461574][ T6414] process 'syz.1.202' launched './file1' with NULL argv: empty string added [ 123.591921][ T6419] netlink: 4 bytes leftover after parsing attributes in process `syz.2.205'. [ 123.602635][ T5891] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 123.686790][ T5891] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 123.764392][ T6421] binder: BINDER_SET_CONTEXT_MGR already set [ 123.796125][ T6421] binder: 6420:6421 ioctl 4018620d 200000000040 returned -16 [ 123.805901][ T6421] binder: 6420:6421 ioctl c0306201 200000000700 returned -14 [ 124.103656][ T6419] team0 (unregistering): Port device team_slave_0 removed [ 124.194988][ T6419] team0 (unregistering): Port device team_slave_1 removed [ 125.911011][ T6449] binder: 6448:6449 ioctl c0306201 2000000001c0 returned -14 [ 126.198185][ T6457] binder: 6455:6457 ioctl c0306201 200000000700 returned -14 [ 126.884914][ T6480] binder: 6479:6480 ioctl c0306201 2000000001c0 returned -14 [ 127.161492][ T6489] binder: 6488:6489 ioctl c0306201 200000000700 returned -14 [ 128.136110][ T6513] binder: 6512:6513 ioctl c0306201 2000000001c0 returned -14 [ 128.493307][ T6522] binder: 6521:6522 ioctl c0306201 200000000700 returned -14 [ 128.700308][ T6528] netlink: 8 bytes leftover after parsing attributes in process `syz.2.248'. [ 128.760685][ T6528] netlink: 12 bytes leftover after parsing attributes in process `syz.2.248'. [ 128.780532][ T6528] netlink: 'syz.2.248': attribute type 14 has an invalid length. [ 129.283772][ T6542] binder: 6541:6542 ioctl c0306201 2000000001c0 returned -14 [ 129.375418][ T6546] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 129.476044][ T6549] binder: BINDER_SET_CONTEXT_MGR already set [ 129.494012][ T6549] binder: 6548:6549 ioctl 4018620d 200000000040 returned -16 [ 129.523627][ T6549] binder: 6548:6549 ioctl c0306201 200000000700 returned -14 [ 129.966122][ T30] audit: type=1326 audit(1748189240.932:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6567 comm="syz.3.267" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff340f8e969 code=0x7ffc0000 [ 130.016856][ T6570] binder: 6569:6570 ioctl c0306201 2000000001c0 returned -14 [ 130.048486][ T30] audit: type=1326 audit(1748189240.932:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6567 comm="syz.3.267" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff340f8e969 code=0x7ffc0000 [ 130.107815][ T6568] netlink: 4 bytes leftover after parsing attributes in process `syz.3.267'. [ 130.139187][ T30] audit: type=1326 audit(1748189240.942:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6567 comm="syz.3.267" exe="/root/syz-executor" sig=0 arch=c000003e syscall=245 compat=0 ip=0x7ff340f8e969 code=0x7ffc0000 [ 130.223280][ T30] audit: type=1326 audit(1748189240.942:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6567 comm="syz.3.267" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff340f8e969 code=0x7ffc0000 [ 130.262741][ T6579] binder: BINDER_SET_CONTEXT_MGR already set [ 130.282520][ T6579] binder: 6575:6579 ioctl 4018620d 200000000040 returned -16 [ 130.308553][ T6579] binder: 6575:6579 ioctl c0306201 200000000700 returned -14 [ 130.315038][ T30] audit: type=1326 audit(1748189240.942:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6567 comm="syz.3.267" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7ff340f8e969 code=0x7ffc0000 [ 130.348635][ T5140] Bluetooth: hci2: unexpected event 0x3d length: 35 > 14 [ 130.387215][ T30] audit: type=1326 audit(1748189241.002:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6567 comm="syz.3.267" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff340f8e969 code=0x7ffc0000 [ 130.536211][ T30] audit: type=1326 audit(1748189241.002:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6567 comm="syz.3.267" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff340f8e969 code=0x7ffc0000 [ 130.613025][ T30] audit: type=1326 audit(1748189241.072:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6567 comm="syz.3.267" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff340f8e969 code=0x7ffc0000 [ 130.715627][ T30] audit: type=1326 audit(1748189241.072:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6567 comm="syz.3.267" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff340f8e969 code=0x7ffc0000 [ 130.817480][ T30] audit: type=1326 audit(1748189241.072:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6567 comm="syz.3.267" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff340f8e969 code=0x7ffc0000 [ 131.315119][ T5140] Bluetooth: hci0: unexpected event 0x09 length: 4 > 3 [ 131.515916][ T6607] binder: 6606:6607 ioctl c0306201 2000000001c0 returned -14 [ 132.027259][ T6620] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 132.033857][ T6620] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 132.089563][ T6627] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 132.090405][ T6620] vhci_hcd vhci_hcd.0: Device attached [ 132.151573][ T6629] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(9) [ 132.158161][ T6629] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 132.235256][ T6629] vhci_hcd vhci_hcd.0: Device attached [ 132.268743][ T6620] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(5) [ 132.275337][ T6620] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 132.315864][ T5890] vhci_hcd: vhci_device speed not set [ 132.339320][ T6627] vhci_hcd vhci_hcd.0: pdev(3) rhport(4) sockfd(11) [ 132.345993][ T6627] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 132.381952][ T6620] vhci_hcd vhci_hcd.0: Device attached [ 132.399198][ T5890] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 132.406526][ T6627] vhci_hcd vhci_hcd.0: Device attached [ 132.447323][ T6630] vhci_hcd: connection closed [ 132.448173][ T6623] vhci_hcd: connection reset by peer [ 132.448378][ T6638] vhci_hcd: connection closed [ 132.453214][ T6635] vhci_hcd: connection closed [ 132.465790][ T3532] vhci_hcd: stop threads [ 132.505451][ T3532] vhci_hcd: release socket [ 132.530446][ T3532] vhci_hcd: disconnect device [ 132.555417][ T3532] vhci_hcd: stop threads [ 132.564978][ T3532] vhci_hcd: release socket [ 132.695625][ T3532] vhci_hcd: disconnect device [ 132.706186][ T3532] vhci_hcd: stop threads [ 132.710493][ T3532] vhci_hcd: release socket [ 132.730669][ T3532] vhci_hcd: disconnect device [ 132.761459][ T3532] vhci_hcd: stop threads [ 132.772318][ T3532] vhci_hcd: release socket [ 132.793042][ T6646] binder: 6645:6646 ioctl c0306201 2000000001c0 returned -14 [ 132.793926][ T3532] vhci_hcd: disconnect device [ 132.840875][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.847606][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.907764][ T6673] binder: 6672:6673 ioctl c0306201 2000000001c0 returned -14 [ 134.206369][ T6677] usb usb8: usbfs: process 6677 (syz.3.304) did not claim interface 0 before use [ 134.495966][ T6686] netlink: 4 bytes leftover after parsing attributes in process `syz.2.313'. [ 134.520171][ T6686] netlink: 28 bytes leftover after parsing attributes in process `syz.2.313'. [ 134.791829][ T6696] binder: 6693:6696 ioctl c0306201 2000000001c0 returned -14 [ 135.073027][ T6708] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 135.591941][ T6719] binder: BINDER_SET_CONTEXT_MGR already set [ 135.613241][ T6719] binder: 6718:6719 ioctl 4018620d 200000000040 returned -16 [ 135.638227][ T6719] binder: 6718:6719 ioctl c0306201 200000000700 returned -14 [ 137.165519][ T6738] binder: 6737:6738 ioctl c0306201 2000000001c0 returned -14 [ 137.555730][ T5890] vhci_hcd: vhci_device speed not set [ 137.728910][ T6749] binder: BINDER_SET_CONTEXT_MGR already set [ 137.748620][ T6749] binder: 6748:6749 ioctl 4018620d 200000000040 returned -16 [ 137.783644][ T6749] binder: 6748:6749 ioctl c0306201 200000000700 returned -14 [ 138.293286][ T6765] binder: 6763:6765 ioctl c0306201 2000000001c0 returned -14 [ 138.423702][ T6769] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 138.504624][ T6769] mac80211_hwsim hwsim11 wlan1 (unregistering): left allmulticast mode [ 138.749873][ T6779] binder: BINDER_SET_CONTEXT_MGR already set [ 138.785469][ T6779] binder: 6777:6779 ioctl 4018620d 200000000040 returned -16 [ 138.837759][ T6779] binder: 6777:6779 ioctl c0306201 200000000700 returned -14 [ 139.280510][ T6790] binder: 6789:6790 ioctl c0306201 2000000001c0 returned -14 [ 145.017381][ T6879] netlink: 156 bytes leftover after parsing attributes in process `syz.3.390'. [ 145.630276][ T6891] vlan0: entered promiscuous mode [ 146.729583][ T5821] IPVS: starting estimator thread 0... [ 146.825931][ T6917] IPVS: using max 28 ests per chain, 67200 per kthread [ 147.602471][ T6934] binder: 6933:6934 ioctl c0306201 200000000700 returned -14 [ 148.753325][ T5821] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 148.984702][ T5821] usb 4-1: config 0 has no interfaces? [ 149.105661][ T5821] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=57.3b [ 149.454655][ T5821] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.467309][ T5821] usb 4-1: Product: syz [ 149.532342][ T5821] usb 4-1: Manufacturer: syz [ 149.542266][ T5821] usb 4-1: SerialNumber: syz [ 149.555724][ T5821] usb 4-1: config 0 descriptor?? [ 149.838695][ T6948] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 149.851914][ T6948] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 149.864345][ T6948] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 149.907370][ T6948] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 150.078073][ T6948] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 150.975720][ T5821] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 151.365979][ T5821] usb 2-1: config 0 has no interfaces? [ 151.485783][ T5140] Bluetooth: hci0: command 0x0c1a tx timeout [ 151.654427][ T5821] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 151.685636][ T5821] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.693711][ T5821] usb 2-1: Product: syz [ 151.735376][ T5821] usb 2-1: Manufacturer: syz [ 151.807246][ T5821] usb 2-1: SerialNumber: syz [ 151.851770][ T5821] usb 2-1: config 0 descriptor?? [ 151.875976][ T5140] Bluetooth: hci2: command 0x0c1a tx timeout [ 151.875986][ T55] Bluetooth: hci1: command 0x0c1a tx timeout [ 151.966623][ T55] Bluetooth: hci3: command 0x0c1a tx timeout [ 151.983555][ T5891] usb 4-1: USB disconnect, device number 2 [ 152.136896][ T55] Bluetooth: hci4: command 0x0c1a tx timeout [ 152.232552][ T6958] vlan2: entered promiscuous mode [ 152.238171][ T6958] vlan2: entered allmulticast mode [ 152.243332][ T6958] hsr_slave_1: entered allmulticast mode [ 152.268853][ T6970] loop6: detected capacity change from 0 to 7 [ 152.319660][ T6959] netlink: 4 bytes leftover after parsing attributes in process `syz.1.419'. [ 152.472342][ T5838] Dev loop6: unable to read RDB block 7 [ 152.484699][ T5838] loop6: AHDI p3 p4 [ 152.499297][ T5838] loop6: partition table partially beyond EOD, truncated [ 152.533906][ T5838] loop6: p3 start 1886353253 is beyond EOD, truncated [ 152.559147][ T6970] Dev loop6: unable to read RDB block 7 [ 152.572584][ T6970] loop6: AHDI p3 p4 [ 152.585176][ T6970] loop6: partition table partially beyond EOD, truncated [ 152.623262][ T6970] loop6: p3 start 1886353253 is beyond EOD, truncated [ 153.929394][ T9] usb 2-1: USB disconnect, device number 2 [ 153.963392][ T55] Bluetooth: hci1: command 0x0c1a tx timeout [ 155.695760][ T5891] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 155.958400][ T5891] usb 4-1: config 0 has no interfaces? [ 155.970526][ T5891] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=57.3b [ 155.980223][ T5891] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.995658][ T5890] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 156.017897][ T5891] usb 4-1: Product: syz [ 156.026544][ T5891] usb 4-1: Manufacturer: syz [ 156.031166][ T5891] usb 4-1: SerialNumber: syz [ 156.066626][ T5891] usb 4-1: config 0 descriptor?? [ 156.209320][ T5890] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 156.292341][ T5890] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 156.355554][ T5890] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 156.387380][ T5890] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 156.408404][ T5890] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 156.450682][ T5890] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 156.462635][ T5890] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 156.472936][ T5890] usb 1-1: Product: syz [ 156.484834][ T5890] usb 1-1: Manufacturer: syz [ 156.492849][ T5890] usb 1-1: SerialNumber: syz [ 156.513267][ T5890] usb 1-1: config 0 descriptor?? [ 157.155687][ T5890] radio-si470x 1-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 157.186957][ T5890] radio-si470x 1-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 157.232995][ T5890] radio-si470x 1-1:0.0: software version 0, hardware version 0 [ 157.249902][ T5890] radio-si470x 1-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 157.278423][ T5890] radio-si470x 1-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 157.489401][ T5890] radio-si470x 1-1:0.0: submitting int urb failed (-90) [ 157.897543][ T5890] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 157.984737][ T5890] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -22 [ 158.043178][ T5890] usb 1-1: USB disconnect, device number 2 [ 158.389742][ T5888] usb 4-1: USB disconnect, device number 3 [ 158.981595][ T7063] netlink: 104 bytes leftover after parsing attributes in process `syz.1.457'. [ 159.076286][ T5928] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 159.270823][ T5928] usb 5-1: config 0 has no interfaces? [ 159.502605][ T5928] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 159.514770][ T5928] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.523715][ T5928] usb 5-1: Product: syz [ 159.529898][ T5928] usb 5-1: Manufacturer: syz [ 159.538752][ T5928] usb 5-1: SerialNumber: syz [ 159.553504][ T5928] usb 5-1: config 0 descriptor?? [ 159.651128][ T7071] binder: BINDER_SET_CONTEXT_MGR already set [ 159.725747][ T7071] binder: 7070:7071 ioctl 4018620d 200000000040 returned -16 [ 159.758165][ T7071] binder: 7070:7071 ioctl c0306201 2000000001c0 returned -14 [ 159.816627][ T5888] IPVS: starting estimator thread 0... [ 159.940286][ T7074] IPVS: using max 37 ests per chain, 88800 per kthread [ 160.795605][ T5890] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 161.095714][ T5890] usb 1-1: Using ep0 maxpacket: 16 [ 161.766053][ T5890] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 161.789339][ T5890] usb 1-1: New USB device found, idVendor=2040, idProduct=d864, bcdDevice=7f.c5 [ 161.798905][ T5890] usb 1-1: New USB device strings: Mfr=242, Product=2, SerialNumber=3 [ 161.808527][ T5890] usb 1-1: Product: syz [ 161.812723][ T5890] usb 1-1: Manufacturer: syz [ 161.817551][ T5890] usb 1-1: SerialNumber: syz [ 161.832842][ T5890] usb 1-1: config 0 descriptor?? [ 161.842485][ T5890] usb 1-1: dvb_usb_v2: found a 'Hauppauge 138xxx DVBT' in warm state [ 161.894313][ T5890] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 162.044203][ T7078] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] SMP KASAN PTI [ 162.056167][ T7078] KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] [ 162.064625][ T7078] CPU: 1 UID: 0 PID: 7078 Comm: syz.0.462 Not tainted 6.15.0-rc7-syzkaller-00152-gd0c22de9995b #0 PREEMPT(full) [ 162.076541][ T7078] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 162.086618][ T7078] RIP: 0010:__mutex_lock+0x138/0xe80 [ 162.091973][ T7078] Code: a0 06 81 99 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 0d 0c 00 00 83 3d 16 0d 29 0e 00 75 23 49 8d 7c 24 60 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 4c f3 c9 f6 4d 39 64 24 60 0f 85 7b 0b 00 [ 162.111613][ T7078] RSP: 0018:ffffc90003eef360 EFLAGS: 00010202 [ 162.117715][ T7078] RAX: 0000000000000019 RBX: 0000000000000000 RCX: ffffffff99810603 [ 162.125707][ T7078] RDX: ffff888024e10000 RSI: ffffffff8d939088 RDI: 00000000000000c8 [ 162.133696][ T7078] RBP: ffffc90003eef4f8 R08: ffffc90003eef467 R09: 0000000000000000 [ 162.141690][ T7078] R10: ffffc90003eef440 R11: fffff520007dde8d R12: 0000000000000068 [ 162.149686][ T7078] R13: dffffc0000000000 R14: ffff888059eec958 R15: 0000000000000000 [ 162.157687][ T7078] FS: 00007f18db9ad6c0(0000) GS:ffff8881261c2000(0000) knlGS:0000000000000000 [ 162.166814][ T7078] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 162.173427][ T7078] CR2: 0000200000002580 CR3: 000000007aefc000 CR4: 00000000003526f0 [ 162.181424][ T7078] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 162.189418][ T7078] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 162.197418][ T7078] Call Trace: [ 162.200715][ T7078] [ 162.203668][ T7078] ? __mutex_lock+0x330/0xe80 [ 162.208387][ T7078] ? dvb_usbv2_generic_write+0x26/0x60 [ 162.213878][ T7078] ? __pfx___mutex_lock+0x10/0x10 [ 162.218936][ T7078] ? __pfx___mutex_lock+0x10/0x10 [ 162.223991][ T7078] ? __mutex_lock+0x330/0xe80 [ 162.228701][ T7078] dvb_usbv2_generic_write+0x26/0x60 [ 162.234029][ T7078] mxl111sf_ctrl_msg+0x16a/0x2e0 [ 162.239061][ T7078] mxl111sf_write_reg+0xa0/0x180 [ 162.244035][ T7078] ? __pfx_mxl111sf_write_reg+0x10/0x10 [ 162.249614][ T7078] ? __lock_acquire+0xaac/0xd20 [ 162.254504][ T7078] mxl111sf_i2c_xfer+0x461/0x4f00 [ 162.259554][ T7078] ? rcu_is_watching+0x15/0xb0 [ 162.264349][ T7078] ? __kasan_check_byte+0x12/0x40 [ 162.269402][ T7078] ? is_bpf_text_address+0x26/0x2b0 [ 162.274637][ T7078] ? rcu_is_watching+0x15/0xb0 [ 162.279419][ T7078] ? rcu_is_watching+0x15/0xb0 [ 162.284205][ T7078] ? __pfx_mxl111sf_i2c_xfer+0x10/0x10 [ 162.289699][ T7078] ? kernel_text_address+0xa5/0xe0 [ 162.294847][ T7078] ? __kernel_text_address+0xd/0x40 [ 162.300081][ T7078] ? unwind_get_return_address+0x4d/0x90 [ 162.305747][ T7078] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 162.311924][ T7078] ? arch_stack_walk+0xfc/0x150 [ 162.316814][ T7078] ? stack_trace_save+0x9c/0xe0 [ 162.321696][ T7078] ? __pfx_stack_trace_save+0x10/0x10 [ 162.327094][ T7078] ? check_path+0x21/0x40 [ 162.331446][ T7078] ? lockdep_unlock+0x89/0x120 [ 162.336243][ T7078] ? validate_chain+0x897/0x2140 [ 162.341226][ T7078] ? __lock_acquire+0xaac/0xd20 [ 162.346117][ T7078] ? do_raw_spin_lock+0x121/0x290 [ 162.351174][ T7078] __i2c_transfer+0x871/0x2170 [ 162.355964][ T7078] ? lockdep_hardirqs_on+0x9c/0x150 [ 162.361187][ T7078] ? __pfx___i2c_transfer+0x10/0x10 [ 162.366406][ T7078] ? rt_mutex_lock_nested+0x15e/0x1e0 [ 162.371811][ T7078] ? i2c_transfer+0x120/0x3a0 [ 162.376517][ T7078] i2c_transfer+0x25b/0x3a0 [ 162.381046][ T7078] ? __pfx_i2c_transfer+0x10/0x10 [ 162.386100][ T7078] ? _copy_from_user+0x94/0xb0 [ 162.390895][ T7078] i2cdev_ioctl_rdwr+0x460/0x740 [ 162.395860][ T7078] i2cdev_ioctl+0x64b/0x7f0 [ 162.400382][ T7078] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 162.405430][ T7078] ? __fget_files+0x3a0/0x420 [ 162.410150][ T7078] ? __fget_files+0x2a/0x420 [ 162.414782][ T7078] ? bpf_lsm_file_ioctl+0x9/0x20 [ 162.419754][ T7078] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 162.424805][ T7078] __se_sys_ioctl+0xf9/0x170 [ 162.429423][ T7078] do_syscall_64+0xf6/0x210 [ 162.433953][ T7078] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 162.440133][ T7078] ? clear_bhb_loop+0x60/0xb0 [ 162.444839][ T7078] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.450757][ T7078] RIP: 0033:0x7f18dab8e969 [ 162.455209][ T7078] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 162.474842][ T7078] RSP: 002b:00007f18db9ad038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 162.483285][ T7078] RAX: ffffffffffffffda RBX: 00007f18dadb5fa0 RCX: 00007f18dab8e969 [ 162.491286][ T7078] RDX: 0000200000002580 RSI: 0000000000000707 RDI: 0000000000000007 [ 162.499306][ T7078] RBP: 00007f18dac10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 162.507300][ T7078] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 162.515382][ T7078] R13: 0000000000000000 R14: 00007f18dadb5fa0 R15: 00007f18daedfa28 [ 162.523489][ T7078] [ 162.526530][ T7078] Modules linked in: [ 162.534308][ T7078] ---[ end trace 0000000000000000 ]--- [ 162.563472][ T5890] dvbdev: DVB: registering new adapter (Hauppauge 138xxx DVBT) [ 162.571223][ T5890] usb 1-1: media controller created [ 162.585878][ T5890] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 162.620992][ T7078] RIP: 0010:__mutex_lock+0x138/0xe80 [ 162.649248][ T7078] Code: a0 06 81 99 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 0d 0c 00 00 83 3d 16 0d 29 0e 00 75 23 49 8d 7c 24 60 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 4c f3 c9 f6 4d 39 64 24 60 0f 85 7b 0b 00 [ 162.676234][ T5890] usb 1-1: selecting invalid altsetting 2 [ 162.694003][ T5890] set interface failed [ 162.699641][ T5928] usb 5-1: USB disconnect, device number 3 [ 162.710290][ T7078] RSP: 0018:ffffc90003eef360 EFLAGS: 00010202 [ 162.721077][ T7078] RAX: 0000000000000019 RBX: 0000000000000000 RCX: ffffffff99810603 [ 162.730554][ T7078] RDX: ffff888024e10000 RSI: ffffffff8d939088 RDI: 00000000000000c8 [ 162.766121][ T7078] RBP: ffffc90003eef4f8 R08: ffffc90003eef467 R09: 0000000000000000 [ 162.775106][ T7078] R10: ffffc90003eef440 R11: fffff520007dde8d R12: 0000000000000068 [ 162.783453][ T7078] R13: dffffc0000000000 R14: ffff888059eec958 R15: 0000000000000000 [ 162.811546][ T7078] FS: 00007f18db9ad6c0(0000) GS:ffff8881261c2000(0000) knlGS:0000000000000000 [ 162.854568][ T7078] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 162.863174][ T7078] CR2: 0000001b30117ff8 CR3: 000000007aefc000 CR4: 00000000003526f0 [ 162.873367][ T7078] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 162.883290][ T7078] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 162.898916][ T7078] Kernel panic - not syncing: Fatal exception [ 162.905313][ T7078] Kernel Offset: disabled [ 162.909639][ T7078] Rebooting in 86400 seconds..