last executing test programs: 7.682486274s ago: executing program 2 (id=3): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x0) getsockname$llc(0xffffffffffffffff, &(0x7f0000000200)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000240)=0x10) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000180)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x38e38e38e38e4d3, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc, &(0x7f0000000f40)={[{0x8, 0x4e00, "155038aad51c1e2b"}]}) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000374000/0x1000)=nil, 0x1000}, 0x1}) openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) socket$tipc(0x1e, 0x2, 0x0) syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_IOVA_RANGES(r2, 0x3b84, &(0x7f0000000000)={0x20, 0x0, 0x1, 0x0, &(0x7f00000022c0)=[{}]}) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101042, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, 0x0, 0x0) 5.747822955s ago: executing program 1 (id=2): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 4.80044878s ago: executing program 1 (id=7): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000001080)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0x4}]}, 0x54}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 4.799559285s ago: executing program 3 (id=4): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000500)='bic', 0x3) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 3.33887537s ago: executing program 2 (id=9): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)}, 0x0) 2.859153211s ago: executing program 2 (id=11): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000840)={0x34, &(0x7f0000001240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 2.725360566s ago: executing program 3 (id=12): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_connect$printer(0x3, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x426}}]}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000440)={0x34, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 2.722926025s ago: executing program 0 (id=13): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='ip6_vti0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x4004150, &(0x7f0000000180)={0x2, 0x4e20, @multicast2}, 0x10) 2.380876547s ago: executing program 0 (id=14): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000002280)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_WRITE(r0, &(0x7f000000a380)={0x18, 0x0, r1}, 0x18) 2.114404263s ago: executing program 0 (id=15): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000300)=ANY=[], 0x340a) 1.927896238s ago: executing program 0 (id=16): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0)=0x2009, 0x4) sendmmsg$inet(r0, &(0x7f0000001540), 0x0, 0x0) 1.510404049s ago: executing program 0 (id=17): r0 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x200c80c0, &(0x7f0000000280)={0xa, 0x4e22, 0x8021, @empty}, 0x1c) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000100)=0x2, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x10, 0x0, 0x0) 1.079785709s ago: executing program 0 (id=18): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f00000065c0)=ANY=[], 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x801) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f00000003c0), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000300)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000000)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), 0x0, 0x0, 0x1}) 0s ago: executing program 1 (id=19): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.160' (ED25519) to the list of known hosts. [ 99.788731][ T5583] cgroup: Unknown subsys name 'net' [ 100.031095][ T5583] cgroup: Unknown subsys name 'cpuset' [ 100.085755][ T5583] cgroup: Unknown subsys name 'rlimit' [ 100.102168][ T9] cfg80211: failed to load regulatory.db Setting up swapspace version 1, size = 127995904 bytes [ 102.031678][ T5583] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 105.817208][ T61] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 105.823072][ T5605] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 105.844330][ T5608] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 105.850875][ T5608] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 105.851637][ T5608] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 105.872772][ T5608] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 105.893441][ T4910] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 105.899399][ T4910] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 105.910792][ T4910] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 105.911988][ T4910] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 105.913593][ T4910] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 105.916018][ T4910] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 105.916773][ T4910] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 105.917578][ T4910] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 105.927388][ T4910] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 105.935938][ T5608] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 105.937902][ T4910] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 105.938475][ T4910] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 105.948750][ T5605] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 105.951167][ T5605] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 107.936578][ T61] Bluetooth: hci0: command tx timeout [ 108.015176][ T61] Bluetooth: hci2: command tx timeout [ 108.095487][ T5605] Bluetooth: hci1: command tx timeout [ 108.095743][ T61] Bluetooth: hci3: command tx timeout [ 108.127766][ T5601] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.128765][ T5601] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.128955][ T5601] bridge_slave_0: entered allmulticast mode [ 108.131188][ T5601] bridge_slave_0: entered promiscuous mode [ 108.187928][ T5601] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.188160][ T5601] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.188538][ T5601] bridge_slave_1: entered allmulticast mode [ 108.190619][ T5601] bridge_slave_1: entered promiscuous mode [ 108.274532][ T5602] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.274734][ T5602] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.275550][ T5602] bridge_slave_0: entered allmulticast mode [ 108.279130][ T5602] bridge_slave_0: entered promiscuous mode [ 108.343864][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.344197][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.344377][ T5602] bridge_slave_1: entered allmulticast mode [ 108.350323][ T5602] bridge_slave_1: entered promiscuous mode [ 108.358012][ T5599] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.358335][ T5599] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.358589][ T5599] bridge_slave_0: entered allmulticast mode [ 108.363185][ T5599] bridge_slave_0: entered promiscuous mode [ 108.385664][ T5601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 108.425262][ T5599] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.425489][ T5599] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.425652][ T5599] bridge_slave_1: entered allmulticast mode [ 108.429006][ T5599] bridge_slave_1: entered promiscuous mode [ 108.434504][ T5601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 108.435953][ T5600] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.436917][ T5600] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.438873][ T5600] bridge_slave_0: entered allmulticast mode [ 108.442494][ T5600] bridge_slave_0: entered promiscuous mode [ 108.515680][ T5600] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.515909][ T5600] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.516071][ T5600] bridge_slave_1: entered allmulticast mode [ 108.519116][ T5600] bridge_slave_1: entered promiscuous mode [ 108.527886][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 108.671495][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 108.679821][ T5599] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 108.686599][ T5601] team0: Port device team_slave_0 added [ 108.726148][ T5599] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 108.729134][ T5601] team0: Port device team_slave_1 added [ 108.734005][ T5600] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 108.792707][ T5600] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 108.797049][ T5602] team0: Port device team_slave_0 added [ 108.857604][ T5602] team0: Port device team_slave_1 added [ 108.861477][ T5599] team0: Port device team_slave_0 added [ 108.863639][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 108.863650][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 108.863665][ T5601] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 108.931537][ T5599] team0: Port device team_slave_1 added [ 108.934660][ T5600] team0: Port device team_slave_0 added [ 108.939171][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 108.939185][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 108.939209][ T5601] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.004525][ T5600] team0: Port device team_slave_1 added [ 109.025712][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.025731][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.025759][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.085272][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.085285][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.085301][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.087088][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.087098][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.087112][ T5599] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.140491][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.140507][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.140531][ T5599] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.149729][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.149746][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.149770][ T5600] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.203842][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.203858][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.203882][ T5600] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.269833][ T5601] hsr_slave_0: entered promiscuous mode [ 109.272376][ T5601] hsr_slave_1: entered promiscuous mode [ 109.365779][ T5602] hsr_slave_0: entered promiscuous mode [ 109.367466][ T5602] hsr_slave_1: entered promiscuous mode [ 109.368678][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 109.368748][ T5602] Cannot create hsr debugfs directory [ 109.432453][ T5599] hsr_slave_0: entered promiscuous mode [ 109.433879][ T5599] hsr_slave_1: entered promiscuous mode [ 109.435516][ T5599] debugfs: 'hsr0' already exists in 'hsr' [ 109.435540][ T5599] Cannot create hsr debugfs directory [ 109.482551][ T5600] hsr_slave_0: entered promiscuous mode [ 109.484118][ T5600] hsr_slave_1: entered promiscuous mode [ 109.485880][ T5600] debugfs: 'hsr0' already exists in 'hsr' [ 109.485904][ T5600] Cannot create hsr debugfs directory [ 110.016199][ T61] Bluetooth: hci0: command tx timeout [ 110.095375][ T61] Bluetooth: hci2: command tx timeout [ 110.176426][ T5605] Bluetooth: hci1: command tx timeout [ 110.176537][ T61] Bluetooth: hci3: command tx timeout [ 110.596469][ T5601] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 110.647511][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 110.653797][ T5601] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 110.680982][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 110.693963][ T5601] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 110.731112][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 110.753470][ T5601] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 110.793833][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 110.915540][ T5599] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 110.950361][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 110.960619][ T5599] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 111.000506][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 111.004412][ T5599] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 111.042532][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 111.072659][ T5599] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 111.104061][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 111.276010][ T5600] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 111.312427][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 111.325165][ T5600] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 111.371051][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 111.374945][ T5600] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 111.400585][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 111.430753][ T5600] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 111.459184][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 111.630235][ T5602] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 111.660703][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 111.668448][ T5602] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 111.699394][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 111.712410][ T5602] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 111.750433][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 111.761676][ T5602] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 111.789888][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 111.852274][ T5601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.953703][ T5601] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.020911][ T3337] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.021180][ T3337] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.061568][ T5599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.096092][ T61] Bluetooth: hci0: command tx timeout [ 112.107852][ T264] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.108706][ T264] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.176213][ T61] Bluetooth: hci2: command tx timeout [ 112.199850][ T5599] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.252045][ T264] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.252186][ T264] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.254980][ T5605] Bluetooth: hci1: command tx timeout [ 112.255079][ T61] Bluetooth: hci3: command tx timeout [ 112.284162][ T5600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.337415][ T264] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.337519][ T264] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.453827][ T5600] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.482054][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.524450][ T25] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.524712][ T25] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.601769][ T185] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.601970][ T185] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.718221][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.784351][ T25] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.784602][ T25] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.869014][ T25] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.869302][ T25] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.737617][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.175143][ T5605] Bluetooth: hci0: command tx timeout [ 114.237123][ T5599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.256126][ T61] Bluetooth: hci2: command tx timeout [ 114.271181][ T5601] veth0_vlan: entered promiscuous mode [ 114.346073][ T5605] Bluetooth: hci1: command tx timeout [ 114.346130][ T61] Bluetooth: hci3: command tx timeout [ 114.447156][ T5601] veth1_vlan: entered promiscuous mode [ 114.496714][ T5600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.739337][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.755356][ T5599] veth0_vlan: entered promiscuous mode [ 114.762799][ T5601] veth0_macvtap: entered promiscuous mode [ 114.797797][ T5601] veth1_macvtap: entered promiscuous mode [ 114.834397][ T5599] veth1_vlan: entered promiscuous mode [ 114.869063][ T5600] veth0_vlan: entered promiscuous mode [ 114.919385][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.938095][ T5600] veth1_vlan: entered promiscuous mode [ 114.952300][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 115.016923][ T185] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.034663][ T185] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.050902][ T185] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.062111][ T185] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.079674][ T5602] veth0_vlan: entered promiscuous mode [ 115.089347][ T5599] veth0_macvtap: entered promiscuous mode [ 115.176892][ T5599] veth1_macvtap: entered promiscuous mode [ 115.272059][ T5602] veth1_vlan: entered promiscuous mode [ 115.464201][ T5600] veth0_macvtap: entered promiscuous mode [ 115.517351][ T5600] veth1_macvtap: entered promiscuous mode [ 115.539151][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 115.604667][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 115.672967][ T185] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.672991][ T185] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.694243][ T1526] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.709807][ T1526] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.718986][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 115.731210][ T1526] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.771634][ T1526] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.827269][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 115.828660][ T5602] veth0_macvtap: entered promiscuous mode [ 115.888833][ T151] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.888856][ T151] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.912352][ T5602] veth1_macvtap: entered promiscuous mode [ 115.951476][ T264] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.002333][ T264] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.022756][ T264] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.060866][ T264] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.377375][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 116.473637][ T1612] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.473657][ T1612] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.507660][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 116.772877][ T25] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.839282][ T25] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.842065][ T25] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.855489][ T25] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.906652][ T2372] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.906673][ T2372] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.983579][ T264] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.983599][ T264] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.153198][ T5689] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 117.403038][ T5689] usb 3-1: too many configurations: 211, using maximum allowed: 8 [ 117.518170][ T5689] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 117.518213][ T5689] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.518233][ T5689] usb 3-1: Product: syz [ 117.518246][ T5689] usb 3-1: Manufacturer: syz [ 117.518259][ T5689] usb 3-1: SerialNumber: syz [ 117.569439][ T264] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.569461][ T264] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.728584][ T1612] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.728608][ T1612] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.214463][ T2372] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.214483][ T2372] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.539018][ T5327] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 119.480106][ T5744] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.480702][ T5744] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.861631][ T5327] usb 3-1: Service connection timeout for: 256 [ 119.861654][ T5327] ath9k_htc 3-1:1.0: ath9k_htc: Unable to initialize HTC services [ 120.247365][ T5701] usb 3-1: USB disconnect, device number 2 [ 120.429516][ T5327] ath9k_htc: Failed to initialize the device [ 120.637209][ T5701] usb 3-1: ath9k_htc: USB layer deinitialized [ 121.313790][ T5773] use of bytesused == 0 is deprecated and will be removed in the future, [ 121.313807][ T5773] use the actual size instead. [ 121.965049][ T5701] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 122.029945][ T5694] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 122.160388][ T5701] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 122.160422][ T5701] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.160442][ T5701] usb 3-1: Product: syz [ 122.160456][ T5701] usb 3-1: Manufacturer: syz [ 122.160469][ T5701] usb 3-1: SerialNumber: syz [ 122.198316][ T5694] usb 4-1: Using ep0 maxpacket: 32 [ 122.204592][ T5694] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 122.204622][ T5694] usb 4-1: config 0 has no interface number 0 [ 122.204671][ T5694] usb 4-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 122.204695][ T5694] usb 4-1: config 0 interface 89 has no altsetting 0 [ 122.252280][ T5694] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 122.252312][ T5694] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.252333][ T5694] usb 4-1: Product: syz [ 122.252348][ T5694] usb 4-1: Manufacturer: syz [ 122.252362][ T5694] usb 4-1: SerialNumber: syz [ 122.366164][ T5701] usb 3-1: config 0 descriptor?? [ 122.421588][ T5694] usb 4-1: config 0 descriptor?? [ 122.644395][ T5694] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 122.644437][ T5694] em28xx 4-1:0.89: Video interface 89 found: [ 122.869290][ T5701] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 123.101935][ T5694] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 123.423867][ T5701] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 123.871349][ T5694] em28xx 4-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 123.871381][ T5694] em28xx 4-1:0.89: board has no eeprom [ 123.886691][ T38] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 123.955363][ T5694] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 123.955392][ T5694] em28xx 4-1:0.89: analog set to bulk mode. [ 123.960058][ T5606] em28xx 4-1:0.89: Registering V4L2 extension [ 124.021264][ T38] usb 1-1: device descriptor read/64, error -71 [ 124.081461][ T5694] usb 4-1: USB disconnect, device number 2 [ 124.106350][ T5694] em28xx 4-1:0.89: Disconnecting em28xx [ 124.233550][ T5606] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 124.233576][ T5606] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 124.233589][ T5606] em28xx 4-1:0.89: No AC97 audio processor [ 124.314462][ T5606] usb 4-1: Decoder not found [ 124.314483][ T5606] em28xx 4-1:0.89: failed to create media graph [ 124.314544][ T5606] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 124.342037][ T5606] INFO: trying to register non-static key. [ 124.342052][ T5606] The code is fine but needs lockdep annotation, or maybe [ 124.342062][ T5606] you didn't initialize this object before use? [ 124.342070][ T5606] turning off the locking correctness validator. [ 124.342086][ T5606] CPU: 1 UID: 0 PID: 5606 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 124.342112][ T5606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 124.342126][ T5606] Workqueue: events request_module_async [ 124.342164][ T5606] Call Trace: [ 124.342172][ T5606] [ 124.342180][ T5606] dump_stack_lvl+0xe8/0x150 [ 124.342209][ T5606] assign_lock_key+0x133/0x150 [ 124.342232][ T5606] register_lock_class+0xcc/0x2e0 [ 124.342266][ T5606] __lock_acquire+0xaf/0x2e40 [ 124.342287][ T5606] ? ret_from_fork_asm+0x1a/0x30 [ 124.342317][ T5606] ? stack_trace_save+0xa9/0x100 [ 124.342346][ T5606] ? __pfx_stack_trace_save+0x10/0x10 [ 124.342379][ T5606] lock_acquire+0x115/0x350 [ 124.342410][ T5606] ? __wake_up_common_lock+0x2f/0x1f0 [ 124.342446][ T5606] rt_spin_lock+0x83/0x400 [ 124.342472][ T5606] ? __wake_up_common_lock+0x2f/0x1f0 [ 124.342500][ T5606] ? __pfx_rt_spin_lock+0x10/0x10 [ 124.342529][ T5606] __wake_up_common_lock+0x2f/0x1f0 [ 124.342557][ T5606] __vb2_queue_cancel+0x2de/0xdc0 [ 124.342586][ T5606] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 124.342607][ T5606] ? lockdep_hardirqs_on+0x7a/0x110 [ 124.342627][ T5606] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 124.342657][ T5606] vb2_core_queue_release+0x2f/0x150 [ 124.342691][ T5606] vb2_video_unregister_device+0x15b/0x200 [ 124.342725][ T5606] em28xx_v4l2_init+0x1c60/0x3140 [ 124.342755][ T5606] em28xx_init_extension+0x120/0x1d0 [ 124.342788][ T5606] ? process_one_work+0x7fd/0x1480 [ 124.342809][ T5606] process_one_work+0xaaf/0x1480 [ 124.342829][ T5606] ? irqentry_exit+0x218/0x8f0 [ 124.342854][ T5606] ? __pfx_process_one_work+0x10/0x10 [ 124.342871][ T5606] ? do_raw_spin_lock+0x12b/0x2f0 [ 124.342900][ T5606] ? assign_work+0x3cf/0x5d0 [ 124.342921][ T5606] worker_thread+0xb05/0x10d0 [ 124.342946][ T5606] ? __kthread_parkme+0x71/0x1f0 [ 124.342973][ T5606] kthread+0x388/0x470 [ 124.342999][ T5606] ? __pfx_worker_thread+0x10/0x10 [ 124.343018][ T5606] ? __pfx_kthread+0x10/0x10 [ 124.343044][ T5606] ret_from_fork+0x514/0xb70 [ 124.343073][ T5606] ? __pfx_ret_from_fork+0x10/0x10 [ 124.343099][ T5606] ? __switch_to+0xc89/0x1420 [ 124.343123][ T5606] ? __pfx_kthread+0x10/0x10 [ 124.343157][ T5606] ret_from_fork_asm+0x1a/0x30 [ 124.343191][ T5606] [ 124.343268][ T5606] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI [ 124.343287][ T5606] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 124.343304][ T5606] CPU: 1 UID: 0 PID: 5606 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 124.343327][ T5606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 124.343339][ T5606] Workqueue: events request_module_async [ 124.343360][ T5606] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 124.343390][ T5606] Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc [ 124.343407][ T5606] RSP: 0018:ffffc90005407908 EFLAGS: 00010246 [ 124.343423][ T5606] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 124.343435][ T5606] RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff [ 124.343450][ T5606] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 124.343462][ T5606] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff888031b4db14 [ 124.343477][ T5606] R13: ffff888031b4dc28 R14: 0000000000000000 R15: 0000000000000000 [ 124.343490][ T5606] FS: 0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000 [ 124.343506][ T5606] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 124.343520][ T5606] CR2: 0000001b31720000 CR3: 000000000e1b0000 CR4: 00000000003526f0 [ 124.343539][ T5606] Call Trace: [ 124.343546][ T5606] [ 124.343556][ T5606] __vb2_queue_cancel+0x2de/0xdc0 [ 124.343585][ T5606] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 124.343605][ T5606] ? lockdep_hardirqs_on+0x7a/0x110 [ 124.343623][ T5606] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 124.343654][ T5606] vb2_core_queue_release+0x2f/0x150 [ 124.343687][ T5606] vb2_video_unregister_device+0x15b/0x200 [ 124.343719][ T5606] em28xx_v4l2_init+0x1c60/0x3140 [ 124.343748][ T5606] em28xx_init_extension+0x120/0x1d0 [ 124.343778][ T5606] ? process_one_work+0x7fd/0x1480 [ 124.343797][ T5606] process_one_work+0xaaf/0x1480 [ 124.343816][ T5606] ? irqentry_exit+0x218/0x8f0 [ 124.343842][ T5606] ? __pfx_process_one_work+0x10/0x10 [ 124.343861][ T5606] ? do_raw_spin_lock+0x12b/0x2f0 [ 124.343890][ T5606] ? assign_work+0x3cf/0x5d0 [ 124.343911][ T5606] worker_thread+0xb05/0x10d0 [ 124.343935][ T5606] ? __kthread_parkme+0x71/0x1f0 [ 124.343961][ T5606] kthread+0x388/0x470 [ 124.343987][ T5801] ------------[ cut here ]------------ [ 124.343987][ T5606] ? __pfx_worker_thread+0x10/0x10 [ 124.343997][ T5801] mas->ld_seq != lock_sequence(map) [ 124.344005][ T5801] WARNING: lib/maple_tree.c:1188 at mas_find+0xa02/0xca0, CPU#0: syz.1.19/5801 [ 124.344007][ T5606] ? __pfx_kthread+0x10/0x10 [ 124.344037][ T5801] Modules linked in: [ 124.344040][ T5606] ret_from_fork+0x514/0xb70 [ 124.344052][ T5801] CPU: 0 UID: 0 PID: 5801 Comm: syz.1.19 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 124.344074][ T5801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 124.344069][ T5606] ? __pfx_ret_from_fork+0x10/0x10 [ 124.344086][ T5801] RIP: 0010:mas_find+0xa02/0xca0 [ 124.344096][ T5606] ? __switch_to+0xc89/0x1420 [ 124.344106][ T5801] Code: 74 08 4c 89 f7 e8 5e 39 e9 f6 49 c7 06 ff ff ff ff 31 c0 e9 16 fd ff ff e8 7b e1 7c f6 31 c0 e9 0a fd ff ff e8 6f e1 7c f6 90 <0f> 0b 90 e9 65 f7 ff ff e8 61 e1 7c f6 31 c0 e9 f0 fc ff ff e8 55 [ 124.344124][ T5801] RSP: 0018:ffffc90005c17638 EFLAGS: 00010293 [ 124.344121][ T5606] ? __pfx_kthread+0x10/0x10 [ 124.344137][ T5801] [ 124.344141][ T5801] RAX: ffffffff8b48c241 RBX: 1ffff92000b82f29 RCX: ffff888028fb3e80 [ 124.344158][ T5801] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 124.344159][ T5606] ret_from_fork_asm+0x1a/0x30 [ 124.344170][ T5801] RBP: 00000000000000ef R08: 0000000000000000 R09: 0000000000000000 [ 124.344182][ T5801] R10: dffffc0000000000 R11: ffffed100812d395 R12: 00000000ffffffff [ 124.344195][ T5606] [ 124.344197][ T5801] R13: ffffc90005c17954 R14: ffffc90005c17900 R15: ffffc90005c17948 [ 124.344202][ T5606] Modules linked in: [ 124.344214][ T5801] FS: 0000000000000000(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000 [ 124.344227][ T5606] ---[ end trace 0000000000000000 ]--- [ 124.344230][ T5801] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 124.344244][ T5801] CR2: 0000001b32b22ff8 CR3: 000000003179c000 CR4: 00000000003526f0 [ 124.344238][ T5606] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 124.344263][ T5801] Call Trace: [ 124.344271][ T5801] [ 124.344267][ T5606] Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc [ 124.344284][ T5606] RSP: 0018:ffffc90005407908 EFLAGS: 00010246 [ 124.344281][ T5801] unmap_vmas+0x43e/0x550 [ 124.344298][ T5606] [ 124.344303][ T5606] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 124.344308][ T5801] ? __pfx_unmap_vmas+0x10/0x10 [ 124.344316][ T5606] RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff [ 124.344331][ T5606] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 124.344343][ T5606] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff888031b4db14 [ 124.344339][ T5801] exit_mmap+0x293/0x9f0 [ 124.344358][ T5606] R13: ffff888031b4dc28 R14: 0000000000000000 R15: 0000000000000000 [ 124.344372][ T5606] FS: 0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000 [ 124.344369][ T5801] ? __pfx_exit_mmap+0x10/0x10 [ 124.344388][ T5606] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 124.344402][ T5606] CR2: 0000001b31720000 CR3: 000000000e1b0000 CR4: 00000000003526f0 [ 124.344397][ T5801] ? do_raw_spin_lock+0x12b/0x2f0 [ 124.344423][ T5606] Kernel panic - not syncing: Fatal exception [ 124.344571][ T5606] Kernel Offset: disabled