last executing test programs: 46.963698221s ago: executing program 3 (id=226): r0 = socket(0x2, 0x805, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e20, @rand_addr=0x64010102}]}, &(0x7f00000007c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00000000c0)={r1}, &(0x7f0000000080)=0x8) 46.452231413s ago: executing program 3 (id=231): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$l2tp(0x2, 0x2, 0x73) r2 = dup3(r1, r0, 0x80000) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f0000000000)=0xd, 0x4) 46.130918301s ago: executing program 3 (id=233): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'bond0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r1}, @IFLA_HSR_SLAVE2={0x8, 0x2, r2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) 45.612312324s ago: executing program 3 (id=239): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84000, 0x0) 45.144876155s ago: executing program 3 (id=243): prlimit64(0x0, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f000093d000/0x2000)=nil, 0x2000, 0x2, &(0x7f0000000080)=0x9, 0x8, 0x0) get_mempolicy(0x0, 0x0, 0x3, &(0x7f000093d000/0x2000)=nil, 0x3) 42.831266529s ago: executing program 3 (id=260): capset(&(0x7f00000003c0)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x0, 0x4, 0x6, 0x40}) r0 = socket$inet6(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000640)={@remote, @loopback, @private1={0xfc, 0x1, '\x00', 0x1}, 0xffffffff, 0x40, 0x93, 0x100, 0x135d0a3, 0xbb002f}) 42.045523328s ago: executing program 32 (id=260): capset(&(0x7f00000003c0)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x0, 0x4, 0x6, 0x40}) r0 = socket$inet6(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000640)={@remote, @loopback, @private1={0xfc, 0x1, '\x00', 0x1}, 0xffffffff, 0x40, 0x93, 0x100, 0x135d0a3, 0xbb002f}) 9.422045666s ago: executing program 0 (id=467): capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0xe, 0x13e, 0x89, 0xffffffff, 0x2}) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) syz_usb_connect$midi(0x5, 0x68, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) 8.551663289s ago: executing program 0 (id=476): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002680)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)="18", 0x1}], 0x1}}], 0x1, 0x4010) shutdown(r0, 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000240)={0x5, 0x2, 0x5, 0x1b}, 0x10) 7.884565538s ago: executing program 0 (id=482): r0 = socket(0x2, 0x3, 0xff) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) sendmmsg$unix(r0, &(0x7f0000000b40)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000300)="6a681367d81cc4642a7e4ecb36cf0b80b5ffcc298f16a0b67969b30af1f3c0a3f290399da8cd007b", 0x28}], 0x1, &(0x7f0000000ac0)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40, 0x4004}}], 0x1, 0x20000000) 7.342732928s ago: executing program 0 (id=485): mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x3a) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x2000000, &(0x7f0000000100)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2b00b8, 0x0) 6.635013941s ago: executing program 0 (id=487): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000080)="00012c615bc20000") syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) 3.656106621s ago: executing program 2 (id=501): sched_setscheduler(0x0, 0x5, &(0x7f0000000200)) ioprio_set$uid(0x3, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) read(r0, 0x0, 0x0) 3.257994344s ago: executing program 2 (id=505): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000080)={0xe0003, 0x0, {[0xffffffffffffffff, 0x1f8, 0x83, 0xffffffffefffff15, 0x3, 0x4, 0x4, 0x4]}}) 2.797951459s ago: executing program 2 (id=511): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x20}, 0xc) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x5, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 2.564390203s ago: executing program 5 (id=514): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="12000000040000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000380)={r1, &(0x7f0000000180), &(0x7f00000002c0)=""/187}, 0x20) 2.474494539s ago: executing program 2 (id=515): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/ipc\x00') mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) 2.201591546s ago: executing program 5 (id=517): keyctl$restrict_keyring(0xa, 0x0, 0x0, &(0x7f0000000000)='id:cb2e') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') 2.031371026s ago: executing program 4 (id=518): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x14e174135c0b86de) setresuid(0x0, 0xee00, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x4, 0x21fffc, 0x1000, 0x0, 0x2, 0x5}) setxattr$incfs_size(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100), 0x0, 0x0, 0x3) 1.932869636s ago: executing program 1 (id=519): r0 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x1c0002, 0x0) write$vga_arbiter(r0, &(0x7f0000000000)=@other={'unlock', ' ', 'mem'}, 0xb) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6410, 0x0, 0x48, 0x0, &(0x7f0000000000)='\x00', 0x0}, 0x48) 1.857499922s ago: executing program 2 (id=520): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0xb024, 0x4) connect$inet6(r0, &(0x7f0000002140)={0xa, 0x4e25, 0x1, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000011c0)="d3f04bb4604aed32226e529c8812223fc4797c733f8176720c3ad91b943b1ad6f8027b3cc582e5502433b313659a57fa991300b16a4529482443b67e8a41483837b5f9f422cb9d69b64f69b4bb9d3fdc2907e8201322498ed0448ce67f43a68a92938a420012241f6712e9dc52e38a6aed925779287435d8441c3f33760552e488dc42bcadd66a5e1643c45095a0aaae13af", 0x4880}], 0x1}, 0x7101}], 0x1, 0x4001c00) 1.809683848s ago: executing program 5 (id=521): ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, 0x0) unshare(0x2a020480) r0 = socket(0x22, 0x2, 0x3) getsockopt$packet_buf(r0, 0x107, 0x1, 0x0, 0x0) 1.778822598s ago: executing program 4 (id=522): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r1, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000a40)={0x48, 0x7, r2, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x1003}) 1.735540545s ago: executing program 1 (id=523): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&\x00\x00\x00\a'], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 1.604865778s ago: executing program 2 (id=524): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x0) 1.481500708s ago: executing program 5 (id=525): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000000)={0x1d, r2, 0x2, {0x0, 0xf0, 0x3}, 0x2}, 0x18) 1.433363373s ago: executing program 4 (id=526): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1f, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) 1.339347646s ago: executing program 1 (id=527): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) 1.165609847s ago: executing program 5 (id=528): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEL_KEY(r0, 0x0, 0x1) syz_genetlink_get_family_id$tipc2(0x0, r0) ioctl$FS_IOC_GETFSUUID(r0, 0x80111500, 0x0) 1.011900607s ago: executing program 0 (id=529): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) connect$bt_l2cap(r0, 0x0, 0x0) 962.522077ms ago: executing program 1 (id=530): r0 = socket$inet6(0xa, 0x2, 0x3a) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, 0x0, 0x0) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="a0"], 0xffd8}}, 0x4000000) 725.465193ms ago: executing program 1 (id=531): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$igmp6(0xa, 0x3, 0x2) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') preadv(r0, &(0x7f0000000180)=[{&(0x7f0000000200)=""/241, 0xf1}], 0x1, 0xe5cb, 0x0) 611.580221ms ago: executing program 4 (id=532): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0xc, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000380)=r0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, 0x0, 0x0}, 0x20) 179.555218ms ago: executing program 1 (id=533): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7200000000003900000008000300", @ANYRES32=r2, @ANYBLOB="14005a8005002d"], 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 169.339757ms ago: executing program 5 (id=534): r0 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r0, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'M'], 0x86) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card2/oss_mixer\x00', 0x0, 0x0) dup3(r1, r0, 0x0) 168.697574ms ago: executing program 4 (id=535): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) 0s ago: executing program 4 (id=536): syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/pid_for_children\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/vlan/vlan1\x00') readlinkat(r0, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.174' (ED25519) to the list of known hosts. [ 96.218743][ T5802] cgroup: Unknown subsys name 'net' [ 96.459461][ T5802] cgroup: Unknown subsys name 'cpuset' [ 96.533273][ T5802] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 97.516798][ T36] cfg80211: failed to load regulatory.db [ 98.613293][ T5802] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 101.408364][ T5823] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 101.427866][ T59] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 101.456661][ T59] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 101.494107][ T5825] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 101.511909][ T5827] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 101.531290][ T5827] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 101.551788][ T5828] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 101.554771][ T5827] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 101.571174][ T5827] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 101.571930][ T5832] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 101.577873][ T5832] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 101.590585][ T5828] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 101.590992][ T5828] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 101.627214][ T5827] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 101.629962][ T5827] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 101.630798][ T5828] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 101.664230][ T5827] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 101.679980][ T5827] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 101.690079][ T5827] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 101.704345][ T5827] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 101.891470][ T5827] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 101.921006][ T5827] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 101.924595][ T5827] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 101.933867][ T5827] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 101.947665][ T5827] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 103.137935][ T5819] chnl_net:caif_netlink_parms(): no params data found [ 103.207744][ T5818] chnl_net:caif_netlink_parms(): no params data found [ 103.227025][ T5817] chnl_net:caif_netlink_parms(): no params data found [ 103.335799][ T5815] chnl_net:caif_netlink_parms(): no params data found [ 103.368228][ T5816] chnl_net:caif_netlink_parms(): no params data found [ 103.657500][ T5819] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.658798][ T5819] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.658983][ T5819] bridge_slave_0: entered allmulticast mode [ 103.661028][ T5819] bridge_slave_0: entered promiscuous mode [ 103.751404][ T5819] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.751492][ T5819] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.751653][ T5819] bridge_slave_1: entered allmulticast mode [ 103.765497][ T5819] bridge_slave_1: entered promiscuous mode [ 103.790822][ T5818] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.790977][ T5818] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.791395][ T5818] bridge_slave_0: entered allmulticast mode [ 103.798512][ T5818] bridge_slave_0: entered promiscuous mode [ 103.819514][ T5817] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.819887][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.820476][ T5817] bridge_slave_0: entered allmulticast mode [ 103.828875][ T5817] bridge_slave_0: entered promiscuous mode [ 103.884051][ T5827] Bluetooth: hci3: command tx timeout [ 103.884919][ T5827] Bluetooth: hci4: command tx timeout [ 103.885993][ T5825] Bluetooth: hci0: command tx timeout [ 103.909986][ T5818] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.910114][ T5818] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.910282][ T5818] bridge_slave_1: entered allmulticast mode [ 103.912161][ T5818] bridge_slave_1: entered promiscuous mode [ 103.945578][ T5817] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.945716][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.945856][ T5817] bridge_slave_1: entered allmulticast mode [ 103.947927][ T5817] bridge_slave_1: entered promiscuous mode [ 103.963307][ T5825] Bluetooth: hci2: command tx timeout [ 104.042644][ T5825] Bluetooth: hci1: command tx timeout [ 104.072320][ T5815] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.072460][ T5815] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.078871][ T5815] bridge_slave_0: entered allmulticast mode [ 104.088235][ T5815] bridge_slave_0: entered promiscuous mode [ 104.109383][ T5819] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.112190][ T5816] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.112420][ T5816] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.114480][ T5816] bridge_slave_0: entered allmulticast mode [ 104.147068][ T5816] bridge_slave_0: entered promiscuous mode [ 104.190295][ T5815] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.190410][ T5815] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.190804][ T5815] bridge_slave_1: entered allmulticast mode [ 104.200277][ T5815] bridge_slave_1: entered promiscuous mode [ 104.228424][ T5819] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.228701][ T5816] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.228822][ T5816] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.229002][ T5816] bridge_slave_1: entered allmulticast mode [ 104.232128][ T5816] bridge_slave_1: entered promiscuous mode [ 104.277993][ T5818] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.281895][ T5817] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.370908][ T5818] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.386882][ T5817] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.485660][ T5815] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.488823][ T5819] team0: Port device team_slave_0 added [ 104.497633][ T5816] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.554237][ T5815] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.556345][ T5819] team0: Port device team_slave_1 added [ 104.558857][ T5816] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.560914][ T5818] team0: Port device team_slave_0 added [ 104.567239][ T5817] team0: Port device team_slave_0 added [ 104.646250][ T5818] team0: Port device team_slave_1 added [ 104.648284][ T5817] team0: Port device team_slave_1 added [ 104.743294][ T5815] team0: Port device team_slave_0 added [ 104.745464][ T5819] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.745478][ T5819] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.745498][ T5819] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.749126][ T5816] team0: Port device team_slave_0 added [ 104.830863][ T5815] team0: Port device team_slave_1 added [ 104.831674][ T5819] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.831685][ T5819] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.831706][ T5819] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.854199][ T5816] team0: Port device team_slave_1 added [ 104.857935][ T5818] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.857950][ T5818] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.857978][ T5818] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.957738][ T5817] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.957756][ T5817] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.957785][ T5817] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.049038][ T5818] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.049052][ T5818] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.049072][ T5818] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.051116][ T5817] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.051134][ T5817] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.051167][ T5817] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.174009][ T5815] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.174027][ T5815] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.174073][ T5815] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.534808][ T5816] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.534821][ T5816] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.534842][ T5816] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.540135][ T5815] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.540148][ T5815] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.540169][ T5815] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.541278][ T5816] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.541289][ T5816] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.541310][ T5816] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.764713][ T5819] hsr_slave_0: entered promiscuous mode [ 105.765828][ T5819] hsr_slave_1: entered promiscuous mode [ 105.835126][ T5818] hsr_slave_0: entered promiscuous mode [ 105.836107][ T5818] hsr_slave_1: entered promiscuous mode [ 105.836904][ T5818] debugfs: 'hsr0' already exists in 'hsr' [ 105.836983][ T5818] Cannot create hsr debugfs directory [ 105.852133][ T5817] hsr_slave_0: entered promiscuous mode [ 105.858134][ T5817] hsr_slave_1: entered promiscuous mode [ 105.860902][ T5817] debugfs: 'hsr0' already exists in 'hsr' [ 105.860971][ T5817] Cannot create hsr debugfs directory [ 105.962909][ T5827] Bluetooth: hci3: command tx timeout [ 105.962920][ T5832] Bluetooth: hci4: command tx timeout [ 105.963007][ T5825] Bluetooth: hci0: command tx timeout [ 105.990865][ T5815] hsr_slave_0: entered promiscuous mode [ 105.991926][ T5815] hsr_slave_1: entered promiscuous mode [ 106.004806][ T5815] debugfs: 'hsr0' already exists in 'hsr' [ 106.004831][ T5815] Cannot create hsr debugfs directory [ 106.011918][ T5816] hsr_slave_0: entered promiscuous mode [ 106.030626][ T5816] hsr_slave_1: entered promiscuous mode [ 106.031402][ T5816] debugfs: 'hsr0' already exists in 'hsr' [ 106.031420][ T5816] Cannot create hsr debugfs directory [ 106.044374][ T5825] Bluetooth: hci2: command tx timeout [ 106.122750][ T5825] Bluetooth: hci1: command tx timeout [ 107.168842][ T5819] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 107.212044][ T5819] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.222177][ T5819] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 107.251453][ T5819] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.256642][ T5819] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 107.307909][ T5819] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.347153][ T5819] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 107.369569][ T5819] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.540621][ T5817] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 107.570475][ T5817] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.587014][ T5817] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 107.618923][ T5817] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.658254][ T5817] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 107.698704][ T5817] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.730833][ T5817] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 107.757018][ T5817] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.927311][ T5818] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 107.957510][ T5818] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.969056][ T5818] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 108.017430][ T5818] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 108.024653][ T5818] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 108.042755][ T5825] Bluetooth: hci4: command tx timeout [ 108.042792][ T5825] Bluetooth: hci0: command tx timeout [ 108.042813][ T5825] Bluetooth: hci3: command tx timeout [ 108.086184][ T5818] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 108.123361][ T5825] Bluetooth: hci2: command tx timeout [ 108.127411][ T5818] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 108.156880][ T5818] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 108.202724][ T5825] Bluetooth: hci1: command tx timeout [ 108.370377][ T5815] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 108.396561][ T5815] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 108.414210][ T5815] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 108.439688][ T5815] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 108.470899][ T5815] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 108.521113][ T5815] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 108.561338][ T5815] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 108.590523][ T5815] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 108.701884][ T5819] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.776364][ T5816] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 108.816041][ T5816] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 108.832333][ T5816] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 108.887518][ T5816] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 108.891491][ T5816] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 108.916587][ T5816] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 108.941213][ T5816] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 108.978489][ T5816] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 109.019504][ T5819] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.060006][ T5817] 8021q: adding VLAN 0 to HW filter on device bond0 [ 109.097151][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.097330][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.215795][ T100] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.215935][ T100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.289915][ T5817] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.361594][ T100] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.361839][ T100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.405488][ T5818] 8021q: adding VLAN 0 to HW filter on device bond0 [ 109.433778][ T1038] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.433904][ T1038] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.559292][ T5818] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.603061][ T5815] 8021q: adding VLAN 0 to HW filter on device bond0 [ 109.634650][ T1038] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.634837][ T1038] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.784423][ T1038] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.789517][ T1038] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.911862][ T5815] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.985922][ T5816] 8021q: adding VLAN 0 to HW filter on device bond0 [ 110.017423][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.017574][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.098317][ T100] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.098537][ T100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.132946][ T5825] Bluetooth: hci4: command tx timeout [ 110.132978][ T5825] Bluetooth: hci3: command tx timeout [ 110.132996][ T5825] Bluetooth: hci0: command tx timeout [ 110.202704][ T5827] Bluetooth: hci2: command tx timeout [ 110.238517][ T5816] 8021q: adding VLAN 0 to HW filter on device team0 [ 110.283742][ T5827] Bluetooth: hci1: command tx timeout [ 110.319306][ T1125] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.319456][ T1125] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.380188][ T5819] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.428230][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.430525][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.805964][ T5817] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.089372][ T5818] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.269329][ T5817] veth0_vlan: entered promiscuous mode [ 111.326726][ T5815] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.375134][ T5817] veth1_vlan: entered promiscuous mode [ 111.509882][ T5818] veth0_vlan: entered promiscuous mode [ 111.566197][ T5818] veth1_vlan: entered promiscuous mode [ 111.621433][ T5816] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.640060][ T5817] veth0_macvtap: entered promiscuous mode [ 111.688276][ T5815] veth0_vlan: entered promiscuous mode [ 111.690681][ T5817] veth1_macvtap: entered promiscuous mode [ 111.751590][ T5819] veth0_vlan: entered promiscuous mode [ 111.771987][ T5815] veth1_vlan: entered promiscuous mode [ 111.830483][ T5818] veth0_macvtap: entered promiscuous mode [ 111.847128][ T5817] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.847862][ T5819] veth1_vlan: entered promiscuous mode [ 111.881190][ T5818] veth1_macvtap: entered promiscuous mode [ 111.917783][ T5817] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.979938][ T1038] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.998589][ T1038] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.022306][ T1038] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.049555][ T1038] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.052318][ T5816] veth0_vlan: entered promiscuous mode [ 112.079773][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.188687][ T5815] veth0_macvtap: entered promiscuous mode [ 112.206748][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.310448][ T5816] veth1_vlan: entered promiscuous mode [ 112.319581][ T5815] veth1_macvtap: entered promiscuous mode [ 112.429172][ T1038] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.445710][ T5819] veth0_macvtap: entered promiscuous mode [ 112.471997][ T1038] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.529698][ T1038] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.581291][ T1038] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.611078][ T5819] veth1_macvtap: entered promiscuous mode [ 112.777105][ T5815] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.832447][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.849996][ T5815] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.852252][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.033461][ T5819] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 113.068616][ T100] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.106197][ T100] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.109080][ T5819] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 113.109461][ T100] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.109986][ T5816] veth0_macvtap: entered promiscuous mode [ 113.156200][ T100] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.217262][ T5816] veth1_macvtap: entered promiscuous mode [ 113.241399][ T1038] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.241422][ T1038] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.357515][ T100] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.467713][ T100] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.560069][ T100] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.620860][ T100] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.625804][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.625827][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.014767][ T5816] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.180856][ T5816] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.380267][ T1462] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.380291][ T1462] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.460257][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.482799][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.519064][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.520716][ T1125] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.520736][ T1125] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.560844][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.834868][ T1038] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.834893][ T1038] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.207150][ T1462] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.207173][ T1462] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.688786][ T3603] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.688809][ T3603] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.137036][ T1462] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.137063][ T1462] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.735105][ T3603] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.735128][ T3603] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.278871][ T5964] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 119.979853][ T5200] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 120.374143][ T5200] usb 2-1: Using ep0 maxpacket: 16 [ 120.446920][ T5200] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 120.446966][ T5200] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 120.446989][ T5200] usb 2-1: config 0 interface 0 has no altsetting 0 [ 120.447029][ T5200] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 120.447050][ T5200] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.116225][ T5200] usb 2-1: config 0 descriptor?? [ 121.855560][ T6003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.924812][ T6003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 122.016274][ T5200] hid (null): nested delimiters [ 122.607473][ T5200] usb 2-1: USB disconnect, device number 2 [ 124.811731][ T6040] netlink: 40 bytes leftover after parsing attributes in process `syz.3.39'. [ 124.935155][ T6043] input: syz1 as /devices/virtual/input/input5 [ 125.532655][ T6053] Illegal XDP return value 4294967274 on prog (id 3) dev N/A, expect packet loss! [ 125.620831][ T6055] warning: `syz.2.45' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 125.836044][ T6057] vcan0: tx address claim with dlc 0 [ 126.563640][ T6069] dvmrp1: entered allmulticast mode [ 127.124620][ T6059] syz.4.46 (6059) used greatest stack depth: 19032 bytes left [ 128.646700][ T6104] netlink: 20 bytes leftover after parsing attributes in process `syz.3.66'. [ 128.860696][ T6101] bond1: entered promiscuous mode [ 129.054503][ T6109] netlink: 64 bytes leftover after parsing attributes in process `syz.0.67'. [ 129.916049][ T6130] netlink: 27 bytes leftover after parsing attributes in process `syz.2.77'. [ 130.172108][ T5905] IPVS: starting estimator thread 0... [ 130.492915][ T6136] IPVS: using max 9 ests per chain, 21600 per kthread [ 131.989064][ T6189] netlink: 12 bytes leftover after parsing attributes in process `syz.2.100'. [ 132.007000][ T6183] misc userio: Can't change port type on an already running userio instance [ 132.196809][ T6193] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 132.436985][ T6201] sch_fq: defrate 5 ignored. [ 133.008885][ T6217] process 'syz.4.113' launched './file0' with NULL argv: empty string added [ 133.691881][ T6233] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 134.030415][ T6243] capability: warning: `syz.4.124' uses deprecated v2 capabilities in a way that may be insecure [ 134.229505][ T6246] netlink: 36 bytes leftover after parsing attributes in process `syz.2.127'. [ 134.550864][ T6258] netlink: 'syz.1.131': attribute type 1 has an invalid length. [ 134.551056][ T6258] netlink: 44 bytes leftover after parsing attributes in process `syz.1.131'. [ 134.551231][ T6258] Zero length message leads to an empty skb [ 135.014535][ T5821] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 135.232662][ T5821] usb 5-1: Using ep0 maxpacket: 32 [ 135.345145][ T5821] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 135.345179][ T5821] usb 5-1: config 0 has no interface number 0 [ 135.345225][ T5821] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 135.345256][ T5821] usb 5-1: config 0 interface 85 has no altsetting 0 [ 135.351751][ T5821] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 135.351784][ T5821] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.351806][ T5821] usb 5-1: Product: syz [ 135.351822][ T5821] usb 5-1: Manufacturer: syz [ 135.351838][ T5821] usb 5-1: SerialNumber: syz [ 135.580522][ T5821] usb 5-1: config 0 descriptor?? [ 136.146213][ T6297] netlink: 'syz.1.146': attribute type 10 has an invalid length. [ 136.266469][ T5821] appletouch 5-1:0.85: Geyser mode initialized. [ 136.303768][ T5821] input: appletouch as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.85/input/input7 [ 136.492271][ T6300] program syz.0.147 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 136.871109][ T6297] team0 (unregistering): Port device team_slave_0 removed [ 136.926888][ T6297] team0 (unregistering): Port device team_slave_1 removed [ 137.139768][ C1] appletouch 5-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 137.318982][ T5821] usb 5-1: USB disconnect, device number 2 [ 137.499368][ T6314] netlink: 12 bytes leftover after parsing attributes in process `syz.3.150'. [ 138.140906][ T6328] netlink: 'syz.4.158': attribute type 1 has an invalid length. [ 138.140933][ T6328] netlink: 2704 bytes leftover after parsing attributes in process `syz.4.158'. [ 138.176026][ T5821] appletouch 5-1:0.85: input: appletouch disconnected [ 138.330207][ T6334] veth0_vlan: entered allmulticast mode [ 138.330746][ T6334] veth0_vlan: left allmulticast mode [ 138.466710][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.481835][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.930764][ T6351] netlink: 8 bytes leftover after parsing attributes in process `syz.3.166'. [ 138.930807][ T6351] netlink: 4 bytes leftover after parsing attributes in process `syz.3.166'. [ 139.803704][ T6367] netlink: 8 bytes leftover after parsing attributes in process `syz.1.173'. [ 140.562009][ T6382] netlink: 'syz.1.179': attribute type 6 has an invalid length. [ 141.654335][ T6024] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 141.820040][ T6024] usb 3-1: config 8 has an invalid interface number: 177 but max is 0 [ 141.820072][ T6024] usb 3-1: config 8 has no interface number 0 [ 141.820118][ T6024] usb 3-1: config 8 interface 177 altsetting 9 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 141.820166][ T6024] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x88 has invalid maxpacket 1023, setting to 64 [ 141.820196][ T6024] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 141.820220][ T6024] usb 3-1: config 8 interface 177 has no altsetting 0 [ 141.820253][ T6024] usb 3-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 141.820277][ T6024] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.076018][ T6402] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 142.473179][ T6024] usb 3-1: string descriptor 0 read error: -71 [ 142.496661][ T5905] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 142.514106][ T6024] ir_toy 3-1:8.177: required endpoints not found [ 142.600190][ T6024] usb 3-1: USB disconnect, device number 2 [ 142.672998][ T5905] usb 2-1: Using ep0 maxpacket: 8 [ 142.675941][ T5905] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 142.675972][ T5905] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 142.675998][ T5905] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 142.676024][ T5905] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 142.676069][ T5905] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 142.676094][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.210710][ T5905] usb 2-1: GET_CAPABILITIES returned 0 [ 143.210765][ T5905] usbtmc 2-1:16.0: can't read capabilities [ 143.482869][ T5833] usb 2-1: USB disconnect, device number 3 [ 144.392666][ T6024] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 144.585131][ T6024] usb 4-1: Using ep0 maxpacket: 32 [ 144.590780][ T6024] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 144.590813][ T6024] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.676948][ T6024] usb 4-1: config 0 descriptor?? [ 144.941015][ T6024] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 145.143402][ T5821] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 145.337112][ T6024] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 145.338750][ T6024] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 145.338845][ T6024] usb 4-1: media controller created [ 145.611008][ T6024] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 145.637248][ T5821] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 145.916051][ T6462] fido_id[6462]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 146.201796][ T6024] az6027: usb out operation failed. (-71) [ 146.204874][ T6024] az6027: usb out operation failed. (-71) [ 146.204893][ T6024] stb0899_attach: Driver disabled by Kconfig [ 146.204902][ T6024] az6027: no front-end attached [ 146.204902][ T6024] [ 146.252137][ T6024] az6027: usb out operation failed. (-71) [ 146.252156][ T6024] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 146.422102][ T6024] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input8 [ 146.486816][ T6024] dvb-usb: schedule remote query interval to 400 msecs. [ 146.486834][ T6024] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 146.628884][ T6024] usb 4-1: USB disconnect, device number 2 [ 146.641520][ T6477] capability: warning: `syz.3.217' uses 32-bit capabilities (legacy support in use) [ 146.659838][ T6477] program syz.3.217 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 147.826418][ T6024] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 148.633178][ T6520] bond0: entered promiscuous mode [ 148.633203][ T6520] bond_slave_0: entered promiscuous mode [ 148.633448][ T6520] bond_slave_1: entered promiscuous mode [ 148.663287][ T6520] batadv0: entered promiscuous mode [ 148.689646][ T6520] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 148.711907][ T6526] netlink: 16 bytes leftover after parsing attributes in process `syz.4.236'. [ 148.990376][ T6530] ======================================================= [ 148.990376][ T6530] WARNING: The mand mount option has been deprecated and [ 148.990376][ T6530] and is ignored by this kernel. Remove the mand [ 148.990376][ T6530] option from the mount to silence this warning. [ 148.990376][ T6530] ======================================================= [ 152.793725][ T3603] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.010521][ T5825] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 153.069350][ T5825] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 153.071454][ T5825] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 153.108143][ T5825] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 153.142902][ T5825] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 154.483209][ T3603] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.242654][ T5825] Bluetooth: hci0: command tx timeout [ 155.273348][ T3603] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.886488][ T3603] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 156.798050][ T6591] chnl_net:caif_netlink_parms(): no params data found [ 157.323768][ T5825] Bluetooth: hci0: command tx timeout [ 157.866630][ T6591] bridge0: port 1(bridge_slave_0) entered blocking state [ 157.866743][ T6591] bridge0: port 1(bridge_slave_0) entered disabled state [ 157.866979][ T6591] bridge_slave_0: entered allmulticast mode [ 157.900600][ T6591] bridge_slave_0: entered promiscuous mode [ 157.935973][ T6670] overlayfs: workdir and upperdir must reside under the same mount [ 157.971401][ T6591] bridge0: port 2(bridge_slave_1) entered blocking state [ 157.971530][ T6591] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.971778][ T6591] bridge_slave_1: entered allmulticast mode [ 158.009817][ T6591] bridge_slave_1: entered promiscuous mode [ 159.272096][ T6591] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 159.402802][ T5825] Bluetooth: hci0: command tx timeout [ 159.538575][ T6705] program syz.0.311 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 159.585497][ T6591] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 160.018361][ T6713] batman_adv: batadv0: Adding interface: ipvlan2 [ 160.018381][ T6713] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 160.018415][ T6713] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 160.018434][ T6713] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.018445][ T6713] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active [ 160.204464][ T6591] team0: Port device team_slave_0 added [ 160.592154][ T6731] netlink: 120 bytes leftover after parsing attributes in process `syz.2.325'. [ 160.592193][ T6731] netlink: 'syz.2.325': attribute type 1 has an invalid length. [ 160.592207][ T6731] netlink: 64 bytes leftover after parsing attributes in process `syz.2.325'. [ 160.800457][ T3603] bridge_slave_1: left allmulticast mode [ 160.800724][ T3603] bridge_slave_1: left promiscuous mode [ 160.837285][ T3603] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.928735][ T6742] netlink: 8 bytes leftover after parsing attributes in process `syz.1.327'. [ 160.999184][ T3603] bridge_slave_0: left allmulticast mode [ 160.999217][ T3603] bridge_slave_0: left promiscuous mode [ 160.999465][ T3603] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.168457][ T3603] dvmrp1: left allmulticast mode [ 161.485729][ T5825] Bluetooth: hci0: command tx timeout [ 162.272765][ T3603] bond0 (unregistering): left promiscuous mode [ 162.272792][ T3603] bond_slave_0: left promiscuous mode [ 162.273133][ T3603] bond_slave_1: left promiscuous mode [ 162.323616][ T3603] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 162.424723][ T3603] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 162.454509][ T3603] bond0 (unregistering): Released all slaves [ 162.475295][ T3603] bond1 (unregistering): Released all slaves [ 162.535016][ T6591] team0: Port device team_slave_1 added [ 162.971075][ T6591] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 162.971093][ T6591] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 162.971122][ T6591] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 163.113398][ T6591] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 163.113417][ T6591] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 163.113445][ T6591] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 163.310701][ T6758] can: request_module (can-proto-5) failed. [ 164.279742][ T6791] vxcan0: tx drop: invalid sa for name 0x0000000000000001 [ 164.838236][ T6591] hsr_slave_0: entered promiscuous mode [ 164.839832][ T6591] hsr_slave_1: entered promiscuous mode [ 164.840859][ T6591] debugfs: 'hsr0' already exists in 'hsr' [ 164.840900][ T6591] Cannot create hsr debugfs directory [ 166.023692][ T6825] input: syz1 as /devices/virtual/input/input9 [ 166.085675][ T6830] Bluetooth: MGMT ver 1.23 [ 166.644582][ T5905] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 166.822607][ T5905] usb 2-1: Using ep0 maxpacket: 16 [ 166.867956][ T5905] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.867994][ T5905] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 166.868037][ T5905] usb 2-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 166.868062][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.946471][ T6850] program syz.4.368 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 167.076179][ T5905] usb 2-1: config 0 descriptor?? [ 167.530766][ T3603] batadv0: left promiscuous mode [ 167.653196][ T5905] ntrig 0003:1B96:0008.0003: item fetching failed at offset 5/7 [ 167.656680][ T5905] ntrig 0003:1B96:0008.0003: parse failed [ 167.656793][ T5905] ntrig 0003:1B96:0008.0003: probe with driver ntrig failed with error -22 [ 167.673683][ T10] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 167.820927][ T5905] usb 2-1: USB disconnect, device number 4 [ 167.829294][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 167.857899][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 167.857967][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 167.858035][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 167.858068][ T10] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 167.858097][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 167.861649][ T10] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 167.861685][ T10] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 167.861709][ T10] usb 5-1: Manufacturer: syz [ 168.037635][ T3603] hsr_slave_0: left promiscuous mode [ 168.078556][ T3603] hsr_slave_1: left promiscuous mode [ 168.116365][ T10] usb 5-1: config 0 descriptor?? [ 168.153086][ T3603] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 168.153361][ T3603] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 168.218266][ T3603] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 168.218298][ T3603] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 168.455262][ T10] rc_core: IR keymap rc-hauppauge not found [ 168.455281][ T10] Registered IR keymap rc-empty [ 168.456684][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.474541][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.533853][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 168.564159][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input11 [ 168.572296][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.612742][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.633922][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.652673][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.672908][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.693159][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.712678][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.742672][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.766719][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.782827][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.794804][ T3603] veth1_macvtap: left promiscuous mode [ 168.806983][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 168.870661][ T10] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 168.870690][ T10] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 168.870978][ T3603] veth0_macvtap: left promiscuous mode [ 168.915144][ T3603] veth1_vlan: left promiscuous mode [ 168.937156][ T10] usb 5-1: USB disconnect, device number 3 [ 168.983051][ T3603] veth0_vlan: left promiscuous mode [ 169.103049][ T5904] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 169.272578][ T5904] usb 2-1: Using ep0 maxpacket: 16 [ 169.290878][ T5904] usb 2-1: config index 0 descriptor too short (expected 51443, got 18) [ 169.315639][ T5904] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 169.315673][ T5904] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.315696][ T5904] usb 2-1: Product: syz [ 169.315713][ T5904] usb 2-1: Manufacturer: syz [ 169.315729][ T5904] usb 2-1: SerialNumber: syz [ 169.453415][ T5904] r8152-cfgselector 2-1: Unknown version 0x0000 [ 169.453444][ T5904] r8152-cfgselector 2-1: config 0 descriptor?? [ 169.728419][ T6880] netlink: 36 bytes leftover after parsing attributes in process `syz.2.380'. [ 169.942757][ T5905] r8152-cfgselector 2-1: USB disconnect, device number 5 [ 171.496458][ T3603] team0 (unregistering): Port device team_slave_1 removed [ 171.593830][ T3603] team0 (unregistering): Port device team_slave_0 removed [ 172.256125][ T5481] 8021q: adding VLAN 0 to HW filter on device eth1 [ 172.315682][ T6900] bridge0: port 2(bridge_slave_1) entered disabled state [ 172.502663][ T5904] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 172.654996][ T5904] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 172.655030][ T5904] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.704022][ T5904] usb 2-1: config 0 descriptor?? [ 172.741651][ T5904] cp210x 2-1:0.0: cp210x converter detected [ 172.945525][ T6931] netlink: 60 bytes leftover after parsing attributes in process `syz.0.403'. [ 173.154981][ T5904] cp210x 2-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 173.155566][ T5905] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 173.375363][ T5905] usb 3-1: Using ep0 maxpacket: 32 [ 173.377919][ T5905] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 173.377948][ T5905] usb 3-1: config 0 has no interface number 0 [ 173.432911][ T5905] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 173.432948][ T5905] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 173.432969][ T5905] usb 3-1: config 0 interface 85 has no altsetting 0 [ 173.441213][ T5905] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 173.441250][ T5905] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.441275][ T5905] usb 3-1: Product: syz [ 173.441292][ T5905] usb 3-1: Manufacturer: syz [ 173.441309][ T5905] usb 3-1: SerialNumber: syz [ 173.643143][ T5905] usb 3-1: config 0 descriptor?? [ 173.672597][ T5904] usb 2-1: cp210x converter now attached to ttyUSB0 [ 173.741483][ T5904] usb 2-1: USB disconnect, device number 6 [ 174.136714][ T5905] appletouch 3-1:0.85: Geyser mode initialized. [ 174.352728][ T5905] input: appletouch as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.85/input/input12 [ 174.433891][ T10] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 174.599506][ T10] usb 1-1: config 150 has an invalid interface number: 204 but max is 2 [ 174.599535][ T10] usb 1-1: config 150 has 2 interfaces, different from the descriptor's value: 3 [ 174.599556][ T10] usb 1-1: config 150 has no interface number 0 [ 174.599597][ T10] usb 1-1: config 150 interface 204 has no altsetting 0 [ 174.650034][ T10] usb 1-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 174.650067][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.650087][ T10] usb 1-1: Product: syz [ 174.650102][ T10] usb 1-1: Manufacturer: syz [ 174.650116][ T10] usb 1-1: SerialNumber: syz [ 174.692340][ T5904] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 175.100628][ T5905] usb 3-1: USB disconnect, device number 3 [ 175.253318][ T5904] cp210x 2-1:0.0: device disconnected [ 175.313437][ T10] xr_serial 1-1:150.204: skipping garbage [ 175.313490][ T10] xr_serial 1-1:150.204: xr_serial converter detected [ 175.773878][ T5905] appletouch 3-1:0.85: input: appletouch disconnected [ 175.878850][ T10] xr_serial ttyUSB0: Failed to set reg 0x0d: -71 [ 175.878914][ T10] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 176.000751][ T10] usb 1-1: USB disconnect, device number 2 [ 176.049711][ T10] xr_serial 1-1:150.204: device disconnected [ 177.232608][ T5905] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 177.257061][ T6591] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 177.311491][ T6591] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 177.378930][ T6591] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 177.455173][ T5905] usb 2-1: Using ep0 maxpacket: 16 [ 177.510421][ T5905] usb 2-1: config index 0 descriptor too short (expected 52, got 36) [ 177.510455][ T5905] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 177.510476][ T5905] usb 2-1: config 0 has no interface number 0 [ 177.510523][ T5905] usb 2-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 177.510549][ T5905] usb 2-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 177.590338][ T5905] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 177.590372][ T5905] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.590391][ T5905] usb 2-1: Product: syz [ 177.590406][ T5905] usb 2-1: Manufacturer: syz [ 177.590420][ T5905] usb 2-1: SerialNumber: syz [ 177.642782][ T5905] usb 2-1: config 0 descriptor?? [ 177.645240][ T6981] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 177.645371][ T6981] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 177.878152][ T6981] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 177.878286][ T6981] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 178.085893][ T6591] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 178.291328][ T5481] 8021q: adding VLAN 0 to HW filter on device eth2 [ 178.292376][ T6591] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 178.349689][ T5905] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 178.349722][ T5905] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read software interface selection register: -71 [ 178.351411][ T5905] asix 2-1:0.251: probe with driver asix failed with error -71 [ 178.433723][ T7006] netlink: 4 bytes leftover after parsing attributes in process `syz.0.429'. [ 178.702914][ T5905] usb 2-1: USB disconnect, device number 7 [ 178.811342][ T6591] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 178.825087][ T6591] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 178.943723][ T6591] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 179.716391][ T6591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 180.097733][ T6591] 8021q: adding VLAN 0 to HW filter on device team0 [ 180.368117][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.368261][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 180.493528][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.495304][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 181.308174][ T7056] netlink: 36 bytes leftover after parsing attributes in process `syz.0.441'. [ 181.851831][ T9] kernel read not supported for file /vcs (pid: 9 comm: kworker/0:0) [ 181.929477][ T7056] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.063394][ T7056] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.836715][ T5481] 8021q: adding VLAN 0 to HW filter on device eth3 [ 182.975227][ T36] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 183.175903][ T36] usb 5-1: Using ep0 maxpacket: 32 [ 183.178457][ T36] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 183.178493][ T36] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 183.241708][ T36] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 183.241739][ T36] usb 5-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 183.241757][ T36] usb 5-1: Product: syz [ 183.241770][ T36] usb 5-1: Manufacturer: syz [ 183.459662][ T36] hub 5-1:4.0: USB hub found [ 183.571523][ T36] hub 5-1:4.0: config failed, hub doesn't have any ports! (err -19) [ 183.623648][ T6591] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 183.962830][ T36] usb 5-1: USB disconnect, device number 4 [ 184.430992][ T7116] program syz.1.460 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 184.781422][ T7127] netlink: 24 bytes leftover after parsing attributes in process `syz.0.463'. [ 185.431377][ T6591] veth0_vlan: entered promiscuous mode [ 185.621072][ T6591] veth1_vlan: entered promiscuous mode [ 186.005929][ T6591] veth0_macvtap: entered promiscuous mode [ 186.038776][ T6591] veth1_macvtap: entered promiscuous mode [ 186.156557][ T5481] 8021q: adding VLAN 0 to HW filter on device eth4 [ 186.329626][ T6591] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 186.376861][ T6591] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 186.440812][ T1196] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.455016][ T1196] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.482525][ T1462] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.486057][ T1462] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 188.059977][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 188.060001][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 188.337328][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 188.337352][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 188.672649][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 188.900758][ T9] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 188.900790][ T9] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 188.900811][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 188.900861][ T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 188.900895][ T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 188.965216][ T9] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 188.965247][ T9] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 188.965268][ T9] usb 1-1: Product: syz [ 188.965283][ T9] usb 1-1: Manufacturer: syz [ 189.030279][ T7203] syz.1.492 (7203) used greatest stack depth: 18816 bytes left [ 189.113604][ T9] cdc_wdm 1-1:1.0: skipping garbage [ 189.113627][ T9] cdc_wdm 1-1:1.0: skipping garbage [ 189.158325][ T9] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 189.158359][ T9] cdc_wdm 1-1:1.0: Unknown control protocol [ 189.742362][ T6024] usb 1-1: USB disconnect, device number 3 [ 189.855595][ T7196] cdc_wdm 1-1:1.0: Error submitting int urb - -19 [ 189.894090][ T5825] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 190.296950][ T7219] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 191.632975][ T7252] program syz.4.509 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 193.186284][ T37] audit: type=1326 audit(1776788387.123:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7286 comm="syz.4.526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa51c45c819 code=0x7ffc0000 [ 193.186341][ T37] audit: type=1326 audit(1776788387.123:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7286 comm="syz.4.526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa51c45c819 code=0x7ffc0000 [ 193.252558][ T37] audit: type=1326 audit(1776788387.193:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7286 comm="syz.4.526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa51c45c819 code=0x7ffc0000 [ 193.252616][ T37] audit: type=1326 audit(1776788387.193:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7286 comm="syz.4.526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa51c45c819 code=0x7ffc0000 [ 193.252661][ T37] audit: type=1326 audit(1776788387.193:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7286 comm="syz.4.526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fa51c45c819 code=0x7ffc0000 [ 193.474434][ T37] audit: type=1326 audit(1776788387.243:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7286 comm="syz.4.526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa51c45c819 code=0x7ffc0000 [ 193.474490][ T37] audit: type=1326 audit(1776788387.283:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7286 comm="syz.4.526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa51c45c819 code=0x7ffc0000 [ 193.474537][ T37] audit: type=1326 audit(1776788387.423:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7286 comm="syz.4.526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa51c45c819 code=0x7ffc0000 [ 193.480853][ T37] audit: type=1326 audit(1776788387.423:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7286 comm="syz.4.526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa51c45c819 code=0x7ffc0000 [ 193.481009][ T37] audit: type=1326 audit(1776788387.423:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7286 comm="syz.4.526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa51c45c819 code=0x7ffc0000 [ 194.021833][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.370237][ T7308] netlink: 8 bytes leftover after parsing attributes in process `syz.1.533'. [ 194.574316][ T5827] ================================================================== [ 194.574330][ T5827] BUG: KASAN: vmalloc-out-of-bounds in __list_del_entry_valid_or_report+0xb5/0x190 [ 194.574366][ T5827] Read of size 8 at addr ffffc9000f3b2008 by task kworker/u9:4/5827 [ 194.574379][ T5827] [ 194.574399][ T5827] CPU: 1 UID: 0 PID: 5827 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 194.574417][ T5827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 194.574435][ T5827] Workqueue: hci2 hci_rx_work [ 194.574462][ T5827] Call Trace: [ 194.574468][ T5827] [ 194.574476][ T5827] dump_stack_lvl+0xe8/0x150 [ 194.574503][ T5827] print_address_description+0x55/0x1e0 [ 194.574528][ T5827] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 194.574546][ T5827] print_report+0x58/0x70 [ 194.574569][ T5827] kasan_report+0x117/0x150 [ 194.574583][ T5827] ? rt_spin_lock+0x20e/0x400 [ 194.574607][ T5827] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 194.574630][ T5827] __list_del_entry_valid_or_report+0xb5/0x190 [ 194.574650][ T5827] kcov_remote_start+0x2af/0x710 [ 194.574677][ T5827] hci_rx_work+0x10f/0x1040 [ 194.574700][ T5827] ? process_scheduled_works+0xa70/0x1860 [ 194.574725][ T5827] process_scheduled_works+0xb5d/0x1860 [ 194.574761][ T5827] ? __pfx_process_scheduled_works+0x10/0x10 [ 194.574788][ T5827] ? assign_work+0x3d5/0x5e0 [ 194.574814][ T5827] worker_thread+0xa53/0xfc0 [ 194.574869][ T5827] kthread+0x388/0x470 [ 194.574896][ T5827] ? __pfx_worker_thread+0x10/0x10 [ 194.574915][ T5827] ? __pfx_kthread+0x10/0x10 [ 194.574941][ T5827] ret_from_fork+0x514/0xb70 [ 194.574967][ T5827] ? __pfx_ret_from_fork+0x10/0x10 [ 194.574982][ T5827] ? __switch_to+0xc79/0x1410 [ 194.575006][ T5827] ? __pfx_kthread+0x10/0x10 [ 194.575024][ T5827] ret_from_fork_asm+0x1a/0x30 [ 194.575069][ T5827] [ 194.575077][ T5827] [ 194.575083][ T5827] The buggy address belongs to a vmalloc virtual mapping [ 194.575102][ T5827] Memory state around the buggy address: [ 194.575114][ T5827] ffffc9000f3b1f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 194.575133][ T5827] ffffc9000f3b1f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 194.575148][ T5827] >ffffc9000f3b2000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 194.575159][ T5827] ^ [ 194.575170][ T5827] ffffc9000f3b2080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 194.575190][ T5827] ffffc9000f3b2100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 194.575198][ T5827] ================================================================== [ 194.575207][ T5827] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 194.575219][ T5827] CPU: 1 UID: 0 PID: 5827 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 194.575236][ T5827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 194.575247][ T5827] Workqueue: hci2 hci_rx_work [ 194.575265][ T5827] Call Trace: [ 194.575270][ T5827] [ 194.575276][ T5827] vpanic+0x56c/0xa60 [ 194.575293][ T5827] ? __pfx_vpanic+0x10/0x10 [ 194.575312][ T5827] panic+0xc5/0xd0 [ 194.575327][ T5827] ? __pfx_panic+0x10/0x10 [ 194.575343][ T5827] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 194.575366][ T5827] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 194.575384][ T5827] check_panic_on_warn+0x89/0xb0 [ 194.575404][ T5827] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 194.575423][ T5827] end_report+0x73/0x170 [ 194.575443][ T5827] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 194.575461][ T5827] kasan_report+0x128/0x150 [ 194.575475][ T5827] ? rt_spin_lock+0x20e/0x400 [ 194.575498][ T5827] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 194.575525][ T5827] __list_del_entry_valid_or_report+0xb5/0x190 [ 194.575545][ T5827] kcov_remote_start+0x2af/0x710 [ 194.575571][ T5827] hci_rx_work+0x10f/0x1040 [ 194.575592][ T5827] ? process_scheduled_works+0xa70/0x1860 [ 194.575617][ T5827] process_scheduled_works+0xb5d/0x1860 [ 194.575653][ T5827] ? __pfx_process_scheduled_works+0x10/0x10 [ 194.575682][ T5827] ? assign_work+0x3d5/0x5e0 [ 194.575707][ T5827] worker_thread+0xa53/0xfc0 [ 194.575732][ T5827] kthread+0x388/0x470 [ 194.575750][ T5827] ? __pfx_worker_thread+0x10/0x10 [ 194.575763][ T5827] ? __pfx_kthread+0x10/0x10 [ 194.575782][ T5827] ret_from_fork+0x514/0xb70 [ 194.575797][ T5827] ? __pfx_ret_from_fork+0x10/0x10 [ 194.575811][ T5827] ? __switch_to+0xc79/0x1410 [ 194.575833][ T5827] ? __pfx_kthread+0x10/0x10 [ 194.575851][ T5827] ret_from_fork_asm+0x1a/0x30 [ 194.575874][ T5827] [ 194.576719][ T5827] Kernel Offset: disabled