last executing test programs: 6.586048758s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x80000, 0x128) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x1c4) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/sctp\x00') r3 = open_tree(r2, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000040)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 5.519308357s ago: executing program 0 (id=6): sendmsg$kcm(0xffffffffffffffff, 0x0, 0x8000) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x2ff, 0x0, 0x7ee69d08}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_GET_SREGS(r2, 0x8138ae83, 0x0) 5.480896339s ago: executing program 1 (id=2): socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$dvb_frontend(&(0x7f0000000380), 0x0, 0x0) socket$inet6(0xa, 0x80002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147c40, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$packet(r0, &(0x7f00000000c0)={0x11, 0x18, r2, 0x1, 0x81}, 0x14) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) 4.726256106s ago: executing program 1 (id=8): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) socketpair$unix(0x1, 0x2, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040ed5000410"], 0x11) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) 4.718752633s ago: executing program 2 (id=3): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x5b02, 0x0) write$char_usb(r1, 0x0, 0x0) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)={0x2, 0x0, @rand_addr=0xac1414bb}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x1}], 0x1}, 0x20000000}, {{&(0x7f0000000180)={0x2, 0x0, @remote}, 0x10, 0x0}}], 0x2, 0x0) syz_usb_disconnect(r0) r3 = syz_open_dev$video(&(0x7f0000000180), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) r5 = syz_open_dev$radio(&(0x7f00000000c0), 0x2, 0x2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$VIDIOC_S_TUNER(r5, 0x4054561e, &(0x7f0000000100)={0x2, "02c0cf0c629c527e5162bf1cab3223b02749791e5c7465e0caa7b1214ac1efe3", 0x5, 0x100, 0x1aa35bb2, 0x4b70, 0x4, 0x2, 0x80000001, 0x401}) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000480)={'ipvlan1\x00', &(0x7f00000001c0)=@ethtool_per_queue_op={0x4b, 0xf, [0x4, 0x8001, 0x0, 0x6, 0xfffffffe, 0x8000, 0x0, 0x8, 0x4, 0x8, 0x0, 0x0, 0x6, 0x1, 0x2, 0x0, 0x3ff, 0x8001, 0xdd5, 0x2, 0x1, 0x1, 0x0, 0x7f, 0x1000, 0xffffffff, 0x4, 0x8000, 0x1, 0x1ec3, 0x2, 0x0, 0x6, 0x7fff, 0x81, 0x4, 0x5, 0x2b, 0xffff8001, 0x1, 0x80, 0x25, 0x4, 0x9, 0x3151, 0x4, 0x4, 0xb518, 0x0, 0x6, 0x8, 0x7f, 0x7, 0x9, 0xc, 0x3, 0x7f8, 0x0, 0x6, 0xd, 0x7, 0x2, 0x3, 0x5, 0x1, 0x5, 0x7, 0x1ff, 0xfffffc01, 0x10, 0xb, 0x7, 0x7fff, 0x401, 0x4, 0xbb, 0xf, 0xd8, 0x3ff, 0x6, 0xfff, 0x5, 0x3, 0xa75, 0x90000000, 0x7, 0xf, 0xe, 0x0, 0x2, 0x800, 0x80000001, 0xfffffb23, 0xb, 0x2, 0x10000, 0x3, 0xe, 0x5, 0x8000, 0x283150c, 0x9, 0x0, 0x7, 0x8, 0x0, 0x4, 0x3, 0xfff, 0x200, 0x8561, 0x2400, 0x6, 0x40, 0x4, 0x4, 0x7, 0x8be, 0x3, 0x80, 0xe103, 0x7, 0x101, 0x10, 0x40, 0x3, 0xfffffff7, 0x9d1], "a8517a030406ff8bfc826d587eef0a0cc0034f9cbc4192dc301eaeb350bf67d11f7490358469379a6534e110ffac13defce1dcf0c4ee15b16d6cb62ee41839a4c7eab1fac7d28dabef84ea76c4407603b6ff72bd1c7a09352d9496424924dc64e32396199f6505c8f7ebaa07dd446ea9adaaf26272852cbb75fa4591"}}) ioctl$VIDIOC_G_SELECTION(r3, 0xc040565e, &(0x7f0000000040)={0x9, 0x103, 0x0, {0x4, 0x2, 0x20000009, 0xf}}) 4.65869577s ago: executing program 3 (id=9): syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_role_change={{0x12, 0x8}, {0x8, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7}}}, 0xb) 4.471594149s ago: executing program 1 (id=10): socket(0xa, 0x3, 0x3a) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080), 0x6) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0x6) 4.467501073s ago: executing program 0 (id=11): r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_submit(0x0, 0x2, &(0x7f00000000c0)=[&(0x7f0000000200)={0x0, 0x0, 0x8, 0x0, 0x0, r0, 0x0}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x400, 0x48940) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f00000000c0)=""/84) 4.348959879s ago: executing program 3 (id=12): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x8c66) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000140)={0xfffffffffffffc04, 0x0, 0x1, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000240)={0x27800000000, 0x0, 0x1, r2, 0x1f}) 3.711836493s ago: executing program 1 (id=13): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r0, 0x0, 0x0, 0x30008087, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r2, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x8, @empty, 0x2}, 0x1c) listen(r4, 0x6f6) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x28, r7, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1a}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x8) 2.697688676s ago: executing program 3 (id=14): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f0000000240)={&(0x7f0000000780)=[0x0, 0x0], &(0x7f0000000200), 0x2, r1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000500)={0x200, 0x1, &(0x7f0000000180)=[r1], &(0x7f0000000200), &(0x7f0000000580)=[r2], &(0x7f0000000980)}) 2.327421964s ago: executing program 1 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000080)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000140)='./file0\x00') r0 = open(&(0x7f0000000000)='./bus\x00', 0x4427e, 0x9a) fallocate(r0, 0x0, 0x0, 0x1000f4) write$P9_RLCREATE(r0, &(0x7f0000000000)={0x18, 0xf, 0x1, {{0x2, 0x4, 0x3}, 0x3}}, 0x18) linkat(r0, &(0x7f00000006c0)='./file1\x00', r0, &(0x7f00000000c0)='./file0\x00', 0x1c00) 2.046240445s ago: executing program 3 (id=16): setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, 0x0, 0x0) unshare(0x8040480) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_int(r0, 0x11a, 0x24, 0x0, 0x0) 1.792031853s ago: executing program 0 (id=17): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r0, 0x1, 0x20, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0x9, 0xfa11, 0x2}, 0x0) r3 = openat$sysfs(0xffffff9c, &(0x7f0000000100)='/sys/power/pm_trace_dev_match', 0x0, 0x0) readv(r3, &(0x7f00000003c0)=[{&(0x7f0000000280)=""/177, 0xb1}], 0x1) listen(0xffffffffffffffff, 0x20) socket$netlink(0x10, 0x3, 0x0) shutdown(0xffffffffffffffff, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r4, r4, 0x0, 0x200000) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet(0x2, 0x801, 0x100) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c00000014001105f4590000000000002b00000100"/30, @ANYRES32=0x0], 0x4c}, 0x1, 0x0, 0x0, 0x4000840}, 0x8004) r6 = openat$sndtimer(0xffffff9c, &(0x7f0000000140), 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r6, 0x403c5404, 0x0) ioctl$sock_SIOCGIFCONF(r5, 0x8912, &(0x7f0000000340)=@req={0x28, &(0x7f00000001c0)={'veth0_macvtap\x00', @ifru_hwaddr=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}}) syz_emit_vhci(0x0, 0x7) 1.612041488s ago: executing program 1 (id=18): r0 = syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000bc0)={0x44, 0x0, 0x0, 0x0, &(0x7f00000009c0)={0x20, 0x80, 0x1c, {0x3, 0x9, 0xe4c, 0x2, 0x3, 0x3865, 0x8, 0x9, 0x1, 0x5, 0x4, 0x81}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) 1.132678905s ago: executing program 3 (id=19): r0 = syz_open_dev$video(&(0x7f0000000040), 0x7, 0x0) ioctl$VIDIOC_ENUM_FREQ_BANDS(r0, 0xc0405665, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x1000}) 791.928551ms ago: executing program 2 (id=20): r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@rand_addr=0x64010102, 0x0, 0x5, 0x0, 0x3, 0x2, 0x20, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xac, 0xfff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x7fffffff, 0x10000}, {0x2, 0xa04, 0x40800000000000, 0x800000000000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, [@tmpl={0x44, 0x5, [{{@in=@empty, 0x4d2, 0x3c}, 0xa, @in=@broadcast, 0x0, 0x0, 0x3, 0x8, 0x49}]}]}, 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000064010100000000000000000000000000fc01000000000000000000000000000000000000000000000a0000"], 0xfc}}, 0x0) sendmmsg$inet6(r0, &(0x7f00000064c0)=[{{&(0x7f0000000280)={0xa, 0x4e22, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}, 0x1c, 0x0}}], 0x1, 0x888) 479.659838ms ago: executing program 3 (id=21): bind$inet(0xffffffffffffffff, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x3f00) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x8, 0xfffff038}, {0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10) timer_create(0x1, &(0x7f0000000100)={0x0, 0x11, 0x4}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x5) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmmsg(r0, &(0x7f0000000180), 0x4000190, 0xc03e) 0s ago: executing program 2 (id=22): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="c60009"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001640)={0x24, 0x0, 0x0, &(0x7f0000001bc0)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x9}]}}, 0x0}, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x20040, 0x0) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_disconnect(r0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(0xffffffffffffffff, 0x28, 0x8, &(0x7f0000000040)=0xffffffffffffffff, 0x57) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340"], 0x0) syz_usb_disconnect(r1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.104' (ED25519) to the list of known hosts. [ 91.996311][ T9] cfg80211: failed to load regulatory.db [ 93.138397][ T5595] cgroup: Unknown subsys name 'net' [ 93.370103][ T5595] cgroup: Unknown subsys name 'cpuset' [ 93.434710][ T5595] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 95.528474][ T5595] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 99.155527][ T4924] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 99.173800][ T4924] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 99.189167][ T4924] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 99.190894][ T4924] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 99.192071][ T4924] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 99.348946][ T5613] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 99.385097][ T5613] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 99.388128][ T5613] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 99.392394][ T5613] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 99.395062][ T5619] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 99.405259][ T5613] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 99.413017][ T60] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 99.423246][ T60] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 99.455474][ T60] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 99.458549][ T60] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 99.489106][ T5619] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 99.511028][ T5619] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 99.550441][ T60] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 99.571517][ T5619] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 99.581871][ T5619] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 101.235006][ T4924] Bluetooth: hci0: command tx timeout [ 101.554154][ T4924] Bluetooth: hci1: command tx timeout [ 101.634550][ T4924] Bluetooth: hci3: command tx timeout [ 101.644710][ T4924] Bluetooth: hci2: command tx timeout [ 101.696531][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.696943][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.697251][ T5612] bridge_slave_0: entered allmulticast mode [ 101.700397][ T5612] bridge_slave_0: entered promiscuous mode [ 101.765312][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.765649][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.765895][ T5612] bridge_slave_1: entered allmulticast mode [ 101.768545][ T5612] bridge_slave_1: entered promiscuous mode [ 101.878723][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.878958][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.879159][ T5620] bridge_slave_0: entered allmulticast mode [ 101.883321][ T5620] bridge_slave_0: entered promiscuous mode [ 101.970465][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.970806][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.971106][ T5620] bridge_slave_1: entered allmulticast mode [ 101.976455][ T5620] bridge_slave_1: entered promiscuous mode [ 102.005460][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.030793][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.031122][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.031400][ T5617] bridge_slave_0: entered allmulticast mode [ 102.036121][ T5617] bridge_slave_0: entered promiscuous mode [ 102.087391][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.087879][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.088128][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.088334][ T5615] bridge_slave_0: entered allmulticast mode [ 102.090733][ T5615] bridge_slave_0: entered promiscuous mode [ 102.165483][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.165817][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.166026][ T5617] bridge_slave_1: entered allmulticast mode [ 102.168460][ T5617] bridge_slave_1: entered promiscuous mode [ 102.228019][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.228251][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.228444][ T5615] bridge_slave_1: entered allmulticast mode [ 102.230900][ T5615] bridge_slave_1: entered promiscuous mode [ 102.286061][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.360105][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.368764][ T5612] team0: Port device team_slave_0 added [ 102.403239][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.434655][ T5612] team0: Port device team_slave_1 added [ 102.440253][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.449114][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.504425][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.536757][ T5620] team0: Port device team_slave_0 added [ 102.605782][ T5620] team0: Port device team_slave_1 added [ 102.607889][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.607902][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.607922][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.670131][ T5617] team0: Port device team_slave_0 added [ 102.695372][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.695386][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.695407][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.699088][ T5615] team0: Port device team_slave_0 added [ 102.702654][ T5617] team0: Port device team_slave_1 added [ 102.783288][ T5615] team0: Port device team_slave_1 added [ 102.807034][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.807047][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.807068][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.886697][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.886711][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.886731][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.941873][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.941886][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.941906][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.009168][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.009181][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.009201][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.011452][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.011463][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.011484][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.104801][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.104815][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.104836][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.162542][ T5612] hsr_slave_0: entered promiscuous mode [ 103.171729][ T5612] hsr_slave_1: entered promiscuous mode [ 103.314297][ T4924] Bluetooth: hci0: command tx timeout [ 103.540776][ T5620] hsr_slave_0: entered promiscuous mode [ 103.542370][ T5620] hsr_slave_1: entered promiscuous mode [ 103.543698][ T5620] debugfs: 'hsr0' already exists in 'hsr' [ 103.543784][ T5620] Cannot create hsr debugfs directory [ 103.635350][ T4924] Bluetooth: hci1: command tx timeout [ 103.667085][ T5617] hsr_slave_0: entered promiscuous mode [ 103.669146][ T5617] hsr_slave_1: entered promiscuous mode [ 103.670420][ T5617] debugfs: 'hsr0' already exists in 'hsr' [ 103.670448][ T5617] Cannot create hsr debugfs directory [ 103.714226][ T4924] Bluetooth: hci2: command tx timeout [ 103.714255][ T4924] Bluetooth: hci3: command tx timeout [ 103.717527][ T5615] hsr_slave_0: entered promiscuous mode [ 103.719097][ T5615] hsr_slave_1: entered promiscuous mode [ 103.720422][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 103.720450][ T5615] Cannot create hsr debugfs directory [ 104.609885][ T5612] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 104.668577][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.674558][ T5612] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 104.726563][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.732304][ T5612] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 104.755578][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.782056][ T5612] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 104.813204][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.920398][ T5617] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 104.950751][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.972757][ T5617] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 105.009231][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.019427][ T5617] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 105.063774][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.097285][ T5617] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 105.138965][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.340183][ T5615] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 105.378978][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.394686][ T5619] Bluetooth: hci0: command tx timeout [ 105.397230][ T5615] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 105.439890][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.454831][ T5615] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 105.499678][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.540186][ T5615] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 105.580185][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.714629][ T5619] Bluetooth: hci1: command tx timeout [ 105.777305][ T5620] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 105.795916][ T5619] Bluetooth: hci3: command tx timeout [ 105.797955][ T5619] Bluetooth: hci2: command tx timeout [ 105.826549][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.846755][ T5620] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 105.881593][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.897085][ T5620] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 105.945791][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.964554][ T5620] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 106.011854][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.119031][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.251471][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.294667][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.325721][ T1356] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.325994][ T1356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.419216][ T1494] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.419381][ T1494] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.511960][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.574370][ T1494] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.574763][ T1494] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.624947][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.655449][ T1494] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.655582][ T1494] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.770978][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.831448][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.849275][ T1356] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.849450][ T1356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.946500][ T1356] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.946678][ T1356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.070223][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.142191][ T2318] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.142377][ T2318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.233500][ T2318] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.233708][ T2318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.476789][ T4924] Bluetooth: hci0: command tx timeout [ 107.794158][ T4924] Bluetooth: hci1: command tx timeout [ 107.876718][ T4924] Bluetooth: hci2: command tx timeout [ 107.876752][ T4924] Bluetooth: hci3: command tx timeout [ 108.280328][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.489177][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.783470][ T5612] veth0_vlan: entered promiscuous mode [ 108.889363][ T5612] veth1_vlan: entered promiscuous mode [ 108.935395][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.979450][ T5617] veth0_vlan: entered promiscuous mode [ 109.013169][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.042568][ T5617] veth1_vlan: entered promiscuous mode [ 109.149112][ T5612] veth0_macvtap: entered promiscuous mode [ 109.209040][ T5612] veth1_macvtap: entered promiscuous mode [ 109.290753][ T5615] veth0_vlan: entered promiscuous mode [ 109.309863][ T5617] veth0_macvtap: entered promiscuous mode [ 109.351546][ T5620] veth0_vlan: entered promiscuous mode [ 109.353633][ T5617] veth1_macvtap: entered promiscuous mode [ 109.383130][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.398029][ T5615] veth1_vlan: entered promiscuous mode [ 109.436909][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.470294][ T5620] veth1_vlan: entered promiscuous mode [ 109.496438][ T1152] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.503419][ T1152] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.531105][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.549527][ T1152] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.569375][ T1152] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.593473][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.749423][ T1152] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.787586][ T1152] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.810259][ T1152] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.879379][ T1152] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.880481][ T5615] veth0_macvtap: entered promiscuous mode [ 110.043639][ T5615] veth1_macvtap: entered promiscuous mode [ 110.140235][ T5620] veth0_macvtap: entered promiscuous mode [ 110.324854][ T1152] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.324872][ T1152] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.326354][ T5620] veth1_macvtap: entered promiscuous mode [ 110.451601][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.537523][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.571383][ T481] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.571406][ T481] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.627936][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.651022][ T481] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.681755][ T481] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.698040][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.742415][ T481] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.759256][ T481] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.787993][ T481] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.788014][ T481] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.811651][ T1356] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.861009][ T1356] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.941353][ T1356] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.960285][ T1356] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.029746][ T481] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.029769][ T481] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.739399][ T1122] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.739421][ T1122] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.431827][ T1477] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.431849][ T1477] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.536619][ T5760] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 112.749698][ T1494] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.749722][ T1494] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.946393][ T481] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.946416][ T481] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.749128][ T5756] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 114.783248][ T10] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 114.974896][ T5756] usb 3-1: Using ep0 maxpacket: 8 [ 115.012611][ T5756] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 115.012678][ T5756] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 115.012711][ T5756] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 115.012736][ T5756] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 115.012760][ T5756] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 115.012807][ T5756] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 115.012832][ T5756] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.163003][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 115.163031][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 115.163082][ T10] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 115.163107][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.365226][ T10] usb 1-1: config 0 descriptor?? [ 115.756443][ T10] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 115.756808][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 115.858819][ T5756] usb 3-1: usb_control_msg returned -32 [ 115.858867][ T5756] usbtmc 3-1:16.0: can't read capabilities [ 116.318947][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 116.327924][ T10] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 116.328025][ T10] usb 1-1: media controller created [ 116.393745][ T5801] 9pnet_virtio: no channels available for device syz [ 116.433907][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 116.784167][ T5756] usb 3-1: USB disconnect, device number 2 [ 116.787142][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 116.787281][ T10] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 117.070784][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input5 [ 117.534824][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 117.534852][ T10] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 117.624203][ T5755] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 117.722574][ T10] usb 1-1: USB disconnect, device number 2 [ 117.905050][ T5755] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 117.905103][ T5755] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 117.951993][ T5755] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 117.952016][ T5755] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.952030][ T5755] usb 2-1: Product: syz [ 117.952041][ T5755] usb 2-1: Manufacturer: syz [ 117.952051][ T5755] usb 2-1: SerialNumber: syz [ 117.966100][ T5619] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 117.966480][ T5619] Bluetooth: hci1: Injecting HCI hardware error event [ 117.970541][ T4924] Bluetooth: hci1: hardware error 0x00 [ 117.975493][ T5707] dvb-usb: bulk message failed: -22 (1/0) [ 117.975609][ T5707] dvb-usb: error while querying for an remote control event. [ 118.136974][ T1253] dvb-usb: bulk message failed: -22 (1/0) [ 118.137010][ T1253] dvb-usb: error while querying for an remote control event. [ 118.500153][ T5755] cdc_mbim 2-1:1.0: skipping garbage [ 118.742349][ T5812] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 119.184741][ T0] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI [ 119.184772][ T0] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 119.184805][ T0] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 119.184826][ T0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 119.184837][ T0] RIP: 0010:__schedule+0x4030/0x5550 [ 119.184866][ T0] Code: 24 80 00 00 00 e8 80 97 f2 f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 [ 119.184882][ T0] RSP: 0018:ffffc900001e7c40 EFLAGS: 00010003 [ 119.184909][ T0] RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 [ 119.184923][ T0] RDX: 0000000000000003 RSI: ffffc900001e7dc0 RDI: ffff8880b863c918 [ 119.184937][ T0] RBP: ffffc900001e7e30 R08: ffffffff8fcf38f7 R09: 1ffffffff1f9e71e [ 119.184952][ T0] R10: dffffc0000000000 R11: ffffffff8199feb0 R12: ffff8880b873c658 [ 119.184966][ T0] R13: ffff888125b6b000 R14: 1ffff110170e7922 R15: 0000000000000014 [ 119.184978][ T0] FS: 0000000000000000(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000 [ 119.184992][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 119.185003][ T0] CR2: 0000200000097030 CR3: 0000000041f42000 CR4: 00000000003526f0 [ 119.185018][ T0] Call Trace: [ 119.185028][ T0] [ 119.185043][ T0] ? irqentry_exit+0x1c1/0x8c0 [ 119.185067][ T0] ? __pfx___schedule+0x10/0x10 [ 119.185084][ T0] ? lockdep_hardirqs_on+0x7a/0x110 [ 119.185108][ T0] ? tick_nohz_idle_exit+0x2a6/0x370 [ 119.185132][ T0] schedule_idle+0x51/0x90 [ 119.185150][ T0] do_idle+0x4a6/0x540 [ 119.185174][ T0] ? __pfx_do_idle+0x10/0x10 [ 119.185197][ T0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 119.185219][ T0] cpu_startup_entry+0x43/0x60 [ 119.185243][ T0] start_secondary+0x101/0x110 [ 119.185263][ T0] common_startup_64+0x13e/0x157 [ 119.185295][ T0] [ 119.185300][ T0] Modules linked in: [ 119.185315][ T0] ---[ end trace 0000000000000000 ]--- [ 119.185331][ T0] RIP: 0010:__schedule+0x4030/0x5550 [ 119.185349][ T0] Code: 24 80 00 00 00 e8 80 97 f2 f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 [ 119.185363][ T0] RSP: 0018:ffffc900001e7c40 EFLAGS: 00010003 [ 119.185376][ T0] RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 [ 119.185387][ T0] RDX: 0000000000000003 RSI: ffffc900001e7dc0 RDI: ffff8880b863c918 [ 119.185398][ T0] RBP: ffffc900001e7e30 R08: ffffffff8fcf38f7 R09: 1ffffffff1f9e71e [ 119.185411][ T0] R10: dffffc0000000000 R11: ffffffff8199feb0 R12: ffff8880b873c658 [ 119.185423][ T0] R13: ffff888125b6b000 R14: 1ffff110170e7922 R15: 0000000000000014 [ 119.185435][ T0] FS: 0000000000000000(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000 [ 119.185448][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 119.185459][ T0] CR2: 0000200000097030 CR3: 0000000041f42000 CR4: 00000000003526f0 [ 119.185475][ T0] Kernel panic - not syncing: Fatal exception [ 120.298206][ T0] Shutting down cpus with NMI [ 120.298855][ T0] Kernel Offset: disabled