last executing test programs:

7.391967941s ago: executing program 2 (id=184):
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r2 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r2, &(0x7f0000000040)={0x18, 0x0, {0x3, @random="bb7fb37b9489", 'sit0\x00'}}, 0x1e)
sendmmsg(r2, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0)
syz_open_dev$ptys(0xc, 0x3, 0x1)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000780)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r3}, 0x10)
openat$sequencer(0xffffffffffffff9c, 0x0, 0x252882, 0x0)
r4 = socket$l2tp(0x2, 0x2, 0x73)
bind$inet(r4, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10)
connect$inet(r4, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x10)
sendmmsg$inet(r4, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0)
bind$inet(r4, &(0x7f0000000040)={0x2, 0x4ea4, @private=0xa010100}, 0x10)
syz_mount_image$msdos(&(0x7f00000001c0), &(0x7f0000000080)='./file1\x00', 0x8, &(0x7f0000000840)=ANY=[@ANYBLOB="646f74732c646f74732c6e6f646f74732c6e6f646f74732c646f74732c6e6f646f74732c6e6f646f74732c71756965742c6e6f646f74732c666c7573682c756d61736b3d30303030303030303030303030303030303030303030302c646f74732c646f74732c756d61736b3d30303030303030303030303030303030303037373737372c6e66732c646f74732c747a3d5554432c646f74732c646f74732c6e6f636173652c7379735f696d6d757461626c652c646f74732c00f8a7354494367fe599abb0e9fee8f6cdbd4415cc7bc52b6352f54afc78e51de6b37ae8efbdfe1689a174697f9528b4217d017a472c4c8e00a5cdd06438f130234c66db3e61a4ea6b90f67ddc19c74c6ac93054e1668cf0ff55fdebea678f16269706271797abeebc6b043e549356dfa4c7e8b4e091a7a6cfc601e4e66e509afea6dcc9d274ab27afd6f183050075b86a3ffc8dfcd249c141fd90a5331224d62867d9b87a8e7d0cf56567584e7adde32f223d2a9bd69b39c51152b3a827f49a0f7e23d51ac4128630c7668a0b38090b5c86636aee6face102356400fbbd"], 0xfd, 0x1bf, &(0x7f0000000480)="$eJzs3TGL02AYB/Cn9bzmnG4TRCHg4nSon+BEThADgtJBJ4XT5SqCt0SX9mP4Af0A0qmLRGrSxkaHWmxS6++39En/edvnHZp26ZNXN99dnL+/fPvl+udIkl70T+M0Zr04jn4sTAIA2CezooivRanrXgCAdqzx/f+t5ZYAgC17/uLlkwdZdvYsTZOI6SQf5sPyscwfPc7O7qY/HNerpnk+vLLM76XN3w7z/Gpcq/L75fp0NT+MO7fLfJ49fJo18kGcb3frAAAAAAAAAAAAAAAAAAAAAADQmVuRLvx2vs/JSTM/qvLy6Kf5QI35PQdx46A6rMcDFeM2NgUAAAAAAAAAAAAAAAAAAAD/mMuPny5ej0ZvPtTFICJWn/mTole98IbL2y76sRNtKP5qke5GG6MNPwWHEbGtxmZFUax1cn2NGHR1cQIAAAAAAAAAAAAAAAAAgP9M/affX7Oki4YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAP1/f83KMYRscbJyzc76nSrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7LHvAQAA///DgjXa")
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x48})
mkdirat(0xffffffffffffff9c, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)

6.536529078s ago: executing program 2 (id=194):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0)
r2 = gettid()
r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffffffffffff5]}, 0x8, 0x0)
readv(r3, &(0x7f00000002c0)=[{&(0x7f0000000000)=""/109, 0x6d}, {&(0x7f0000000200)=""/153, 0x99}], 0x2)
tkill(r2, 0x8)

5.366136615s ago: executing program 2 (id=205):
socket$nl_sock_diag(0x10, 0x3, 0x4)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r0 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7737, 0x1, 0x2, 0x34f}, &(0x7f00000000c0)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2e, 0x0, 0x0, 0x4}]}, 0x10)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1})
io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0)

5.15800709s ago: executing program 2 (id=211):
syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', 0x48c5, &(0x7f0000000b80)={[{@uni_xlateno}, {@shortname_winnt}, {@rodir}, {@fat=@gid}, {@fat=@nfs_nostale_ro}, {@uni_xlateno}, {@shortname_mixed}, {@uni_xlateno}, {@fat=@sys_immutable}, {@uni_xlate}, {@utf8no}, {@shortname_winnt}]}, 0x0, 0x274, &(0x7f0000000780)="$eJzs3MGLG1UYAPDPbNvdbmmzBxEUxIde9BLa9S8I0oK4oKyNqAdh6mY17JgsmbgSEdubV/+O4tGboP4De/HmXbwsguClBzHSJONm10BbaZzV/H4Q5su8+fLeTGbCNwN5R29/+dHebtHYzQZRW0tRi7gT9yI27kdTT0yXtXF8IWbdiZcu/fbjs2++8+5rza2t69sp3WjefHkzpXTluW8/+eyr578fXHrr6yvfrMbhxntHv27+dPjU4dNHf9wsP703SFm61esNslt5O+10ir1GSm/k7axop063aPdPtO/mvf39Ycq6O5fX9/vtokhZd5j22sM06KVBf5iyD7JONzUajXR5PZbNyiNntO5ub2fNhQyGKlyct7Lfb2Yrcxtbd/+NQQEAZ0tV9f+HnSJ1itR9UP1fC/X/4qj/l8H9+n99ev2epP4HAAAAAAAAAAAAAID/gnujUX00GtXLZflajYi1iCjfVz1OFsP3v9xm/ri3FpF/cdA6aE2Wk/bmbnQij3ZcPR/x+/h8mJrEN17dun41jW3Ed/ntaf7tg9ZKrJb5pY35+dcm+elk/vlYn+1/M+rx5Pz8zbn5F+LFF2byG1GPH96PXuSxMz6vj/M/v5bSK69vncq/ON4OAAAA/g8a6S9/u38ftzdSOW3IqfbJyuPnA1F/wPOBU/fX5+KZc9XtNwAAACyTYvjpXpbn7b7g0QKHbuFBLSIq6v2XiDgbB+GxBj9/PLnqH2bjqn+ZAACAx+246K96JAAAAAAAAAAAAAAAAAAAALC8HnbysHL7fzL32Ex3K9XsJQAAAAAAAAAAAAAAAAAAAAAAAJwNfwYAAP//xsMhSw==")
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00')
mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0)
mount$bind(&(0x7f0000000500)='./file0\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1333404, 0x0)
mount$bind(&(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x11080, 0x0)
mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0)
read$FUSE(r0, &(0x7f0000002140)={0x2020}, 0x2100)

4.96018684s ago: executing program 2 (id=213):
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xa0000)
syz_usb_connect(0x5, 0x0, 0x0, 0x0)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0})
poll(&(0x7f00000000c0)=[{r0, 0x3388}], 0x1, 0x800)

4.66986997s ago: executing program 2 (id=219):
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000400)='kfree\x00'}, 0x10)
r0 = socket(0x10, 0x3, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r0)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x0, 0x0, 0x0, 0x7995}, 0xfff7, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0})
ioctl$USBDEVFS_REAPURB(r2, 0x4008550c, 0x0)

4.107119817s ago: executing program 32 (id=219):
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000400)='kfree\x00'}, 0x10)
r0 = socket(0x10, 0x3, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r0)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x0, 0x0, 0x0, 0x7995}, 0xfff7, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0})
ioctl$USBDEVFS_REAPURB(r2, 0x4008550c, 0x0)

2.56020618s ago: executing program 0 (id=230):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r0}, 0x10)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x2d75000)
timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x0, 0x1}, {0x0, 0xe4c}}, 0x0)

2.498688003s ago: executing program 0 (id=231):
mkdir(0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x8)
socket$rxrpc(0x21, 0x2, 0x2)
r0 = getpid()
sysfs$2(0x2, 0x80000001, 0x0)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000)
process_mrelease(0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e20}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000680)="adcd0e9a3fc364961ed0e41b0cd69500e2ec785e49cdeb1d7c17e785cc145057b46a35d570830c5a86e5fd40b7ec8d03e3dc83b955da225ce2866f27529bc455389d0eb2202be1e65e0091b0182f77b4f02fa951f3f7cb6c2abb629f56cf7290d94eb21e4c5b9837c68321aa127c1b51f244bdcf14306f6e83838dc7908c724580ec7fe1fe802d9ba76ecf7b53e1b3e8df2a84585a6b6e470a054452d6ee88617d", 0xa1)
r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_VFIO_CHECK_EXTENSION(r4, 0x3b65, 0x4)
setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000400)={0xa58, {{0x2, 0x4e23, @loopback}}}, 0x88)
r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
getsockopt$rose(r5, 0x104, 0x4b264316b88a3841, 0x0, &(0x7f00000000c0))
r6 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_EVENTS(r6, 0x84, 0xb, &(0x7f0000000300)={0x0, 0x4}, 0xe)
shutdown(r6, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={<r7=>0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10)
getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f0000000040)={r7, 0x5e6e5432}, &(0x7f0000000080)=0x8)
read$alg(0xffffffffffffffff, 0x0, 0x0)
r8 = syz_io_uring_setup(0xe3e, &(0x7f0000000600)={0x0, 0xa9c8, 0x400, 0x2}, 0x0, 0x0)
r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r8, 0x0, 0x0, 0x7c, 0x5, 0x0, {0x0, r9, r8}})

1.850652912s ago: executing program 1 (id=232):
socket$inet6(0xa, 0x80001, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x201, 0x2)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$inet_udp(0x2, 0x2, 0x0)
socket$kcm(0x10, 0x2, 0x0)
sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2)
r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0)
socket$rds(0x15, 0x5, 0x0)
ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2})
socket$inet6(0xa, 0x2, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[<r2=>0x0], 0x40000012})
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200))
ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000180)={0x600, 0x1, &(0x7f0000000340)=[r2], &(0x7f0000000280), &(0x7f0000000200), &(0x7f00000000c0), 0x0, 0x7f})

1.724261394s ago: executing program 1 (id=233):
r0 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f00000001c0)={0x8000042, 0x3}, 0x10)
r1 = socket$tipc(0x1e, 0x5, 0x0)
setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000140)={0x10000042, 0x0, 0x2}, 0x10)
sendmsg$tipc(r0, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x1, {{0x40, 0x2}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x48004)

1.667584448s ago: executing program 1 (id=234):
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$inet6(r0, &(0x7f0000000040)={&(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7f}, 0x1c, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="280000000000000029000000390000000602020100000000fe8000000000000000000000000000aa1400000000000000290000004300000087a7"], 0x40}, 0x0)

1.62044784s ago: executing program 1 (id=235):
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a3b370086d04ae085811f10103010902"], 0x0)
r0 = socket$inet(0xa, 0x801, 0x84)
listen(r0, 0x8)
close(0xffffffffffffffff)
connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0)
accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x0)
r1 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=<r2=>0x0, &(0x7f00000001c0)=<r3=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4)
syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1})
io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0)

1.612860379s ago: executing program 0 (id=236):
ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x0, 0x1000, 0x0, {0x0, 0x1}, {0x48, 0x2}, @period={0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x0, 0x4}, 0x0, 0x0}})
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01)
write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250)
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000340)=0x7)

1.490197358s ago: executing program 0 (id=237):
syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000840)='./bus\x00', 0x10, &(0x7f0000000540), 0x1, 0x7cc, &(0x7f00000022c0)="$eJzs3ctrW1caAPDvyvJjnGTsgYFJZmUYmDGEyOOMJ5mBLlK6KIUGAu26iZEVk1q2giWH2BjSUArdFNrQRaHdZJ226a7bPrbtv9BuSikJaeuEJnRRXK4esRxLjpzYchP/fnCtc+7D53z3ce6R7kEKYM8aSf9kIg5FxNtJxFB9fhIRvdVUNuJEbb27K8v5dEpidfWln5LqOndWlvPRtE0MDsa+euZgRHzxRsThzMZyy4tLM5PFYmG+nh+rzJ4fKy8uHTk3OzldmC7MHRufmDh6/L/H+7cv1l++Xtp/853n//XxiV9f/9v1t75M4kTsry9rjmO7jMRIbZ9Eb7oL13luuwvbZcluV4BHkl6aPbWrPA7FUDb6Ot82u5MVAwB2zKWIWAUA9pjE/R8A9pjG5wB3Vpbz6bR6aXc/j+i2W89GxEAt/sbzzdqSbP2Z3UD1OejgnWTd844kIoa3ofyRiPjg01c+TKfYoeeQAK28djkizgyPNNr/tfYn2TBmoabzARn/biQ2GRww8kBe+wfd81na//nfWv9v7frL3O//RIv+T3+La/dRjMT6EScbr//MjW0opq20//dM79rYtrtN8dcN99RzB6p9vt7k7LliIW3b/hwRo9Hbn+bHNylj9PZvt9fNaIq4uf/385VXr6Xlp69ra2RuZB9ocqcmK5OPG3fDrcsRf8+2ij+5f/yTNv3fUx2W8cL/33y/3bI0/jTexrQ+/p0fVbZ6NeKf0Tr+hmSz8YnHxqqnw1jjpGjhk+/eG2xXfvPxT6e0/Np7gQPbH2wL6fEf3Dz+4aR5vGZ562V8dXXo83bL2sff0Pr870terqYbl9LFyUplfjyiL3lx4/yja9s28o310/hH/9H6+t/s/E/fE57pMP7szR8/emj8jRkb4q8b6LCwLUrjn9rS8d964vrdmZ525Xd2/CfSRM9ofU4n7d9m9eprWueRdxwAAAAAAAAAAAAAAAAAAAAAAAAAbEEmIvZHksndT2cyuVxUf8P7rzGYKZbKlcNnSwtzU1H9rezh6M00vupyqOn7UMfr34ffyB99IP+fiPhLRLzb/6dqPpcvFad2O3gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqNvX5vf/Uz/0117v7WoNAYAdMfDQNW4XulIRAKBrHn7/j4j+na8HANA9Hd3/AYCnivs/AOw97v8AsPcMRGR3uw4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA81U6dPJlOq/dWlvNpfurC4sJM6cKRqUJ5Jje7kM/lS/Pnc9Ol0nSxkMuXZps2/abV/yuWSucnYm7h4lilUK6MlReXTs+WFuYqp8/NTk4XThd6uxYZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHSuvLg0M1ksFubriWuDEevndCnRU69QVwt9IhOrQ7U99Uepz84nvj/y7cHN1rmy4TSWeOzEbrZKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE+O3wMAAP//mc0dAw==")
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0xa002, 0x15)
r0 = getpid()
r1 = syz_pidfd_open(r0, 0x0)
setns(r1, 0x8020000)
mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000000000)={0xf}, 0x20)

1.457975748s ago: executing program 0 (id=238):
r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
ioctl$VIDIOC_CROPCAP(r0, 0xc02c563a, &(0x7f0000000000)={0xc, {0xc4, 0x400, 0x7, 0x5c}, {0x2, 0x401, 0x7, 0x8}, {0xce, 0x8fe}})

1.231213578s ago: executing program 0 (id=239):
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)

98.91775ms ago: executing program 1 (id=240):
syz_mount_image$iso9660(&(0x7f0000000080), &(0x7f0000000540)='./file0\x00', 0x204818, &(0x7f0000000100)={[{@overriderock}, {@overriderock}, {@hide}, {@session={'session', 0x3d, 0x5c}}, {@showassoc}, {@iocharset={'iocharset', 0x3d, 'cp437'}}, {@iocharset={'iocharset', 0x3d, 'cp950'}}, {@nojoliet}]}, 0x1, 0x544, &(0x7f0000001000)="$eJzs3V9v01YfwPGfS/sQ5ZGqRw8TQlWBQ9mkIpXgJBAUceU5J+mBxI5sB7VXqKIpqkhhokxae8O4YZu0vQh2uRexd4T2EjbZTvqHJjHQv6u+nwjOiX3s8zup5Z/cxscCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADEcmu2XbSkabzOkhrNrQV+a/dtf+sDC+TWvmJMvyJW/E9yObmSLrry1e7qy/F/czKbvpuVXFzkZPu/l//34NLkxGD7MQF/lt+/cE+bW9vPV3q97qujCuQMunpx9LqG9kzom5bT0MqEvqpWKvadxXqo6qapw+Uw0i3lBtqJ/EDNu7dUsVotK11Y9jteo+Y09WDh/dsl266oh4W2doLQ9+48LITuomk2jddI2sSr4zb34wPxkYlUpJ2WUmvrvW45awBxo+KnNCplNSrZpVKxWCoVK/eq9+7b9uSBBfZH5ECLozto8e90hGdv4HAm+vlfmmLEk44siRr6cqUmgfjSGrG+b5D/v7mjx/a7N/8PsvyV3dUzkuT/a+m7a6Py/4hYTu61KVuyLc9lRXrSk668OvWITvbVEC2eGAnFFyMtcZIlqr9ESVUqUhFbnsii1CUUJXUx0hQtoSxLKJHo5IhyJRAtjkTiSyBK5sWVW6KkKFWpSlmUaCnIsvjSEU8aUhMn2cuarCefe1mUNSrGnUbFkcPID467rpTGjJb8j8M70vM3cBh/D/I/AAAAAAA4t6zkt+/x9f+UXE1qddPU9mmHBQAAAAAAjlDyl//ZuJiKa1fF4vofAAAAAIDzxkrusbNEJC/X09qaWMntUvwSAAAAAACAcyL5+/+1uEjmQLku1s50KVz/AwAAAABwTvycOcd+2L5o/fmXBMGU9ba99LW1kczN62xcSLe78PEeo/qMNd3fSVJU0mJy0tWzVi5ttDMJ5od+sZYVh7UbgLMTwI+fE8ClSflVbqRtbqym5epgTdpLvm6auuD6zQdFcZzpiUgvRd+/WP9BkuH/4rWmrZys97qFpy97q0ksb+O9vN3oT6B4YB7FMbG8TuZbSO65GDriqeRGjH6/eUvW1ntde+/4J9LNJ/b3+GZ6TJ/vZC5tNdef8Ta/f/y5uM9iYdTo+1EUDznyd3IzbXNz/mZaDImilBVFaW8Uwz+Lw0dRzoqifMgoAOC0rGVkIUsO5N0vOMt9WXaXz8zu72Q+bTM/k5xYJ2eGnNHtrDO6fcjs9seBZyCNyrFxv799lFXfxxu8H9lv2CxZ8Ud44fXGd3J5c2v79vrGyrPus+6LUqlcse/a9r2STCXD6BfkHgDAEHufsWMNzf+ZT+Gx7mZcVf9/5ysFBXkqL6Unq7KQ3G2QfONg6F7ze76GsJBx1ZpP0mT6hJeFMVd1/0nuchjstzS27f4YyifwkwAA4OTMZeThT8n/CxnX3ftz+fir4/yep7UBAIDjoYMPVj76yQoC035SrFaLTrSoVeC7j1Rgag2tjBfpwF10vIZW7cCPfNdvxpXHpqZDFXbabT+IVN0PVNsPzVIyfaDqP/o91C3Hi4wbtpvaCbVyfS9y3EjVTOiqdufbpgkXdZBsHLa1a+rGdSLjeyr0O4GrC0qFWu9paGrai0zdxFVPtQPTcoKceuw3Oy2tajp0A9OO/HSHg76MV/eDVrLbwml/2AAAnBGbW9vPV3q97qtjrAztOHfiQwUAAH0ZWRoAAAAAAAAAAAAAAAAAAAAAAJwBJ3H/H5VzXhlMBX1W4qFyBJXMU8ebYz85AThW/wQAAP//rVVPjw==")

0s ago: executing program 1 (id=241):
syz_clone(0x42000000, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = syz_clone(0x60000400, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = getpgid(r0)
r2 = syz_pidfd_open(r1, 0x0)
pidfd_send_signal(r2, 0x11, 0x0, 0x4)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:31736' (ED25519) to the list of known hosts.
syzkaller login: [   49.276397][ T5783] cgroup: Unknown subsys name 'net'
[   49.366289][ T5783] cgroup: Unknown subsys name 'cpuset'
[   49.370036][ T5783] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.767014][ T5783] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   55.150964][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   55.154885][   T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   55.157748][   T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   55.161000][   T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   55.163906][   T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   55.289115][ T5845] chnl_net:caif_netlink_parms(): no params data found
[   55.312999][ T5237] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   55.316433][ T5237] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   55.319455][ T5237] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   55.323378][ T5237] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   55.327106][ T5849] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   55.330387][ T5849] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   55.357203][ T5857] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   55.360151][ T5857] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   55.363871][ T5857] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   55.367658][ T5857] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   55.415834][ T5845] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.420533][ T5845] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.424298][ T5845] bridge_slave_0: entered allmulticast mode
[   55.428226][ T5845] bridge_slave_0: entered promiscuous mode
[   55.435896][ T5845] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.438961][ T5845] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.442817][ T5845] bridge_slave_1: entered allmulticast mode
[   55.446648][ T5845] bridge_slave_1: entered promiscuous mode
[   55.497957][ T5845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.506481][ T5845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.547103][ T5845] team0: Port device team_slave_0 added
[   55.560874][ T5845] team0: Port device team_slave_1 added
[   55.608294][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.611700][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.623008][ T5845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.631962][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.634921][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.645879][ T5845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.738723][ T5845] hsr_slave_0: entered promiscuous mode
[   55.742345][ T5845] hsr_slave_1: entered promiscuous mode
[   55.749121][ T5853] chnl_net:caif_netlink_parms(): no params data found
[   55.934588][ T5853] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.937701][ T5853] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.940700][ T5853] bridge_slave_0: entered allmulticast mode
[   55.945321][ T5853] bridge_slave_0: entered promiscuous mode
[   55.958121][ T5853] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.961238][ T5853] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.965737][ T5853] bridge_slave_1: entered allmulticast mode
[   55.969869][ T5853] bridge_slave_1: entered promiscuous mode
[   56.006725][ T5855] chnl_net:caif_netlink_parms(): no params data found
[   56.039720][ T5853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.053411][ T5853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.113622][ T5853] team0: Port device team_slave_0 added
[   56.140881][ T5853] team0: Port device team_slave_1 added
[   56.218455][ T5855] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.223673][ T5855] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.226645][ T5855] bridge_slave_0: entered allmulticast mode
[   56.230680][ T5855] bridge_slave_0: entered promiscuous mode
[   56.236640][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.239535][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.251689][ T5853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.256237][ T5855] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.260460][ T5855] bridge0: port 2(bridge_slave_1) entered disabled state
[   56.264049][ T5855] bridge_slave_1: entered allmulticast mode
[   56.267952][ T5855] bridge_slave_1: entered promiscuous mode
[   56.271539][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.273995][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.285037][ T5853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.290187][ T5845] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   56.317467][ T5845] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   56.327222][ T5845] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   56.354117][ T5845] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   56.363468][ T5855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.375039][ T5855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.423982][ T5853] hsr_slave_0: entered promiscuous mode
[   56.427083][ T5853] hsr_slave_1: entered promiscuous mode
[   56.429519][ T5853] debugfs: 'hsr0' already exists in 'hsr'
[   56.431871][ T5853] Cannot create hsr debugfs directory
[   56.467483][ T5855] team0: Port device team_slave_0 added
[   56.490665][ T5855] team0: Port device team_slave_1 added
[   56.534080][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.536405][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.545398][ T5855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.559202][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.562871][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.572427][ T5855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.659235][ T5855] hsr_slave_0: entered promiscuous mode
[   56.662995][ T5855] hsr_slave_1: entered promiscuous mode
[   56.666103][ T5855] debugfs: 'hsr0' already exists in 'hsr'
[   56.668520][ T5855] Cannot create hsr debugfs directory
[   56.840285][ T5853] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   56.862714][ T5853] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   56.870314][ T5845] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.873715][ T5853] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   56.893683][ T5853] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   56.919082][ T5845] 8021q: adding VLAN 0 to HW filter on device team0
[   56.923539][ T5855] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   56.931061][ T5855] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   56.942480][ T5855] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   56.950233][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.952952][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.959179][ T5855] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   56.970966][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.974079][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.106865][ T5853] 8021q: adding VLAN 0 to HW filter on device bond0
[   57.139417][ T5853] 8021q: adding VLAN 0 to HW filter on device team0
[   57.154726][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.157231][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.163027][ T5855] 8021q: adding VLAN 0 to HW filter on device bond0
[   57.174534][ T5855] 8021q: adding VLAN 0 to HW filter on device team0
[   57.194420][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.197474][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.202333][ T5857] Bluetooth: hci0: command tx timeout
[   57.210628][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.213974][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.243371][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.246184][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.335093][ T5845] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.361527][ T5857] Bluetooth: hci1: command tx timeout
[   57.417342][ T5845] veth0_vlan: entered promiscuous mode
[   57.432757][ T5845] veth1_vlan: entered promiscuous mode
[   57.441604][ T5857] Bluetooth: hci2: command tx timeout
[   57.495810][ T5845] veth0_macvtap: entered promiscuous mode
[   57.513934][ T5845] veth1_macvtap: entered promiscuous mode
[   57.539638][ T5853] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.550034][ T5855] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.573172][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.585730][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.607172][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.626571][   T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.645018][   T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.651850][   T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.681095][ T5855] veth0_vlan: entered promiscuous mode
[   57.704042][ T5853] veth0_vlan: entered promiscuous mode
[   57.711815][ T1089] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.714820][ T5853] veth1_vlan: entered promiscuous mode
[   57.715246][ T1089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.723887][ T5855] veth1_vlan: entered promiscuous mode
[   57.773582][ T1089] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.773962][ T5853] veth0_macvtap: entered promiscuous mode
[   57.780970][ T1089] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.789537][ T5853] veth1_macvtap: entered promiscuous mode
[   57.794440][ T5855] veth0_macvtap: entered promiscuous mode
[   57.806084][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.810675][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.825806][ T5855] veth1_macvtap: entered promiscuous mode
[   57.855224][   T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.859134][   T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.867440][ T5845] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   57.880948][   T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.887502][   T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.894078][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.916221][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.951146][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.983634][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   58.002694][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   58.061100][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   58.117313][   T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.120655][   T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.199725][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.212123][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.239727][ T5917] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1'.
[   58.296736][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.312486][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.361858][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.365243][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.269943][ T5931] Bluetooth: MGMT ver 1.23
[   59.303097][ T5857] Bluetooth: hci0: command tx timeout
[   59.441539][ T5857] Bluetooth: hci1: command tx timeout
[   59.522114][ T5857] Bluetooth: hci2: command tx timeout
[   59.662882][ T5952] loop0: detected capacity change from 0 to 256
[   59.751793][ T5899] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[   59.848661][ T5956] netlink: 12 bytes leftover after parsing attributes in process `syz.1.18'.
[   59.935245][ T5899] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[   59.945064][ T5899] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024
[   59.984558][ T5899] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[   59.994778][ T5899] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   59.997474][ T5899] usb 3-1: Product: syz
[   59.998774][ T5899] usb 3-1: Manufacturer: syz
[   60.006854][ T5899] usb 3-1: SerialNumber: syz
[   60.175604][ T5965] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   60.288858][ T5899] cdc_mbim 3-1:1.0: skipping garbage
[   60.320435][ T5961] loop1: detected capacity change from 0 to 4096
[   60.327448][ T5946] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[   60.349400][ T5961] ntfs3(loop1): Different NTFS sector size (4096) and media sector size (512).
[   60.380041][ T5961] ntfs3(loop1): Failed to initialize $Extend/$Reparse.
[   60.535424][ T5970] loop1: detected capacity change from 0 to 4096
[   60.545147][ T5970] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement.
[   60.958604][ T5946] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[   60.988925][ T5899] cdc_mbim 3-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048
[   60.994919][ T5899] cdc_mbim 3-1:1.0: setting rx_max = 2048
[   61.199134][ T5899] cdc_mbim 3-1:1.0: setting tx_max = 184
[   61.215061][ T5899] cdc_mbim 3-1:1.0: cdc-wdm0: USB WDM device
[   61.230958][ T5899] wwan wwan0: port wwan0mbim0 attached
[   61.263784][ T5899] cdc_mbim 3-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.2-1, CDC MBIM, fe:06:29:d8:d0:1a
[   61.362641][ T5857] Bluetooth: hci0: command tx timeout
[   61.513158][    T9] usb 3-1: USB disconnect, device number 2
[   61.522755][ T5857] Bluetooth: hci1: command tx timeout
[   61.546556][    T9] cdc_mbim 3-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.2-1, CDC MBIM
[   61.601954][ T5857] Bluetooth: hci2: command tx timeout
[   61.659548][    T9] wwan wwan0: port wwan0mbim0 disconnected
[   62.366629][ T6005] netlink: 'syz.2.36': attribute type 1 has an invalid length.
[   62.369226][ T6005] netlink: 8 bytes leftover after parsing attributes in process `syz.2.36'.
[   62.377182][ T6005] netlink: 'syz.2.36': attribute type 1 has an invalid length.
[   62.603554][ T6013] loop0: detected capacity change from 0 to 32768
[   62.619351][ T6013] XFS (loop0): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[   62.632292][ T6013] XFS (loop0): Ending clean mount
[   62.679058][ T5845] XFS (loop0): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[   62.821439][ T6031] netlink: 'syz.1.44': attribute type 2 has an invalid length.
[   62.833222][ T6031] netlink: 'syz.1.44': attribute type 8 has an invalid length.
[   62.836656][ T6031] netlink: 132 bytes leftover after parsing attributes in process `syz.1.44'.
[   63.048017][ T6037] loop1: detected capacity change from 0 to 32768
[   63.065974][ T6037] XFS (loop1): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[   63.095706][ T6037] XFS (loop1): Ending clean mount
[   63.103709][ T6037] XFS (loop1): Quotacheck needed: Please wait.
[   63.124992][ T6037] XFS (loop1): Quotacheck: Done.
[   63.149208][ T5853] XFS (loop1): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[   63.182361][ T5918] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[   63.360382][ T5918] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[   63.372058][ T5918] usb 1-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49
[   63.375992][ T5918] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   63.379469][ T5918] usb 1-1: Product: syz
[   63.392048][ T5918] usb 1-1: Manufacturer: syz
[   63.394151][ T5918] usb 1-1: SerialNumber: syz
[   63.409226][ T5918] usb 1-1: config 0 descriptor??
[   63.428871][ T6065] batadv1: entered promiscuous mode
[   63.601406][ T5857] Bluetooth: hci1: command tx timeout
[   63.691826][ T5857] Bluetooth: hci2: command tx timeout
[   63.704552][  T791] usb 1-1: USB disconnect, device number 2
[   64.021931][ T5918] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[   64.171448][ T5918] usb 2-1: Using ep0 maxpacket: 16
[   64.178100][ T5918] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[   64.183221][ T5918] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[   64.187601][ T5918] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[   64.192330][ T5918] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[   64.196283][ T5918] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[   64.204122][ T5918] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[   64.207768][ T5918] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[   64.210897][ T5918] usb 2-1: Manufacturer: syz
[   64.217256][ T5918] usb 2-1: config 0 descriptor??
[   64.320467][ T6081] netlink: 28 bytes leftover after parsing attributes in process `syz.2.63'.
[   64.483305][ T5918] rc_core: IR keymap rc-hauppauge not found
[   64.491323][ T5918] Registered IR keymap rc-empty
[   64.493326][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.512391][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.544247][ T5918] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0
[   64.549319][ T5918] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input4
[   64.583664][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.607453][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.631463][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.657265][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.672740][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.686171][ T6102] netlink: 1041 bytes leftover after parsing attributes in process `syz.2.72'.
[   64.692519][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.721372][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.742380][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.771610][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.795190][ T5918] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[   64.816566][ T5918] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1
[   64.820244][ T5918] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[   64.884275][ T5847] usb 2-1: USB disconnect, device number 2
[   64.962213][ T6114] netlink: 92 bytes leftover after parsing attributes in process `syz.2.77'.
[   64.965615][ T6114] netlink: 16 bytes leftover after parsing attributes in process `syz.2.77'.
[   65.434129][ T6119] loop1: detected capacity change from 0 to 1024
[   65.462929][ T6119] hfsplus: keylen 65060 too large
[   65.465488][ T6119] hfsplus: xattr searching failed
[   65.713423][ T6121] loop1: detected capacity change from 0 to 65536
[   65.744361][ T6121] XFS (loop1): Mounting V5 Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2
[   65.752772][ T6121] XFS (loop1): Ending clean mount
[   65.756852][ T6121] XFS (loop1): Quotacheck needed: Please wait.
[   65.773010][ T6121] XFS (loop1): Quotacheck: Done.
[   65.806359][ T5853] XFS (loop1): Unmounting Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2
[   65.852171][ T6137] tmpfs: Bad value for 'mpol'
[   66.056241][ T6148] warning: `syz.2.90' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   66.456160][ T6165] input: syz1 as /devices/virtual/input/input5
[   66.900103][ T6169] loop1: detected capacity change from 0 to 256
[   67.173982][ T6182] netlink: 'syz.1.105': attribute type 39 has an invalid length.
[   67.188978][ T6182] veth0_macvtap: left promiscuous mode
[   67.911385][ T5890] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[   68.025643][ T6216] netlink: 964 bytes leftover after parsing attributes in process `syz.1.121'.
[   68.110912][ T5890] usb 3-1: Using ep0 maxpacket: 16
[   68.127903][ T5890] usb 3-1: config 0 has an invalid interface number: 107 but max is 0
[   68.137093][ T5890] usb 3-1: config 0 has no interface number 0
[   68.139674][ T5890] usb 3-1: config 0 interface 107 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 255
[   68.155291][ T5890] usb 3-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60
[   68.158307][ T5890] usb 3-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3
[   68.163572][ T5890] usb 3-1: Product: syz
[   68.165440][ T5890] usb 3-1: Manufacturer: syz
[   68.167483][ T5890] usb 3-1: SerialNumber: syz
[   68.182152][ T5890] usb 3-1: config 0 descriptor??
[   68.185185][ T6196] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[   68.190093][ T6220] Bluetooth: hci0: invalid length 0, exp 2 for type 30
[   68.399864][ T5890] keyspan 3-1:0.107: Keyspan 4 port adapter converter detected
[   68.406979][ T5890] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 81
[   68.415988][ T5890] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 1
[   68.422657][ T5890] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB0
[   68.428664][ T5890] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 2
[   68.435374][ T5890] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB1
[   68.440275][ T5890] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 4
[   68.445995][ T5890] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB2
[   68.454811][ T5890] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 6
[   68.459954][ T5890] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB3
[   68.473132][ T5890] usb 3-1: USB disconnect, device number 3
[   68.489803][ T5890] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0
[   68.498135][ T5890] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1
[   68.506694][ T5890] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2
[   68.516559][ T5890] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3
[   68.523699][ T5890] keyspan 3-1:0.107: device disconnected
[   68.575244][ T6229] loop0: detected capacity change from 0 to 32768
[   68.577884][ T6229] =======================================================
[   68.577884][ T6229] WARNING: The mand mount option has been deprecated and
[   68.577884][ T6229]          and is ignored by this kernel. Remove the mand
[   68.577884][ T6229]          option from the mount to silence this warning.
[   68.577884][ T6229] =======================================================
[   68.607499][ T6229] XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[   68.627544][ T6229] XFS (loop0): Ending clean mount
[   68.631423][ T6229] XFS (loop0): Quotacheck needed: Please wait.
[   68.645845][ T6229] XFS (loop0): Quotacheck: Done.
[   68.675045][ T5845] XFS (loop0): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[   68.948157][ T6243] capability: warning: `syz.2.130' uses deprecated v2 capabilities in a way that may be insecure
[   69.043613][ T5918] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[   69.192823][ T5918] usb 1-1: Using ep0 maxpacket: 8
[   69.197591][ T5918] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b
[   69.201210][ T5918] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   69.240657][ T5918] pvrusb2: Hardware description: Terratec Grabster AV400
[   69.245429][ T5918] pvrusb2: **********
[   69.246842][ T5918] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental.
[   69.250220][ T5918] pvrusb2: Important functionality might not be entirely working.
[   69.253506][ T5918] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver.
[   69.257514][ T5918] pvrusb2: **********
[   69.341446][   T10] usb 3-1: new full-speed USB device number 4 using dummy_hcd
[   69.448934][ T2396] pvrusb2: Invalid write control endpoint
[   69.480695][ T2396] pvrusb2: Invalid write control endpoint
[   69.485219][ T2396] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work.
[   69.489306][ T2396] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device.
[   69.494474][ T2396] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups.
[   69.498794][ T2396] pvrusb2: Device being rendered inoperable
[   69.503864][ T2396] cx25840 2-0044: Unable to detect h/w, assuming cx23887
[   69.507968][ T2396] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a)
[   69.513921][   T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64
[   69.520929][ T2396] pvrusb2: Attached sub-driver cx25840
[   69.523448][   T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A
[   69.527944][   T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64
[   69.532446][ T2396] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[   69.536830][ T2396] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[   69.873834][   T10] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10
[   69.877594][   T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   69.878686][ T5916] usb 1-1: USB disconnect, device number 3
[   69.880890][   T10] usb 3-1: Product: syz
[   69.880904][   T10] usb 3-1: Manufacturer: syz
[   69.880914][   T10] usb 3-1: SerialNumber: syz
[   69.895551][   T10] usb 3-1: config 0 descriptor??
[   69.898157][ T6255] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22
[   69.904044][ T6255] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22
[   69.915581][   T10] usb 3-1: ucan: probing device on interface #0
[   70.369814][ T6279] Invalid option length (65058) for dns_resolver key
[   70.577947][   T10] ucan 3-1:0.0 can0: registered device
[   70.741470][   T10] ucan 3-1:0.0 can0: firmware string: unknown
[   70.769001][   T10] usb 3-1: USB disconnect, device number 4
[   71.367327][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[   71.370468][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   71.689154][ T6292] loop0: detected capacity change from 0 to 32768
[   71.694940][ T6292] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.151 (6292)
[   71.705584][ T6292] BTRFS info (device loop0): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[   71.709826][ T6292] BTRFS info (device loop0): using blake2b (blake2b-256-generic) checksum algorithm
[   71.713224][ T6292] BTRFS info (device loop0): using free-space-tree
[   71.768290][   T33] audit: type=1800 audit(1755132017.364:2): pid=6292 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.151" name="file1" dev="loop0" ino=260 res=0 errno=0
[   71.832547][ T6320] loop1: detected capacity change from 0 to 128
[   71.836488][ T6320] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x00067272 (sector = 1)
[   71.852524][ T5918] usb 3-1: new high-speed USB device number 5 using dummy_hcd
[   71.875227][ T5845] BTRFS info (device loop0): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[   71.878456][ T6320] FAT-fs (loop1): FAT read failed (blocknr 128)
[   72.015065][ T5918] usb 3-1: unable to get BOS descriptor or descriptor too short
[   72.019478][ T5918] usb 3-1: config 84 has an invalid interface number: 111 but max is 0
[   72.032092][ T5918] usb 3-1: config 84 has no interface number 0
[   72.034236][ T5918] usb 3-1: config 84 interface 111 has no altsetting 0
[   72.048099][ T5918] usb 3-1: language id specifier not provided by device, defaulting to English
[   72.066929][ T5918] usb 3-1: New USB device found, idVendor=0421, idProduct=046e, bcdDevice=33.f0
[   72.070472][ T5918] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   72.083475][ T5918] usb 3-1: Product: Ъ
[   72.093357][ T5918] usb 3-1: SerialNumber: 麡珏גּ줺귮癲ꋧ⌗컹야髰蹏铏܎䖎鯫湼샘婜ꁤ齯Ἑᢱ벗/￭蠾쬯ꃯ▋뵻薱⾡䴢㒟瀪慠欗삅탯睌࢔קּ狴
[   72.096802][ T6329] loop0: detected capacity change from 0 to 2048
[   72.111999][ T6329] EXT4-fs: inline encryption not supported
[   72.136885][ T6329] EXT4-fs (loop0): mounted filesystem 00000800-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   72.167351][ T5845] EXT4-fs (loop0): unmounting filesystem 00000800-0000-0000-0000-000000000000.
[   72.319899][ T5918] usb 3-1: bad CDC descriptors
[   72.332222][ T5918] usb 3-1: USB disconnect, device number 5
[   72.551232][   T33] audit: type=1326 audit(1755132018.144:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6336 comm="syz.0.162" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638af8ebe9 code=0x7ffc0000
[   72.558701][   T33] audit: type=1326 audit(1755132018.154:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6336 comm="syz.0.162" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638af8ebe9 code=0x7ffc0000
[   72.566620][   T33] audit: type=1326 audit(1755132018.154:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6336 comm="syz.0.162" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638af8ebe9 code=0x7ffc0000
[   72.576187][   T33] audit: type=1326 audit(1755132018.154:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6336 comm="syz.0.162" exe="/syz-executor" sig=0 arch=c000003e syscall=158 compat=0 ip=0x7f638af8ebe9 code=0x7ffc0000
[   72.585852][   T33] audit: type=1326 audit(1755132018.154:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6336 comm="syz.0.162" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638af8ebe9 code=0x7ffc0000
[   72.595925][   T33] audit: type=1326 audit(1755132018.154:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6336 comm="syz.0.162" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638af8ebe9 code=0x7ffc0000
[   72.603258][   T33] audit: type=1326 audit(1755132018.154:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6336 comm="syz.0.162" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638af8ebe9 code=0x7ffc0000
[   72.610940][   T33] audit: type=1326 audit(1755132018.154:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6336 comm="syz.0.162" exe="/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f638af8ebe9 code=0x7ffc0000
[   72.618525][   T33] audit: type=1326 audit(1755132018.154:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6336 comm="syz.0.162" exe="/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f638af8ebe9 code=0x7ffc0000
[   72.711889][ T3688] Bluetooth: hci3: Frame reassembly failed (-84)
[   73.031179][ T6355] dvmrp0: entered allmulticast mode
[   73.558773][ T6360] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null.
[   73.584950][ T6360] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[   74.331786][ T6371] loop2: detected capacity change from 0 to 40427
[   74.341389][ T6371] F2FS-fs (loop2): Small segment_count (9 < 1 * 24)
[   74.343711][ T6371] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock
[   74.410938][ T6371] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[   74.421884][ T6371] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0
[   74.425148][ T6371] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5
[   74.473872][ T5855] syz-executor: attempt to access beyond end of device
[   74.473872][ T5855] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[   74.479814][ T5855] CPU: 0 UID: 0 PID: 5855 Comm: syz-executor Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[   74.479828][ T5855] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   74.479834][ T5855] Call Trace:
[   74.479838][ T5855]  <TASK>
[   74.479842][ T5855]  dump_stack_lvl+0x189/0x250
[   74.479858][ T5855]  ? __pfx_dump_stack_lvl+0x10/0x10
[   74.479867][ T5855]  ? __pfx_queue_work_on+0x10/0x10
[   74.479875][ T5855]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   74.479887][ T5855]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   74.479906][ T5855]  f2fs_handle_critical_error+0x37c/0x540
[   74.479925][ T5855]  f2fs_write_end_io+0x886/0xb60
[   74.479954][ T5855]  __submit_merged_bio+0x27a/0x6a0
[   74.479973][ T5855]  __submit_merged_write_cond+0x255/0x530
[   74.479991][ T5855]  f2fs_write_data_pages+0x261d/0x3000
[   74.480030][ T5855]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[   74.480072][ T5855]  ? __lock_acquire+0xab9/0xd20
[   74.480088][ T5855]  ? do_raw_spin_lock+0x121/0x290
[   74.480104][ T5855]  ? do_raw_spin_unlock+0x4d/0x240
[   74.480116][ T5855]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[   74.480130][ T5855]  do_writepages+0x32e/0x550
[   74.480153][ T5855]  ? do_raw_spin_unlock+0x4d/0x240
[   74.480168][ T5855]  filemap_fdatawrite+0x199/0x240
[   74.480183][ T5855]  ? __pfx_filemap_fdatawrite+0x10/0x10
[   74.480221][ T5855]  ? do_raw_spin_unlock+0x4d/0x240
[   74.480231][ T5855]  f2fs_sync_dirty_inodes+0x31f/0x830
[   74.480249][ T5855]  f2fs_write_checkpoint+0x95a/0x1df0
[   74.480277][ T5855]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[   74.480324][ T5855]  ? call_rcu+0x6ff/0x9c0
[   74.480336][ T5855]  ? lockdep_hardirqs_on+0x9c/0x150
[   74.480350][ T5855]  ? kill_f2fs_super+0x298/0x6c0
[   74.480369][ T5855]  kill_f2fs_super+0x2c3/0x6c0
[   74.480388][ T5855]  ? __pfx_kill_f2fs_super+0x10/0x10
[   74.480400][ T5855]  ? radix_tree_delete_item+0x2b6/0x400
[   74.480419][ T5855]  ? shrinker_free+0x2ce/0x3e0
[   74.480442][ T5855]  deactivate_locked_super+0xbc/0x130
[   74.480455][ T5855]  cleanup_mnt+0x425/0x4c0
[   74.480464][ T5855]  ? lockdep_hardirqs_on+0x9c/0x150
[   74.480473][ T5855]  task_work_run+0x1d4/0x260
[   74.480485][ T5855]  ? __pfx_task_work_run+0x10/0x10
[   74.480493][ T5855]  ? __x64_sys_umount+0x122/0x160
[   74.480505][ T5855]  ? exit_to_user_mode_loop+0x40/0x110
[   74.480520][ T5855]  exit_to_user_mode_loop+0xec/0x110
[   74.480533][ T5855]  do_syscall_64+0x2bd/0x3b0
[   74.480544][ T5855]  ? lockdep_hardirqs_on+0x9c/0x150
[   74.480555][ T5855]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.480566][ T5855]  ? exc_page_fault+0x9f/0xf0
[   74.480579][ T5855]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.480589][ T5855] RIP: 0033:0x7f56d818ff17
[   74.480601][ T5855] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[   74.480609][ T5855] RSP: 002b:00007fff555e5b38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[   74.480623][ T5855] RAX: 0000000000000000 RBX: 00007f56d8211c05 RCX: 00007f56d818ff17
[   74.480630][ T5855] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff555e5bf0
[   74.480636][ T5855] RBP: 00007fff555e5bf0 R08: 0000000000000000 R09: 0000000000000000
[   74.480642][ T5855] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff555e6c80
[   74.480647][ T5855] R13: 00007f56d8211c05 R14: 0000000000012258 R15: 00007fff555e6cc0
[   74.480666][ T5855]  </TASK>
[   74.480671][ T5855] F2FS-fs (loop2): Stopped filesystem due to reason: 3
[   74.721568][ T5857] Bluetooth: hci3: Opcode 0x1003 failed: -110
[   74.816167][ T6382] skbuff: bad partial csum: csum=65506/2 headroom=178 headlen=65526
[   75.073624][ T6401] netlink: 60 bytes leftover after parsing attributes in process `syz.1.187'.
[   75.079102][ T6401] netlink: 60 bytes leftover after parsing attributes in process `syz.1.187'.
[   75.137568][ T6397] loop2: detected capacity change from 0 to 256
[   75.199127][ T6406] loop1: detected capacity change from 0 to 512
[   75.226033][ T6406] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   75.230301][ T6406] ext4 filesystem being mounted at /76/file2 supports timestamps until 2038-01-19 (0x7fffffff)
[   75.274651][ T6406] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000 ro.
[   75.294634][ T6406] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000 r/w.
[   75.346959][ T5853] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   76.066491][ T6418] loop1: detected capacity change from 0 to 32768
[   76.132520][ T6418] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[   76.148762][ T6418] XFS (loop1): Ending clean mount
[   76.159644][ T6418] XFS (loop1): Quotacheck needed: Please wait.
[   76.187887][ T6418] XFS (loop1): Quotacheck: Done.
[   76.238593][ T5853] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[   77.167377][ T6467] loop2: detected capacity change from 0 to 128
[   77.682781][ T6480] loop1: detected capacity change from 0 to 512
[   78.106180][   T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   78.227375][   T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   78.308870][   T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   78.382835][   T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   78.451508][ T5918] usb 2-1: new low-speed USB device number 3 using dummy_hcd
[   78.472183][ T5237] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   78.478951][ T5237] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   78.483304][ T5237] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   78.487046][ T5237] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   78.491011][ T5237] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   78.553919][ T6489] netlink: 12 bytes leftover after parsing attributes in process `syz.0.222'.
[   78.612882][ T5918] usb 2-1: config index 0 descriptor too short (expected 36, got 30)
[   78.616279][ T5918] usb 2-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config
[   78.641771][ T5918] usb 2-1: config 0 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 2
[   78.651263][ T5918] usb 2-1: config 0 interface 0 has no altsetting 0
[   78.654112][ T5918] usb 2-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.00
[   78.657887][ T5918] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   78.662304][   T12] bridge_slave_1: left allmulticast mode
[   78.669043][   T12] bridge_slave_1: left promiscuous mode
[   78.681047][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[   78.692384][ T5918] usb 2-1: config 0 descriptor??
[   78.696216][ T5918] usbhid 2-1:0.0: couldn't find an input interrupt endpoint
[   78.719431][   T12] bridge_slave_0: left allmulticast mode
[   78.724118][   T12] bridge_slave_0: left promiscuous mode
[   78.727154][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[   78.902418][ T5918] usb 2-1: USB disconnect, device number 3
[   79.063876][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   79.069109][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   79.074195][   T12] bond0 (unregistering): Released all slaves
[   79.323837][ T6486] chnl_net:caif_netlink_parms(): no params data found
[   79.342608][   T12] hsr_slave_0: left promiscuous mode
[   79.344921][   T12] hsr_slave_1: left promiscuous mode
[   79.346886][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   79.349179][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[   79.353910][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   79.356215][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[   79.369220][   T12] veth1_macvtap: left promiscuous mode
[   79.371354][   T12] veth0_macvtap: left promiscuous mode
[   79.373556][   T12] veth1_vlan: left promiscuous mode
[   79.375417][   T12] veth0_vlan: left promiscuous mode
[   79.795470][   T12] team0 (unregistering): Port device team_slave_1 removed
[   79.819093][   T12] team0 (unregistering): Port device team_slave_0 removed
[   80.470635][ T6486] bridge0: port 1(bridge_slave_0) entered blocking state
[   80.474303][ T6486] bridge0: port 1(bridge_slave_0) entered disabled state
[   80.477543][ T6486] bridge_slave_0: entered allmulticast mode
[   80.481662][ T6486] bridge_slave_0: entered promiscuous mode
[   80.486187][ T6486] bridge0: port 2(bridge_slave_1) entered blocking state
[   80.489392][ T6486] bridge0: port 2(bridge_slave_1) entered disabled state
[   80.493396][ T6486] bridge_slave_1: entered allmulticast mode
[   80.497326][ T6486] bridge_slave_1: entered promiscuous mode
[   80.560646][ T6486] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   80.564032][ T5237] Bluetooth: hci2: command tx timeout
[   80.571968][ T6486] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   80.704018][ T6486] team0: Port device team_slave_0 added
[   80.709867][ T6486] team0: Port device team_slave_1 added
[   80.748309][ T6486] batman_adv: batadv0: Adding interface: batadv_slave_0
[   80.750715][ T6486] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   80.773741][ T6486] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   80.790043][ T6486] batman_adv: batadv0: Adding interface: batadv_slave_1
[   80.793184][ T6486] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   80.802540][ T6486] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   80.905141][ T6486] hsr_slave_0: entered promiscuous mode
[   80.908322][ T6486] hsr_slave_1: entered promiscuous mode
[   80.912552][ T6486] debugfs: 'hsr0' already exists in 'hsr'
[   80.915116][ T6486] Cannot create hsr debugfs directory
[   80.930977][  T791] usb 2-1: new high-speed USB device number 4 using dummy_hcd
[   80.993619][ T5845] syz-executor (5845) used greatest stack depth: 20184 bytes left
[   81.044622][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   81.102155][  T791] usb 2-1: Using ep0 maxpacket: 8
[   81.109103][  T791] usb 2-1: config 0 has no interfaces?
[   81.116849][  T791] usb 2-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58
[   81.120564][  T791] usb 2-1: New USB device strings: Mfr=241, Product=1, SerialNumber=3
[   81.124258][  T791] usb 2-1: Product: syz
[   81.125630][  T791] usb 2-1: Manufacturer: syz
[   81.127110][  T791] usb 2-1: SerialNumber: syz
[   81.132627][  T791] usb 2-1: config 0 descriptor??
[   81.169967][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   81.264043][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   81.353240][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   81.364668][ T6486] netdevsim netdevsim3 netdevsim0: renamed from eth0
[   81.374195][ T6486] netdevsim netdevsim3 netdevsim1: renamed from eth1
[   81.414160][ T6486] netdevsim netdevsim3 netdevsim2: renamed from eth2
[   81.422615][ T6486] netdevsim netdevsim3 netdevsim3: renamed from eth3
[   81.603188][   T24] cfg80211: failed to load regulatory.db
[   81.636997][   T13] bridge_slave_1: left allmulticast mode
[   81.639391][   T13] bridge_slave_1: left promiscuous mode
[   81.659074][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[   81.659117][ T5857] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   81.665791][   T24] usb 2-1: USB disconnect, device number 4
[   81.672028][ T5857] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   81.676831][ T5857] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   81.684942][ T5857] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   81.688599][ T5857] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   81.712729][   T13] bridge_slave_0: left allmulticast mode
[   81.722062][   T13] bridge_slave_0: left promiscuous mode
[   81.724005][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[   81.972729][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   81.977208][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   81.981840][   T13] bond0 (unregistering): Released all slaves
[   82.006367][ T6486] 8021q: adding VLAN 0 to HW filter on device bond0
[   82.044855][ T6486] 8021q: adding VLAN 0 to HW filter on device team0
[   82.068828][ T1090] bridge0: port 1(bridge_slave_0) entered blocking state
[   82.071303][ T1090] bridge0: port 1(bridge_slave_0) entered forwarding state
[   82.104096][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   82.106536][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   82.191866][ T6486] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   82.208370][ T6587] loop1: detected capacity change from 0 to 164
[   82.217156][ T6587] isofs_fill_super: root inode is not a directory. Corrupted media?
[   82.280637][ T6576] chnl_net:caif_netlink_parms(): no params data found
[   82.460137][   T13] hsr_slave_0: left promiscuous mode
[   82.464665][   T13] hsr_slave_1: left promiscuous mode
[   82.466910][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   82.469377][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[   82.476537][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   82.479139][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[   82.492931][   T13] veth1_macvtap: left promiscuous mode
[   82.494840][   T13] veth0_macvtap: left promiscuous mode
[   82.497431][   T13] veth1_vlan: left promiscuous mode
[   82.499158][   T13] veth0_vlan: left promiscuous mode
[   82.650917][ T5237] Bluetooth: hci2: command tx timeout
[   82.798805][   T13] team0 (unregistering): Port device team_slave_1 removed
[   82.824988][   T13] team0 (unregistering): Port device team_slave_0 removed
[   83.139462][ T6576] bridge0: port 1(bridge_slave_0) entered blocking state
[   83.142668][ T6576] bridge0: port 1(bridge_slave_0) entered disabled state
[   83.145940][ T6576] bridge_slave_0: entered allmulticast mode
[   83.149928][ T6576] bridge_slave_0: entered promiscuous mode
[   83.173267][ T6576] bridge0: port 2(bridge_slave_1) entered blocking state
[   83.176804][ T6576] bridge0: port 2(bridge_slave_1) entered disabled state
[   83.179865][ T6576] bridge_slave_1: entered allmulticast mode
[   83.184187][ T6576] bridge_slave_1: entered promiscuous mode
[   83.246673][ T6576] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   83.266631][ T6576] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   83.315329][ T6486] 8021q: adding VLAN 0 to HW filter on device batadv0
[   83.334776][ T6576] team0: Port device team_slave_0 added
[   83.338549][ T6576] team0: Port device team_slave_1 added
[   83.383128][ T6576] batman_adv: batadv0: Adding interface: batadv_slave_0
[   83.385395][ T6576] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   83.394784][ T6576] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   83.399188][ T6576] batman_adv: batadv0: Adding interface: batadv_slave_1
[   83.401749][ T6576] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   83.410009][ T6576] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   83.448725][ T6576] hsr_slave_0: entered promiscuous mode
[   83.457560][ T6576] hsr_slave_1: entered promiscuous mode
[   83.512364][   T13] ------------[ cut here ]------------
[   83.514771][   T13] WARNING: CPU: 1 PID: 13 at net/xfrm/xfrm_state.c:3303 xfrm_state_fini+0x270/0x2f0
[   83.518069][   T13] Modules linked in:
[   83.520668][   T13] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[   83.526768][   T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   83.531630][   T13] Workqueue: netns cleanup_net
[   83.533670][   T13] RIP: 0010:xfrm_state_fini+0x270/0x2f0
[   83.535926][   T13] Code: c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 78 e0 01 f8 48 8b 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 c6 9a e2 f7 e8 61 72 9e f7 90 <0f> 0b 90 e9 fd fd ff ff e8 53 72 9e f7 90 0f 0b 90 e9 60 fe ff ff
[   83.544381][   T13] RSP: 0018:ffffc90000107898 EFLAGS: 00010293
[   83.546872][   T13] RAX: ffffffff8a21397f RBX: ffff88802abc8000 RCX: ffff88801c2d0000
[   83.550092][   T13] RDX: 0000000000000000 RSI: ffffffff8dba3401 RDI: ffff88801c2d0000
[   83.553470][   T13] RBP: ffffc900001079b0 R08: ffffffff8f62f267 R09: 1ffffffff1ec5e4c
[   83.556493][   T13] R10: dffffc0000000000 R11: fffffbfff1ec5e4d R12: ffffffff8f62d2e0
[   83.559203][   T13] R13: 1ffff92000020f40 R14: ffff88802abc9480 R15: dffffc0000000000
[   83.561930][   T13] FS:  0000000000000000(0000) GS:ffff8881a3c23000(0000) knlGS:0000000000000000
[   83.564671][   T13] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   83.566767][   T13] CR2: 00007fadddb368e5 CR3: 0000000106840000 CR4: 00000000000006f0
[   83.569815][   T13] Call Trace:
[   83.571352][   T13]  <TASK>
[   83.572530][   T13]  xfrm_net_exit+0x2d/0x70
[   83.573964][   T13]  ops_undo_list+0x49a/0x990
[   83.575420][   T13]  ? __pfx_ops_undo_list+0x10/0x10
[   83.577198][   T13]  ? do_raw_spin_unlock+0x4d/0x240
[   83.579198][   T13]  cleanup_net+0x4c5/0x800
[   83.582357][   T13]  ? __pfx_cleanup_net+0x10/0x10
[   83.584004][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[   83.585651][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[   83.587532][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[   83.589558][   T13]  process_scheduled_works+0xae1/0x17b0
[   83.591476][   T13]  ? __pfx_process_scheduled_works+0x10/0x10
[   83.593384][   T13]  worker_thread+0x8a0/0xda0
[   83.594922][   T13]  kthread+0x711/0x8a0
[   83.596295][   T13]  ? __pfx_worker_thread+0x10/0x10
[   83.598146][   T13]  ? __pfx_kthread+0x10/0x10
[   83.599917][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[   83.602369][   T13]  ? lockdep_hardirqs_on+0x9c/0x150
[   83.604496][   T13]  ? __pfx_kthread+0x10/0x10
[   83.606503][   T13]  ret_from_fork+0x3fc/0x770
[   83.608286][   T13]  ? __pfx_ret_from_fork+0x10/0x10
[   83.610127][   T13]  ? __switch_to_asm+0x39/0x70
[   83.612102][   T13]  ? __switch_to_asm+0x33/0x70
[   83.613749][   T13]  ? __pfx_kthread+0x10/0x10
[   83.615273][   T13]  ret_from_fork_asm+0x1a/0x30
[   83.616918][   T13]  </TASK>
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   83.618073][   T13] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   83.620855][   T13] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[   83.625043][   T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   83.629132][   T13] Workqueue: netns cleanup_net
[   83.631165][   T13] Call Trace:
[   83.632559][   T13]  <TASK>
[   83.633836][   T13]  dump_stack_lvl+0x99/0x250
[   83.635781][   T13]  ? __asan_memcpy+0x40/0x70
[   83.637737][   T13]  ? __pfx_dump_stack_lvl+0x10/0x10
[   83.639880][   T13]  ? __pfx__printk+0x10/0x10
[   83.641786][   T13]  vpanic+0x281/0x750
[   83.643360][   T13]  ? __pfx__printk+0x10/0x10
[   83.645103][   T13]  ? __pfx_vpanic+0x10/0x10
[   83.646617][   T13]  ? is_bpf_text_address+0x292/0x2b0
[   83.648321][   T13]  panic+0xb9/0xc0
[   83.649569][   T13]  ? __pfx_panic+0x10/0x10
[   83.651057][   T13]  __warn+0x31b/0x4b0
[   83.652350][   T13]  ? xfrm_state_fini+0x270/0x2f0
[   83.654028][   T13]  ? xfrm_state_fini+0x270/0x2f0
[   83.655785][   T13]  report_bug+0x2be/0x4f0
[   83.657227][   T13]  ? xfrm_state_fini+0x270/0x2f0
[   83.658843][   T13]  ? xfrm_state_fini+0x270/0x2f0
[   83.660557][   T13]  ? xfrm_state_fini+0x272/0x2f0
[   83.662159][   T13]  handle_bug+0x84/0x160
[   83.663523][   T13]  exc_invalid_op+0x1a/0x50
[   83.665185][   T13]  asm_exc_invalid_op+0x1a/0x20
[   83.667080][   T13] RIP: 0010:xfrm_state_fini+0x270/0x2f0
[   83.669381][   T13] Code: c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 78 e0 01 f8 48 8b 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 c6 9a e2 f7 e8 61 72 9e f7 90 <0f> 0b 90 e9 fd fd ff ff e8 53 72 9e f7 90 0f 0b 90 e9 60 fe ff ff
[   83.677319][   T13] RSP: 0018:ffffc90000107898 EFLAGS: 00010293
[   83.679858][   T13] RAX: ffffffff8a21397f RBX: ffff88802abc8000 RCX: ffff88801c2d0000
[   83.683215][   T13] RDX: 0000000000000000 RSI: ffffffff8dba3401 RDI: ffff88801c2d0000
[   83.686552][   T13] RBP: ffffc900001079b0 R08: ffffffff8f62f267 R09: 1ffffffff1ec5e4c
[   83.689888][   T13] R10: dffffc0000000000 R11: fffffbfff1ec5e4d R12: ffffffff8f62d2e0
[   83.692764][   T13] R13: 1ffff92000020f40 R14: ffff88802abc9480 R15: dffffc0000000000
[   83.695647][   T13]  ? xfrm_state_fini+0x26f/0x2f0
[   83.697774][   T13]  ? xfrm_state_fini+0x26f/0x2f0
[   83.699898][   T13]  xfrm_net_exit+0x2d/0x70
[   83.701880][   T13]  ops_undo_list+0x49a/0x990
[   83.703860][   T13]  ? __pfx_ops_undo_list+0x10/0x10
[   83.706000][   T13]  ? do_raw_spin_unlock+0x4d/0x240
[   83.708172][   T13]  cleanup_net+0x4c5/0x800
[   83.710072][   T13]  ? __pfx_cleanup_net+0x10/0x10
[   83.712162][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[   83.714401][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[   83.716862][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[   83.719247][   T13]  process_scheduled_works+0xae1/0x17b0
[   83.721576][   T13]  ? __pfx_process_scheduled_works+0x10/0x10
[   83.724068][   T13]  worker_thread+0x8a0/0xda0
[   83.726033][   T13]  kthread+0x711/0x8a0
[   83.727800][   T13]  ? __pfx_worker_thread+0x10/0x10
[   83.729988][   T13]  ? __pfx_kthread+0x10/0x10
[   83.731966][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[   83.734158][   T13]  ? lockdep_hardirqs_on+0x9c/0x150
[   83.736395][   T13]  ? __pfx_kthread+0x10/0x10
[   83.738361][   T13]  ret_from_fork+0x3fc/0x770
[   83.740295][   T13]  ? __pfx_ret_from_fork+0x10/0x10
[   83.742385][   T13]  ? __switch_to_asm+0x39/0x70
[   83.744387][   T13]  ? __switch_to_asm+0x33/0x70
[   83.746398][   T13]  ? __pfx_kthread+0x10/0x10
[   83.748340][   T13]  ret_from_fork_asm+0x1a/0x30
[   83.750371][   T13]  </TASK>
[   83.752435][   T13] Kernel Offset: disabled
[   83.754277][   T13] Rebooting in 86400 seconds..

VM DIAGNOSIS:
00:40:29  Registers:
info registers vcpu 0

CPU#0
RAX=000000000006aa6a RBX=dffffc0000000000 RCX=f8d6f652e7791b00 RDX=00000000000a7c65
RSI=ffffffff90378dac RDI=ffffffff8be325a0 RBP=ffffffff90e26dc0 RSP=ffffc90000007518
R8 =00000000000238cf R9 =ffffffff8172c195 R10=ffffc90000007638 R11=ffffffff81ac38c0
R12=ffffffff81ad647d R13=00000000000238ce R14=ffffc900000075e8 R15=000000000000ad64
RIP=ffffffff8172c34d RFL=00000216 [----AP-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055557c5c9500 ffffffff 00c00000
GS =0000 ffff8880b8623000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000562e7aae2a18 CR3=00000001063dc000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 ff00000000ff0000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000ff0000 0000000000000000 XMM05=0000000000000000 00007fd91d612e53
XMM06=0000000000000000 00007fd91d612e4d XMM07=0000000000000000 00007fd91d612e61
XMM08=0000000000000000 00007fd91d612ee7 XMM09=0000000000000000 00007fd91d612fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000035 RBX=0000000000000035 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90000107030
R8 =ffff8881069e8237 R9 =1ffff11020d3d046 R10=dffffc0000000000 R11=ffffffff854e7660
R12=dffffc0000000000 R13=ffffffff99af28c8 R14=ffffffff99de74e0 R15=0000000000000000
RIP=ffffffff854e76dc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c23000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fadddb368e5 CR3=0000000106840000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000100000001 0000003400000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000ff0000 0000000000000000 XMM05=0000000000000000 00007f94ba812e53
XMM06=0000000000000000 00007f94ba812e4d XMM07=0000000000000000 00007f94ba812e61
XMM08=0000000000000000 00007f94ba812ee7 XMM09=0000000000000000 00007f94ba812fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
