last executing test programs: 3.487800108s ago: executing program 1 (id=2): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000080)={&(0x7f0000000040)=[{0xa75d, 0x3000, 0x2, &(0x7f00000000c0)='Q['}], 0x1}) 3.289091138s ago: executing program 2 (id=3): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000080)={&(0x7f0000000040)=[{0xa75d, 0x3000, 0x0, 0x0}], 0x1}) 2.996630192s ago: executing program 3 (id=4): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000080)={&(0x7f0000000040)=[{0xa75d, 0x3000, 0x0, 0x0}], 0x1}) 2.613008052s ago: executing program 0 (id=1): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000580)={&(0x7f0000000540)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000240)=[0x0, 0x0], &(0x7f0000000200), 0x2, r1}) ioctl$BTRFS_IOC_QUOTA_CTL(0xffffffffffffffff, 0xc0109428, &(0x7f0000000180)={0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000840)={0x0, 0x1, &(0x7f00000005c0)=[r1], &(0x7f0000000180), &(0x7f0000000280)=[r2], &(0x7f0000000040)}) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73f72cc9f0ba1f848140000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f00000000c0)={0x0, 0x8, &(0x7f0000000000)=[{&(0x7f0000000340)="5c00000013006bcd9e3fe3dc4e48aa31086b8703140000001f03000000330000040014000d000a000d0000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x840) 2.35001892s ago: executing program 0 (id=5): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) read$midi(r2, 0x0, 0x43) 1.405031371s ago: executing program 0 (id=6): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000003000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f00003e1000/0x18000)=nil, &(0x7f00000001c0)=[@text64={0x40, 0x0}], 0x1, 0x40, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000340)={[0x3ffffd, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x213f85fc, 0x0, 0x200000, 0x1, 0x0, 0x3, 0xfffffffffffffffd, 0x5, 0x7, 0x9], 0x3000, 0x280384}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 593.988278ms ago: executing program 3 (id=7): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008aec1, &(0x7f0000000500)=""/233) (async) socket(0x3, 0x6, 0x1) (async) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) (async) syz_usb_connect(0x3, 0x2d, &(0x7f0000000180)={{0x12, 0x1, 0x0, 0x62, 0xa1, 0xb, 0x40, 0xc45, 0x1010, 0xe6fc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x32, 0x0, 0x1, 0x97, 0x40, 0xa4, 0x0, [], [{{0x9, 0x5, 0x82, 0x3, 0x3ff, 0x0, 0x7e}}]}}]}}]}}, 0x0) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xfb, 0x8a, 0x54, 0x8, 0xb48, 0x1006, 0xb77d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x9, 0xf5, 0xa0, 0x9b, [{{0x9, 0x4, 0x46, 0x0, 0x0, 0xd6, 0x2c, 0x3e, 0x4}}]}}]}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000002c000092000040"]) (async, rerun: 64) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r1, 0x0) (async, rerun: 64) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r5, 0x0, 0x60, &(0x7f0000000280)={'filter\x00', 0xb001, 0x4, 0x3c8, 0x0, 0x1f8, 0x0, 0x2e0, 0x2e0, 0x2e0, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xe8}}, {{@arp={@local, @loopback, 0xffffffff, 0x0, 0xb, 0x2, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, {[0xff, 0xff, 0xff, 0xff]}}, {@mac=@local, {[0xff, 0xff, 0x0, 0x101, 0xff, 0xff]}}, 0x8, 0x1, 0x5, 0xd721, 0x6, 0x9, 'bridge_slave_1\x00', 'pimreg0\x00', {}, {0xff}, 0x0, 0x39}, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @dev={0xac, 0x14, 0x14, 0x35}, @multicast1, 0x2, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x2, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, 0x0, 0x0) (async, rerun: 32) r6 = socket$pppl2tp(0x18, 0x1, 0x1) (rerun: 32) close(r6) (async, rerun: 64) r7 = socket$can_j1939(0x1d, 0x2, 0x7) (rerun: 64) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f00000000c0)={0x1d, r8}, 0x18) connect$can_j1939(r7, &(0x7f0000000140)={0x1d, r8}, 0x18) (async) sendmmsg(r7, &(0x7f000000a200)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000002c0)="220733d69b211bb4a3f85730728e28424ba4cda255348a19dfc31da6b47d7904126212e0e8502fb4f3dadbbdfa5c952f12a9036dae3d2b0fc75a7bee726dc4c93d91e404a7c235d50738b60402190afaa9e06aff5bdd9087ac06c98060dd3ce9d5871751f599848cefda4e3893ed17b43fadafd1e859e9376358372d4f3cb3a0bf0fe13d15f63fee7e5753f3b19ae14a1226f1d0e748b0b0fc15af257611a13d40cc6aa716bd2733d9395d32fafe82dccc3b211e02659298134932c7c7d1033958c52744bb6adcf202f058a68249", 0xce}, {&(0x7f0000000400)="73fd5418cdbef924ba442463287fbdde2ab7da9d2b26d6b741a60e2aba6555bff157db432a06da33ed74145ddfec5146fe85c31fd70ec45ce1d1fe8dbf85f5e9eed99d6adec3a8a271e9fa501ef5898da20a50c603fbb5af49e0c36b53c91e33ccd527e2ba5edab0f61b9833642fcc839ced7b2ae3c5ab3c565aa52b38f42b865e07775777066808b3a7c4e70e4c05717bc6da503324a9ab9e13b738908b5e9f5b080b464098931a725cfbf8403017399050e250f8cb8b99bd8e5b138dcd386b324e381a36f63aac6099b8aa3979408d4f9db909a8d353a3dc533e2b558cd5921dbf0b33760bb481ffd108e820e871b6e19a87f8141e990d94de13dd8faee04b4e732b122fc85beb7f0163f169e9744ce609ea57fdaafd954cd8562ab91b47176ed0548096ca08ad7264c40f882894a2dbfa9bbc37bdc253a477eb4ae52faa1e6632bfc950b0209bb048349ea50d3527fbbc31a706ffe7c566551ca79d4b0e1359275f044cfbf90cd8497ed033fa064e58f0c11a1a8d18cf53866d4d7b232fb54ed86ea9654440deabd4e8ca66061633ba34a298732ba9605fe31a530f5198aa3e1d1c0fda4c036dc845c835b1959dc0b13cf15c75f58c6ef62f56588d7043c03cfeff1f7b0792e514ac00c9d7570ac95037f6fa4f0cfd7263649bd2b5342320f74ef89799307f596d5db41c683f615da96eb5a5b802fa8ecf3764f6ffd5271e66b382e0e14b81f145c22d4f90306ef02c8c8921521e46b23f72b2fdd2b4fc9a3eb6f03207ada71244714e67cbf65c138215e612a8c9a4420aa45fc39164f5cfc4f9fc014fcfd10b856c3ebd4e1e877046aaee29a642b211f356cb7ed483eda92450d5ff66ff23a20a8bb845265a2939cb34c48a2b22b33bb3e774383588b9f7a53333eb20f4c1054368e34d3acc692d3b12f746b729a122b0aa62a74f5bf0040d589f815c1bce1b4a5934384998df3ab48fe41f0b90fb4d4d8cb01bfecfc86a96d91facba50a5828a8f62bb8759f3dfaeb728e3e42744e83fbad739bd03de69d1c78f6d01b714b11a284caa1ebba69fe7d29e2cbc43db1e6d249545a7c6debd66b5b5f53d4c1d6cebcb2fa427160eb86e48047aab6ce43f7fa0d5bb1dc99ba03e65a7bf178ccba74cf71dec7712414b38f7bf98065a518366839ca4f4a1887ad28d495c1d5c4aa413128d80ab031bd7694cf1101fe9dd65e99849ce6b2e69d6e371bd1df1022e32125747356748d0d3b30fa7d2aa6394707a60b572606d7297091fb45a5534cf269f77f6fc61c92b94f141f06ba8e347667c2fb2c87de5eacf60fadc48f7d7c5516be44807b48583ecc13e00a58143e134706700d28357ac38611494311b049dd497cc5ce315051e215a57f33939d320f808f8dcdedeb60f42b71d618e272506f0bc28843d3fd337989d74600299ab187395347c5bfbb665e5bc03e27978c0b0a464355a47da458690f957122beac9bb139b4223bd156ad74bb76e6880823e52f9eb806aad122892ebd8355ff6cb15ff2e0ce7cad2219a333999318f59c986b4bee11b9f05e355fe32e98732015f17eb19db77088c55d321828bec2dd25ba0da232717e8dafed91f96636d930f3c38b46da4c5541ae963e30e89a341af805176d9e1c9c88068bd81f4acf0325d24fa76dacbff3b88615699f08ded43403b7aeecdd2bbec00e60555317a4e24828ba9e8b9a737621d8ba12fa83c963d67a5a5e5ebbf29ac272cad91786c269fc053ce3f50bb0c05926ccefcc4548d42142efbd86460ec4516aa48e34b54af6319b8c948b69a1fd0d49930d844f13cf5bd1e67c662cdca6dc5f4daf11a75a123ed0a740dfe3014515917a2b01d691803cd7c8f4c46a2fefeab1608498503df514da7c62692b3c2b927b0f09164b367a260aee0c619575891e98ec8391a0b385d4b9ca4a421e2766047cbc11264e89f7d704e7c83d7e50b1c2fa3648c90cb8f66d93f40df5ac3fdd206a3997a5efb0a2cab9c07e00165c2b1cb2c2baf1b06493c4809d1d5dd5c7e6dbc22f1385482f54d4fb96e9e8aec587fe68b7d2d033c7efe622918e0d8661c89582f50db39a3376c1684b9dcfb10ef6cca665c75e2b7e468e7cb3a15604b759b0d949f459b982181f5f423f5dfc8b209665c9763ed0545f9ebf77661559312b4c2fc9518434530f75bf17d1ab39be227845a1d1c9982f2e27601009c36c9ce9cf11da012532e09d23ef2a749a5ca8df867", 0x62c}, {0x0, 0xe}], 0x3, &(0x7f0000002480)}}, {{0x0, 0x0, 0x0}}], 0x2, 0x60000800) (async, rerun: 32) writev(r6, &(0x7f00000025c0)=[{&(0x7f0000000140)="9cd13e", 0x3}], 0x1) (async, rerun: 32) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r10, &(0x7f0000000c80)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff]}, 0x45c) write$char_usb(r9, &(0x7f0000000080)="44e3", 0x2) (async) creat(&(0x7f0000000140)='./file0\x00', 0x71) mount(&(0x7f0000000180)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='bfs\x00', 0x208003, 0x0) 418.66453ms ago: executing program 2 (id=8): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000200)={0x1000001, "56600e1e324551c423170000000099faec52328074c1000000000000ebff0100", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r2, 0xc0303e03, &(0x7f00000000c0)={"3c2486910284ed923431d4c5d5fbf514fd00", r3}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000000c0)={"766cace9c303653f121a2d892000", 0x0, 0x0, {0x81, 0x50000a}, {0x7, 0x8}, 0x5, [0x3, 0x3, 0x4, 0x6, 0x0, 0x400, 0xffffffffffff0001, 0x2, 0x8, 0x7, 0x80000000, 0x81, 0x10, 0x522586f, 0xfffffffffffffffb, 0x7]}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) ioctl$SW_SYNC_IOC_INC(r1, 0x40045701, &(0x7f00000001c0)=0xfffffffd) 366.980238ms ago: executing program 1 (id=9): r0 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x100000) r1 = socket(0x2, 0x2, 0x1) r2 = syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x800000) r3 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x1, 0x40000) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0xf5, 0xd4, 0xba, 0x8, 0xf3d, 0x68a3, 0xe957, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xfe, 0x38, 0xc6bc52c9c52aeb48, 0x6, [{{0x9, 0x4, 0xf2, 0xc5, 0x0, 0xff, 0xff, 0xff, 0x7}}]}}]}}, &(0x7f0000000680)={0x0, 0x0, 0x78, 0x0}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_DISCONNECT(r2, 0xab08) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000004b40), 0x0, 0x0) ioctl$IOMMU_TEST_OP_SET_TEMP_MEMORY_LIMIT(r4, 0x400448c9, 0x0) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fb", 0x42}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee38192714", 0x17}], 0x2}], 0x1, 0x40800) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000380)={0x50, 0x0, 0x0, {0x7, 0x27, 0x0, 0x30000, 0x0, 0x0, 0x8, 0x10000}}, 0x50) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000000000100b060a5000000000000109022400010000500009040002010300000009210000000122f80409058103"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) r7 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_SET_VERSION(r7, 0xc0106407, &(0x7f00000000c0)={0x1, 0x2}) ioctl$DRM_IOCTL_SET_VERSION(r7, 0xc0106407, &(0x7f0000000140)={0x1, 0x1}) syz_usb_control_io$hid(r6, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r8, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) read(r5, &(0x7f0000000100)=""/159, 0xfffffe5a) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x44, 0x0) ioctl$DRM_IOCTL_GET_UNIQUE(r3, 0xc0106401, &(0x7f00000002c0)={0x11, &(0x7f0000000240)=""/17}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r9, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) io_setup(0x4, &(0x7f0000000340)) 251.49623ms ago: executing program 0 (id=10): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f0000006300)={0x2020}, 0x2020) write$FUSE_INIT(r3, 0x0, 0x0) syz_fuse_handle_req(r3, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000777a078afbd825c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000023000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000db2100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cc2351270000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) dup2(r4, r3) writev(r1, &(0x7f0000001400)=[{&(0x7f0000001280)="189f", 0x2}], 0x1) splice(r0, 0x0, r2, 0x0, 0x4ffe2, 0x0) 140.909632ms ago: executing program 2 (id=11): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socket$packet(0x11, 0x3, 0x300) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r3, &(0x7f00000001c0)=[{&(0x7f0000000400)=""/226, 0xe2}], 0x1, 0x33, 0x200000) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000003000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f00003e1000/0x18000)=nil, &(0x7f00000001c0)=[@text64={0x40, 0x0}], 0x1, 0x40, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000340)={[0x3ffffd, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x213f85fc, 0x0, 0x200000, 0x1, 0x0, 0x3, 0xfffffffffffffffd, 0x5, 0x7, 0x9], 0x3000, 0x280384}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 3 (id=12): socket$igmp(0x2, 0x3, 0x2) r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="120100007e3dc410cd0621013ddd0102030109021b000100094000090485000189fe1f000905820220"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) (async) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x3a4, &(0x7f00000000c0)=ANY=[]) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x200000, 0x0) socket$kcm(0x29, 0x2, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.78' (ED25519) to the list of known hosts. [ 435.566598][ T5869] cgroup: Unknown subsys name 'net' [ 435.699534][ T5869] cgroup: Unknown subsys name 'cpuset' [ 435.708890][ T5869] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 437.343345][ T5869] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 440.248850][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.255352][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.633807][ T5888] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 441.644050][ T5888] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 441.652009][ T5888] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 441.660544][ T5888] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 441.669324][ T5888] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 441.676030][ T5897] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 441.684318][ T5897] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 441.691648][ T5888] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 441.692105][ T5897] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 441.700461][ T5888] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 441.706905][ T5897] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 441.713614][ T5888] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 441.720909][ T5897] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 441.730543][ T5153] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 441.734241][ T5897] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 441.741554][ T5153] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 441.750242][ T5897] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 441.762606][ T5897] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 441.811480][ T5153] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 441.824504][ T5153] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 442.344317][ T5886] chnl_net:caif_netlink_parms(): no params data found [ 442.464928][ T5885] chnl_net:caif_netlink_parms(): no params data found [ 442.482615][ T5882] chnl_net:caif_netlink_parms(): no params data found [ 442.562894][ T5883] chnl_net:caif_netlink_parms(): no params data found [ 442.648486][ T5886] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.656857][ T5886] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.664196][ T5886] bridge_slave_0: entered allmulticast mode [ 442.672130][ T5886] bridge_slave_0: entered promiscuous mode [ 442.701311][ T5886] bridge0: port 2(bridge_slave_1) entered blocking state [ 442.708769][ T5886] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.716073][ T5886] bridge_slave_1: entered allmulticast mode [ 442.723471][ T5886] bridge_slave_1: entered promiscuous mode [ 442.828072][ T5885] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.835499][ T5885] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.842978][ T5885] bridge_slave_0: entered allmulticast mode [ 442.850498][ T5885] bridge_slave_0: entered promiscuous mode [ 442.881008][ T5886] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 442.891062][ T5885] bridge0: port 2(bridge_slave_1) entered blocking state [ 442.901409][ T5885] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.908674][ T5885] bridge_slave_1: entered allmulticast mode [ 442.916366][ T5885] bridge_slave_1: entered promiscuous mode [ 442.964102][ T5886] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 443.004025][ T5882] bridge0: port 1(bridge_slave_0) entered blocking state [ 443.011684][ T5882] bridge0: port 1(bridge_slave_0) entered disabled state [ 443.019309][ T5882] bridge_slave_0: entered allmulticast mode [ 443.027388][ T5882] bridge_slave_0: entered promiscuous mode [ 443.066644][ T5885] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 443.076320][ T5882] bridge0: port 2(bridge_slave_1) entered blocking state [ 443.083464][ T5882] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.090995][ T5882] bridge_slave_1: entered allmulticast mode [ 443.098452][ T5882] bridge_slave_1: entered promiscuous mode [ 443.119572][ T5883] bridge0: port 1(bridge_slave_0) entered blocking state [ 443.127098][ T5883] bridge0: port 1(bridge_slave_0) entered disabled state [ 443.134331][ T5883] bridge_slave_0: entered allmulticast mode [ 443.142039][ T5883] bridge_slave_0: entered promiscuous mode [ 443.151695][ T5886] team0: Port device team_slave_0 added [ 443.161778][ T5885] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 443.184497][ T5883] bridge0: port 2(bridge_slave_1) entered blocking state [ 443.191979][ T5883] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.199628][ T5883] bridge_slave_1: entered allmulticast mode [ 443.207028][ T5883] bridge_slave_1: entered promiscuous mode [ 443.215693][ T5886] team0: Port device team_slave_1 added [ 443.267132][ T5882] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 443.324446][ T5885] team0: Port device team_slave_0 added [ 443.333679][ T5885] team0: Port device team_slave_1 added [ 443.341838][ T5882] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 443.352094][ T5886] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 443.360097][ T5886] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.386296][ T5886] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 443.401804][ T5883] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 443.436998][ T5886] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 443.443974][ T5886] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.470431][ T5886] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 443.486023][ T5883] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 443.547832][ T5882] team0: Port device team_slave_0 added [ 443.556477][ T5882] team0: Port device team_slave_1 added [ 443.577381][ T5885] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 443.584362][ T5885] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.610775][ T5885] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 443.623857][ T5885] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 443.630878][ T5885] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.657359][ T5885] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 443.684803][ T5883] team0: Port device team_slave_0 added [ 443.693461][ T5883] team0: Port device team_slave_1 added [ 443.738010][ T5882] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 443.745327][ T5882] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.771890][ T5882] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 443.812132][ T5883] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 443.819221][ T5883] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.846538][ T5153] Bluetooth: hci0: command tx timeout [ 443.846544][ T51] Bluetooth: hci1: command tx timeout [ 443.846800][ T51] Bluetooth: hci3: command tx timeout [ 443.857613][ T5153] Bluetooth: hci2: command tx timeout [ 443.866826][ T5883] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 443.893469][ T5882] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 443.900856][ T5882] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.927062][ T5882] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 443.960164][ T5883] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 443.967433][ T5883] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.993741][ T5883] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 444.019716][ T5886] hsr_slave_0: entered promiscuous mode [ 444.026429][ T5886] hsr_slave_1: entered promiscuous mode [ 444.055432][ T5885] hsr_slave_0: entered promiscuous mode [ 444.061906][ T5885] hsr_slave_1: entered promiscuous mode [ 444.068419][ T5885] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 444.076448][ T5885] Cannot create hsr debugfs directory [ 444.119297][ T5882] hsr_slave_0: entered promiscuous mode [ 444.126128][ T5882] hsr_slave_1: entered promiscuous mode [ 444.132252][ T5882] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 444.140390][ T5882] Cannot create hsr debugfs directory [ 444.214343][ T5883] hsr_slave_0: entered promiscuous mode [ 444.221945][ T5883] hsr_slave_1: entered promiscuous mode [ 444.228692][ T5883] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 444.236327][ T5883] Cannot create hsr debugfs directory [ 444.727875][ T5886] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 444.740952][ T5886] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 444.751976][ T5886] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 444.773572][ T5886] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 444.832994][ T5885] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 444.847171][ T5885] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 444.867210][ T5885] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 444.901811][ T5885] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 444.964697][ T5882] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 444.976869][ T5882] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 444.988542][ T5882] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 445.000732][ T5882] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 445.112480][ T5883] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 445.123467][ T5883] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 445.138271][ T5883] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 445.150534][ T5883] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 445.290471][ T5886] 8021q: adding VLAN 0 to HW filter on device bond0 [ 445.320960][ T5885] 8021q: adding VLAN 0 to HW filter on device bond0 [ 445.361490][ T5886] 8021q: adding VLAN 0 to HW filter on device team0 [ 445.377043][ T5925] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.384429][ T5925] bridge0: port 1(bridge_slave_0) entered forwarding state [ 445.413291][ T5925] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.420555][ T5925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 445.440118][ T5882] 8021q: adding VLAN 0 to HW filter on device bond0 [ 445.464047][ T5885] 8021q: adding VLAN 0 to HW filter on device team0 [ 445.497657][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.504783][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 445.553001][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.560150][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 445.577272][ T5882] 8021q: adding VLAN 0 to HW filter on device team0 [ 445.591203][ T5883] 8021q: adding VLAN 0 to HW filter on device bond0 [ 445.622554][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.629879][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 445.664101][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.671278][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 445.698928][ T5883] 8021q: adding VLAN 0 to HW filter on device team0 [ 445.723576][ T5885] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 445.780436][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.787681][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 445.834113][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.841460][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 445.925892][ T5893] Bluetooth: hci0: command tx timeout [ 445.931369][ T5893] Bluetooth: hci1: command tx timeout [ 445.932354][ T5882] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 445.937691][ T5893] Bluetooth: hci3: command tx timeout [ 445.952819][ T51] Bluetooth: hci2: command tx timeout [ 446.231417][ T5886] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 446.253951][ T5885] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 446.406785][ T5886] veth0_vlan: entered promiscuous mode [ 446.422946][ T5886] veth1_vlan: entered promiscuous mode [ 446.454344][ T5885] veth0_vlan: entered promiscuous mode [ 446.484512][ T5885] veth1_vlan: entered promiscuous mode [ 446.513247][ T5882] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 446.527701][ T5883] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 446.541361][ T5886] veth0_macvtap: entered promiscuous mode [ 446.553960][ T5886] veth1_macvtap: entered promiscuous mode [ 446.597743][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 446.637309][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 446.675821][ T5885] veth0_macvtap: entered promiscuous mode [ 446.695994][ T5882] veth0_vlan: entered promiscuous mode [ 446.704916][ T5885] veth1_macvtap: entered promiscuous mode [ 446.712104][ T5959] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.723274][ T5959] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.745642][ T5959] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.766630][ T5882] veth1_vlan: entered promiscuous mode [ 446.774972][ T5959] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.830309][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 446.860866][ T5883] veth0_vlan: entered promiscuous mode [ 446.873248][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 446.908957][ T5965] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.939833][ T5965] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.953434][ T5883] veth1_vlan: entered promiscuous mode [ 446.985771][ T5965] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.998959][ T5882] veth0_macvtap: entered promiscuous mode [ 447.017863][ T5882] veth1_macvtap: entered promiscuous mode [ 447.026850][ T5965] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.039107][ T5959] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.050975][ T5959] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.120798][ T5882] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 447.172239][ T5925] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.174202][ T5882] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 447.188125][ T5925] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.204511][ T5959] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.221445][ T5959] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.245835][ T36] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.284563][ T5883] veth0_macvtap: entered promiscuous mode [ 447.311479][ T36] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.322453][ T36] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.334332][ T5886] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 447.382123][ T36] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.397239][ T5883] veth1_macvtap: entered promiscuous mode [ 447.414283][ T5959] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.430501][ T5959] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.533501][ T5883] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 447.587590][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.596536][ T5883] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 447.599900][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.648436][ T5959] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.724348][ T5959] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.752308][ T5959] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.761424][ T5959] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 447.781147][ T5925] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.789494][ T5925] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.811669][ T5855] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 447.935586][ T5925] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.945278][ T24] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 447.965956][ T5925] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.985313][ T5855] usb 2-1: Using ep0 maxpacket: 32 [ 448.005642][ T5893] Bluetooth: hci3: command tx timeout [ 448.011595][ T51] Bluetooth: hci2: command tx timeout [ 448.017107][ T5855] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 448.017166][ T5855] usb 2-1: config 0 has no interface number 0 [ 448.017212][ T5855] usb 2-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 448.023082][ T5855] usb 2-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 448.027199][ T5897] Bluetooth: hci1: command tx timeout [ 448.032986][ T5153] Bluetooth: hci0: command tx timeout [ 448.066148][ T5855] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.074270][ T5855] usb 2-1: Product: syz [ 448.096426][ T5855] usb 2-1: Manufacturer: syz [ 448.101180][ T5855] usb 2-1: SerialNumber: syz [ 448.118377][ T5855] usb 2-1: config 0 descriptor?? [ 448.133792][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 448.139885][ T5855] em28xx 2-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 448.152012][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 448.154734][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 448.157683][ T5855] em28xx 2-1:0.132: Video interface 132 found: [ 448.179971][ T24] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 448.189286][ T24] usb 3-1: config 0 has no interface number 0 [ 448.197478][ T24] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 448.211673][ T24] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 448.225110][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.233657][ T24] usb 3-1: Product: syz [ 448.238966][ T24] usb 3-1: Manufacturer: syz [ 448.247963][ T24] usb 3-1: SerialNumber: syz [ 448.267152][ T24] usb 3-1: config 0 descriptor?? [ 448.290825][ T24] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 448.335969][ T5940] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 448.337939][ T24] em28xx 3-1:0.132: Video interface 132 found: [ 448.372541][ T5987] netlink: 'syz.0.1': attribute type 10 has an invalid length. [ 448.390850][ T5987] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 448.400823][ T5987] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 448.423924][ T5987] netlink: 'syz.0.1': attribute type 10 has an invalid length. [ 448.432255][ T5987] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1'. [ 448.442017][ T5987] batadv0: entered promiscuous mode [ 448.447849][ T5987] batadv0: entered allmulticast mode [ 448.457072][ T5987] bond0: (slave batadv0): Releasing backup interface [ 448.466804][ T5987] bridge0: port 3(batadv0) entered blocking state [ 448.473447][ T5987] bridge0: port 3(batadv0) entered disabled state [ 448.495362][ T5940] usb 4-1: Using ep0 maxpacket: 32 [ 448.509751][ T5940] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 448.518230][ T5940] usb 4-1: config 0 has no interface number 0 [ 448.530749][ T5940] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 448.557489][ T5940] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 448.571651][ T5855] em28xx 2-1:0.132: unknown em28xx chip ID (0) [ 448.573311][ T5940] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.605621][ T5940] usb 4-1: Product: syz [ 448.609844][ T5940] usb 4-1: Manufacturer: syz [ 448.625174][ T5940] usb 4-1: SerialNumber: syz [ 448.639407][ T5940] usb 4-1: config 0 descriptor?? [ 448.662383][ T5940] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 448.672979][ T5940] em28xx 4-1:0.132: Video interface 132 found: [ 448.705696][ T24] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 448.801645][ T5965] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 448.811708][ T5965] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 449.064385][ T5940] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 449.583762][ T5992] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 449.685802][ T5855] em28xx 2-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 449.701986][ T5977] em28xx 2-1:0.132: failed to trigger write to i2c address 0xba (error=-5) [ 449.712134][ T5855] em28xx 2-1:0.132: board has no eeprom [ 449.722774][ T5979] em28xx 2-1:0.132: failed to trigger read from i2c address 0xba (error=-5) [ 449.735039][ T5985] em28xx 2-1:0.132: failed to trigger read from i2c address 0xba (error=-5) [ 449.771725][ T24] em28xx 3-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 449.777708][ T5940] em28xx 4-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 449.789598][ T5855] em28xx 2-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 449.813619][ T24] em28xx 3-1:0.132: board has no eeprom [ 449.821944][ T5855] em28xx 2-1:0.132: analog set to bulk mode. [ 449.835000][ T5975] em28xx 2-1:0.132: Registering V4L2 extension [ 449.883896][ T5855] usb 2-1: USB disconnect, device number 2 [ 449.884524][ T5940] em28xx 4-1:0.132: board has no eeprom [ 449.895268][ T24] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 449.918390][ T5855] em28xx 2-1:0.132: Disconnecting em28xx [ 449.924286][ T24] em28xx 3-1:0.132: analog set to bulk mode. [ 450.051511][ T24] usb 3-1: USB disconnect, device number 2 [ 450.085489][ T5153] Bluetooth: hci0: command tx timeout [ 450.091611][ T5153] Bluetooth: hci1: command tx timeout [ 450.096841][ T5897] Bluetooth: hci2: command tx timeout [ 450.097838][ T5153] Bluetooth: hci3: command tx timeout [ 450.113496][ T24] em28xx 3-1:0.132: Disconnecting em28xx [ 450.204680][ T5975] em28xx 2-1:0.132: Config register raw data: 0xffffffed [ 450.218672][ T5975] em28xx 2-1:0.132: AC97 chip type couldn't be determined [ 450.228915][ T5975] em28xx 2-1:0.132: No AC97 audio processor [ 450.241084][ T5975] usb 2-1: Decoder not found [ 450.249100][ T5975] em28xx 2-1:0.132: failed to create media graph [ 450.257342][ T5975] em28xx 2-1:0.132: V4L2 device video103 deregistered [ 450.273697][ T5975] em28xx 2-1:0.132: Remote control support is not available for this card. [ 450.289562][ T5927] em28xx 3-1:0.132: Registering V4L2 extension [ 450.515542][ T5940] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 450.524601][ T6003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 450.535701][ T5940] em28xx 4-1:0.132: analog set to bulk mode. [ 450.567702][ T5940] usb 4-1: USB disconnect, device number 2 [ 450.588827][ T5940] em28xx 4-1:0.132: Disconnecting em28xx [ 450.598941][ T6003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 450.781790][ T5927] em28xx 3-1:0.132: Config register raw data: 0xffffffed [ 450.794533][ T5927] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 450.828998][ T5927] em28xx 3-1:0.132: No AC97 audio processor [ 450.862950][ T5927] usb 3-1: Decoder not found [ 450.876724][ T5927] em28xx 3-1:0.132: failed to create media graph [ 450.894156][ T5927] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 450.912329][ T5927] em28xx 3-1:0.132: Remote control support is not available for this card. [ 450.937764][ T5855] em28xx 2-1:0.132: Closing input extension [ 450.950611][ T10] em28xx 4-1:0.132: Registering V4L2 extension [ 450.963714][ T5855] em28xx 2-1:0.132: Freeing device [ 451.192030][ T10] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 451.205514][ T10] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 451.212677][ T10] em28xx 4-1:0.132: No AC97 audio processor [ 451.240784][ T10] usb 4-1: Decoder not found [ 451.248282][ T10] em28xx 4-1:0.132: failed to create media graph [ 451.254688][ T10] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 451.273665][ T10] em28xx 4-1:0.132: Remote control support is not available for this card. [ 451.273978][ T6024] ================================================================== [ 451.283107][ T5940] em28xx 4-1:0.132: Closing input extension [ 451.290463][ T6024] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 451.290495][ T6024] Read of size 8 at addr ffff888079880738 by task v4l_id/6024 [ 451.290511][ T6024] [ 451.290540][ T6024] CPU: 1 UID: 0 PID: 6024 Comm: v4l_id Not tainted 6.16.0-rc3-next-20250627-syzkaller #0 PREEMPT(full) [ 451.290564][ T6024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 451.290585][ T6024] Call Trace: [ 451.290593][ T6024] [ 451.290601][ T6024] dump_stack_lvl+0x189/0x250 [ 451.290625][ T6024] ? __virt_addr_valid+0x1c8/0x5c0 [ 451.290647][ T6024] ? rcu_is_watching+0x15/0xb0 [ 451.290666][ T6024] ? __pfx_dump_stack_lvl+0x10/0x10 [ 451.290686][ T6024] ? rcu_is_watching+0x15/0xb0 [ 451.290705][ T6024] ? lock_release+0x4b/0x3e0 [ 451.290734][ T6024] ? __virt_addr_valid+0x1c8/0x5c0 [ 451.290757][ T6024] ? __virt_addr_valid+0x4a5/0x5c0 [ 451.290780][ T6024] print_report+0xd2/0x2b0 [ 451.290807][ T6024] ? v4l2_fh_open+0xc7/0x430 [ 451.290827][ T6024] kasan_report+0x118/0x150 [ 451.290851][ T6024] ? v4l2_fh_open+0xc7/0x430 [ 451.290876][ T6024] v4l2_fh_open+0xc7/0x430 [ 451.290896][ T6024] ? __pfx___mutex_lock+0x10/0x10 [ 451.290925][ T6024] em28xx_v4l2_open+0x157/0x9a0 [ 451.290952][ T6024] v4l2_open+0x20c/0x360 [ 451.290977][ T6024] chrdev_open+0x4c9/0x5e0 [ 451.291005][ T6024] ? __pfx_chrdev_open+0x10/0x10 [ 451.291035][ T6024] ? __pfx_chrdev_open+0x10/0x10 [ 451.291060][ T6024] do_dentry_open+0xdf0/0x1970 [ 451.291108][ T6024] vfs_open+0x3b/0x340 [ 451.291135][ T6024] ? path_openat+0x2ecd/0x3830 [ 451.291157][ T6024] path_openat+0x2ee5/0x3830 [ 451.291176][ T6024] ? arch_stack_walk+0xfc/0x150 [ 451.291214][ T6024] ? __pfx_path_openat+0x10/0x10 [ 451.291233][ T6024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.291260][ T6024] do_filp_open+0x1fa/0x410 [ 451.291279][ T6024] ? __lock_acquire+0xab9/0xd20 [ 451.291307][ T6024] ? __pfx_do_filp_open+0x10/0x10 [ 451.291338][ T6024] ? _raw_spin_unlock+0x28/0x50 [ 451.291358][ T6024] ? alloc_fd+0x64c/0x6c0 [ 451.291389][ T6024] do_sys_openat2+0x121/0x1c0 [ 451.291409][ T6024] ? __pfx_do_sys_openat2+0x10/0x10 [ 451.291439][ T6024] ? exc_page_fault+0x76/0xf0 [ 451.291463][ T6024] ? do_user_addr_fault+0xc8a/0x1390 [ 451.291490][ T6024] __x64_sys_openat+0x138/0x170 [ 451.291510][ T6024] do_syscall_64+0xfa/0x3b0 [ 451.291534][ T6024] ? lockdep_hardirqs_on+0x9c/0x150 [ 451.291560][ T6024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.291581][ T6024] ? clear_bhb_loop+0x60/0xb0 [ 451.291608][ T6024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.291636][ T6024] RIP: 0033:0x7f5dda6a7407 [ 451.291666][ T6024] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 451.291686][ T6024] RSP: 002b:00007ffe4a0bec60 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 451.291715][ T6024] RAX: ffffffffffffffda RBX: 00007f5ddadcc880 RCX: 00007f5dda6a7407 [ 451.291732][ T6024] RDX: 0000000000000000 RSI: 00007ffe4a0bff1c RDI: ffffffffffffff9c [ 451.291748][ T6024] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 451.291760][ T6024] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 451.291774][ T6024] R13: 00007ffe4a0beeb0 R14: 00007f5ddaf33000 R15: 0000559d36ad64d8 [ 451.291800][ T6024] [ 451.291807][ T6024] [ 451.618119][ T6024] Allocated by task 10: [ 451.622369][ T6024] kasan_save_track+0x3e/0x80 [ 451.627059][ T6024] __kasan_kmalloc+0x93/0xb0 [ 451.631660][ T6024] __kmalloc_cache_noprof+0x230/0x3d0 [ 451.637045][ T6024] em28xx_v4l2_init+0x10b/0x2e70 [ 451.641999][ T6024] em28xx_init_extension+0x120/0x1c0 [ 451.647295][ T6024] process_scheduled_works+0xade/0x17b0 [ 451.652850][ T6024] worker_thread+0x8a0/0xda0 [ 451.657440][ T6024] kthread+0x711/0x8a0 [ 451.661516][ T6024] ret_from_fork+0x3fc/0x770 [ 451.666116][ T6024] ret_from_fork_asm+0x1a/0x30 [ 451.670891][ T6024] [ 451.673235][ T6024] Freed by task 10: [ 451.677054][ T6024] kasan_save_track+0x3e/0x80 [ 451.681754][ T6024] kasan_save_free_info+0x46/0x50 [ 451.686795][ T6024] __kasan_slab_free+0x62/0x70 [ 451.691561][ T6024] kfree+0x18e/0x440 [ 451.695467][ T6024] em28xx_v4l2_init+0x1683/0x2e70 [ 451.700508][ T6024] em28xx_init_extension+0x120/0x1c0 [ 451.705809][ T6024] process_scheduled_works+0xade/0x17b0 [ 451.711382][ T6024] worker_thread+0x8a0/0xda0 [ 451.715977][ T6024] kthread+0x711/0x8a0 [ 451.720054][ T6024] ret_from_fork+0x3fc/0x770 [ 451.724669][ T6024] ret_from_fork_asm+0x1a/0x30 [ 451.729454][ T6024] [ 451.731786][ T6024] The buggy address belongs to the object at ffff888079880000 [ 451.731786][ T6024] which belongs to the cache kmalloc-8k of size 8192 [ 451.745847][ T6024] The buggy address is located 1848 bytes inside of [ 451.745847][ T6024] freed 8192-byte region [ffff888079880000, ffff888079882000) [ 451.759828][ T6024] [ 451.762160][ T6024] The buggy address belongs to the physical page: [ 451.768571][ T6024] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79880 [ 451.777402][ T6024] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 451.785915][ T6024] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 451.793917][ T6024] page_type: f5(slab) [ 451.797916][ T6024] raw: 00fff00000000040 ffff88801a842280 0000000000000000 0000000000000001 [ 451.806508][ T6024] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 451.815100][ T6024] head: 00fff00000000040 ffff88801a842280 0000000000000000 0000000000000001 [ 451.823783][ T6024] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 451.832459][ T6024] head: 00fff00000000003 ffffea0001e62001 00000000ffffffff 00000000ffffffff [ 451.841490][ T6024] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 451.850185][ T6024] page dumped because: kasan: bad access detected [ 451.856604][ T6024] page_owner tracks the page as allocated [ 451.862337][ T6024] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5680, tgid 5680 (sshd-session), ts 70059753623, free_ts 70056895125 [ 451.883233][ T6024] post_alloc_hook+0x240/0x2a0 [ 451.888020][ T6024] get_page_from_freelist+0x21e4/0x22c0 [ 451.893579][ T6024] __alloc_frozen_pages_noprof+0x181/0x370 [ 451.899399][ T6024] alloc_pages_mpol+0x232/0x4a0 [ 451.904259][ T6024] allocate_slab+0x8a/0x370 [ 451.908777][ T6024] ___slab_alloc+0xbeb/0x1410 [ 451.913459][ T6024] __kmalloc_cache_noprof+0x296/0x3d0 [ 451.918833][ T6024] tomoyo_init_log+0x111f/0x1f70 [ 451.923785][ T6024] tomoyo_supervisor+0x340/0x1480 [ 451.928816][ T6024] tomoyo_env_perm+0x149/0x1e0 [ 451.933585][ T6024] tomoyo_find_next_domain+0x15cf/0x1aa0 [ 451.939223][ T6024] tomoyo_bprm_check_security+0x11c/0x180 [ 451.944958][ T6024] security_bprm_check+0x89/0x270 [ 451.950009][ T6024] bprm_execve+0x8ee/0x1450 [ 451.954517][ T6024] do_execveat_common+0x510/0x6a0 [ 451.959546][ T6024] __x64_sys_execve+0x94/0xb0 [ 451.964225][ T6024] page last free pid 5680 tgid 5680 stack trace: [ 451.970561][ T6024] __free_frozen_pages+0xb80/0xd80 [ 451.975682][ T6024] __put_partials+0x156/0x1a0 [ 451.980465][ T6024] put_cpu_partial+0x17c/0x250 [ 451.985284][ T6024] __slab_free+0x2d5/0x3c0 [ 451.989732][ T6024] qlist_free_all+0x97/0x140 [ 451.994332][ T6024] kasan_quarantine_reduce+0x148/0x160 [ 451.999800][ T6024] __kasan_kmalloc+0x22/0xb0 [ 452.004404][ T6024] __kmalloc_cache_noprof+0x230/0x3d0 [ 452.009785][ T6024] tomoyo_init_log+0x111f/0x1f70 [ 452.014736][ T6024] tomoyo_supervisor+0x340/0x1480 [ 452.019772][ T6024] tomoyo_find_next_domain+0x488/0x1aa0 [ 452.025685][ T6024] tomoyo_bprm_check_security+0x11c/0x180 [ 452.031429][ T6024] security_bprm_check+0x89/0x270 [ 452.036471][ T6024] bprm_execve+0x8ee/0x1450 [ 452.040982][ T6024] do_execveat_common+0x510/0x6a0 [ 452.046014][ T6024] __x64_sys_execve+0x94/0xb0 [ 452.050717][ T6024] [ 452.053039][ T6024] Memory state around the buggy address: [ 452.058671][ T6024] ffff888079880600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 452.066730][ T6024] ffff888079880680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 452.074795][ T6024] >ffff888079880700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 452.082856][ T6024] ^ [ 452.088747][ T6024] ffff888079880780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 452.096808][ T6024] ffff888079880800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 452.104867][ T6024] ================================================================== [ 452.113089][ C1] vkms_vblank_simulate: vblank timer overrun [ 452.127849][ T24] em28xx 3-1:0.132: Closing input extension [ 452.166504][ T5855] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 452.208196][ T24] em28xx 3-1:0.132: Freeing device [ 452.228238][ T6024] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 452.235494][ T6024] CPU: 1 UID: 0 PID: 6024 Comm: v4l_id Not tainted 6.16.0-rc3-next-20250627-syzkaller #0 PREEMPT(full) [ 452.246627][ T6024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 452.256711][ T6024] Call Trace: [ 452.260004][ T6024] [ 452.262943][ T6024] dump_stack_lvl+0x99/0x250 [ 452.267548][ T6024] ? __asan_memcpy+0x40/0x70 [ 452.272155][ T6024] ? __pfx_dump_stack_lvl+0x10/0x10 [ 452.277360][ T6024] ? __pfx__printk+0x10/0x10 [ 452.281961][ T6024] panic+0x2db/0x790 [ 452.285881][ T6024] ? __pfx_panic+0x10/0x10 [ 452.290361][ T6024] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 452.296272][ T6024] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 452.302604][ T6024] ? print_memory_metadata+0x314/0x400 [ 452.308100][ T6024] ? v4l2_fh_open+0xc7/0x430 [ 452.312738][ T6024] check_panic_on_warn+0x89/0xb0 [ 452.317689][ T6024] ? v4l2_fh_open+0xc7/0x430 [ 452.322292][ T6024] end_report+0x78/0x160 [ 452.326549][ T6024] kasan_report+0x129/0x150 [ 452.331061][ T6024] ? v4l2_fh_open+0xc7/0x430 [ 452.335666][ T6024] v4l2_fh_open+0xc7/0x430 [ 452.340101][ T6024] ? __pfx___mutex_lock+0x10/0x10 [ 452.345141][ T6024] em28xx_v4l2_open+0x157/0x9a0 [ 452.350010][ T6024] v4l2_open+0x20c/0x360 [ 452.354273][ T6024] chrdev_open+0x4c9/0x5e0 [ 452.358699][ T6024] ? __pfx_chrdev_open+0x10/0x10 [ 452.363658][ T6024] ? __pfx_chrdev_open+0x10/0x10 [ 452.368621][ T6024] do_dentry_open+0xdf0/0x1970 [ 452.373421][ T6024] vfs_open+0x3b/0x340 [ 452.377525][ T6024] ? path_openat+0x2ecd/0x3830 [ 452.382339][ T6024] path_openat+0x2ee5/0x3830 [ 452.386940][ T6024] ? arch_stack_walk+0xfc/0x150 [ 452.391820][ T6024] ? __pfx_path_openat+0x10/0x10 [ 452.396766][ T6024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.402846][ T6024] do_filp_open+0x1fa/0x410 [ 452.407359][ T6024] ? __lock_acquire+0xab9/0xd20 [ 452.412232][ T6024] ? __pfx_do_filp_open+0x10/0x10 [ 452.417283][ T6024] ? _raw_spin_unlock+0x28/0x50 [ 452.422139][ T6024] ? alloc_fd+0x64c/0x6c0 [ 452.426487][ T6024] do_sys_openat2+0x121/0x1c0 [ 452.431175][ T6024] ? __pfx_do_sys_openat2+0x10/0x10 [ 452.436395][ T6024] ? exc_page_fault+0x76/0xf0 [ 452.441283][ T6024] ? do_user_addr_fault+0xc8a/0x1390 [ 452.446583][ T6024] __x64_sys_openat+0x138/0x170 [ 452.451527][ T6024] do_syscall_64+0xfa/0x3b0 [ 452.456054][ T6024] ? lockdep_hardirqs_on+0x9c/0x150 [ 452.461266][ T6024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.467344][ T6024] ? clear_bhb_loop+0x60/0xb0 [ 452.472037][ T6024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.477928][ T6024] RIP: 0033:0x7f5dda6a7407 [ 452.482349][ T6024] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 452.501967][ T6024] RSP: 002b:00007ffe4a0bec60 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 452.510400][ T6024] RAX: ffffffffffffffda RBX: 00007f5ddadcc880 RCX: 00007f5dda6a7407 [ 452.518389][ T6024] RDX: 0000000000000000 RSI: 00007ffe4a0bff1c RDI: ffffffffffffff9c [ 452.526380][ T6024] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 452.534355][ T6024] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 452.542327][ T6024] R13: 00007ffe4a0beeb0 R14: 00007f5ddaf33000 R15: 0000559d36ad64d8 [ 452.550316][ T6024] [ 452.553671][ T6024] Kernel Offset: disabled [ 452.558007][ T6024] Rebooting in 86400 seconds..