last executing test programs:

3.101640611s ago: executing program 0 (id=1):
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x3000046, &(0x7f0000000440)={[{@resuid}, {@data_err_abort}, {@barrier_val={'barrier', 0x3d, 0x1}}, {@dioread_lock}, {@grpjquota}, {@quota}, {@data_err_ignore}, {@grpquota}, {@nobh}, {@user_xattr}, {@bh}, {@minixdf}]}, 0x1, 0x553, &(0x7f0000000a40)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x40)
pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0x1}], 0x1, 0x5405, 0x800, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2, 0x11, r1, 0x0)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x3000046, &(0x7f00000004c0)={[{@delalloc}, {@data_err_abort}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@usrquota}, {@data_err_ignore}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@oldalloc}, {@grpquota}, {@noload}, {@user_xattr}, {@bh}, {@dioread_nolock}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x181042, 0x13)
fallocate(r2, 0x10, 0x63a, 0x8000)

2.9016971s ago: executing program 0 (id=4):
syz_emit_ethernet(0x22, &(0x7f0000000000)={@local, @random="429e82211cf8", @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x2, 0x0, 0x14, 0x67, 0x0, 0x2, 0x89, 0x0, @rand_addr=0x64010100, @multicast1}}}}}, 0x0)

2.77742396s ago: executing program 0 (id=5):
socket$inet_sctp(0x2, 0x5, 0x84)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
fchdir(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x142)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000041, 0x0, 0x3, 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})

2.76720756s ago: executing program 0 (id=6):
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fc, 0x301)
ioctl$USBDEVFS_DISCSIGNAL(r0, 0x8010550e, 0x0)

2.691975548s ago: executing program 0 (id=7):
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000001180)=0x2000000)
mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r0, 0x0)
ioctl$SNDCTL_DSP_GETOPTR(r0, 0x5008, 0x0)
ioctl$SNDCTL_DSP_GETOPTR(r0, 0x800c5012, &(0x7f0000000040))

2.051649704s ago: executing program 2 (id=14):
syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x1b, 0x61, 0xe3, 0x8, 0x16d0, 0x10a9, 0x3052, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0xff, 0x7f, 0x88, 0x0, [], [{{0x9, 0x5, 0x3, 0x2}}]}}]}}]}}, 0x0)

800.262861ms ago: executing program 2 (id=27):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000d40)=ANY=[@ANYBLOB="6000000010000104a0518fd50000000000000000", @ANYRES32=0x0, @ANYBLOB="096b0200000000002c00128009000100626f6e64000000001c00028006001900ff0300000800090001000000080007000300000014003500626f6e6430"], 0x60}, 0x1, 0x0, 0x0, 0x20004040}, 0x0)

738.41909ms ago: executing program 2 (id=28):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0)
sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000880)={0xf8, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MLSLVLLST={0x4}, @NLBL_CIPSOV4_A_MLSLVLLST={0xcc, 0x8, 0x0, 0x1, [{0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4310667c}, @NLBL_CIPSOV4_A_MLSLVLREM={0xfef8, 0x6, 0x40}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x97}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x59d9d7ab}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x57}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x648120bf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x68}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47b5a3eb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa3}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x75}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6f039e51}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x51}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x24}]}, {0x4c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4c7dea56}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x0, 0x5, 0x2edf784b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x11466de3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x557924e7}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x198a4289}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x69036d58}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd4}]}]}]}, 0xf8}}, 0x0)

738.130944ms ago: executing program 2 (id=29):
r0 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$TCSETS(r0, 0x40045431, 0x0)

671.349458ms ago: executing program 2 (id=30):
r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f00000000c0)=0xbc5d371c1acb29ed, 0x4)

671.18275ms ago: executing program 2 (id=31):
syz_usb_connect(0x0, 0x2d, &(0x7f0000000440)=ANY=[@ANYBLOB="12015002159d1a087d0710048a1b0102030109021b0001faf930050904042b01852e5900090506"], &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0})

129.591407ms ago: executing program 1 (id=35):
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$sock_int(r0, 0x29, 0x6, 0x0, 0x0)

129.457582ms ago: executing program 1 (id=36):
r0 = syz_open_dev$vbi(&(0x7f0000000540), 0x2, 0x2)
ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000580)={0x6, @pix={0x2, 0x1, 0x20493859, 0x0, 0x2, 0x8000, 0x7, 0x5, 0x0, 0x3, 0x1, 0x6}})

129.368649ms ago: executing program 1 (id=37):
syz_emit_ethernet(0x66, &(0x7f0000000000)={@link_local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x30, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @dev, @dev, [{0x2, 0x1, "1d6ace8f8ca9"}]}}}}}}, 0x0)

51.76822ms ago: executing program 1 (id=38):
r0 = socket$inet(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', <r1=>0x0})
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0xa4, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {0x0, 0x11}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x2, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0xb}]}}]}, 0xa4}}, 0x0)

318.152µs ago: executing program 1 (id=39):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_SYS_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x18, 0x1407, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x60}]}, 0x18}}, 0x0)

0s ago: executing program 1 (id=40):
syz_create_resource$binfmt(0x0)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="1801000001ffffeb00000000eb658e0d850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f0000000480), 0x400034f, 0x2, 0x0)
clock_settime(0x0, &(0x7f0000000240)={0x77359400})

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:21807' (ED25519) to the list of known hosts.
syzkaller login: [   49.742822][ T5833] cgroup: Unknown subsys name 'net'
[   49.833437][ T5833] cgroup: Unknown subsys name 'cpuset'
[   49.839578][ T5833] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   51.310771][ T5833] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   55.269786][ T5846] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   55.272801][ T5846] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   55.275640][ T5846] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   55.278621][ T5846] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   55.281497][ T5846] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   55.331400][ T5846] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   55.334314][ T5846] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   55.336910][ T5846] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   55.340096][ T5846] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   55.343688][ T5846] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   55.383792][   T55] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   55.388506][   T55] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   55.392257][   T55] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   55.395973][   T55] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   55.399966][   T55] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   55.420713][ T5843] chnl_net:caif_netlink_parms(): no params data found
[   55.498943][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.502101][ T5843] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.504498][ T5843] bridge_slave_0: entered allmulticast mode
[   55.507299][ T5843] bridge_slave_0: entered promiscuous mode
[   55.513172][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.515543][ T5843] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.517808][ T5843] bridge_slave_1: entered allmulticast mode
[   55.520367][ T5843] bridge_slave_1: entered promiscuous mode
[   55.551069][ T5843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.558367][ T5843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.590393][ T5843] team0: Port device team_slave_0 added
[   55.595492][ T5843] team0: Port device team_slave_1 added
[   55.613685][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.616074][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.626569][ T5843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.633334][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.636087][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.646593][ T5843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.732349][ T5843] hsr_slave_0: entered promiscuous mode
[   55.735508][ T5843] hsr_slave_1: entered promiscuous mode
[   55.812070][ T5850] chnl_net:caif_netlink_parms(): no params data found
[   55.870420][ T5848] chnl_net:caif_netlink_parms(): no params data found
[   55.944360][ T5850] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.950998][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.955059][ T5850] bridge_slave_0: entered allmulticast mode
[   55.957963][ T5850] bridge_slave_0: entered promiscuous mode
[   55.978481][ T5850] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.981235][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.983631][ T5850] bridge_slave_1: entered allmulticast mode
[   55.986523][ T5850] bridge_slave_1: entered promiscuous mode
[   55.997871][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.000171][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.002689][ T5848] bridge_slave_0: entered allmulticast mode
[   56.005286][ T5848] bridge_slave_0: entered promiscuous mode
[   56.022871][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.025258][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[   56.027514][ T5848] bridge_slave_1: entered allmulticast mode
[   56.030149][ T5848] bridge_slave_1: entered promiscuous mode
[   56.042948][ T5850] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.062169][ T5850] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.073124][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.095148][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.119614][ T5843] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   56.127354][ T5850] team0: Port device team_slave_0 added
[   56.139057][ T5843] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   56.144265][ T5850] team0: Port device team_slave_1 added
[   56.147349][ T5848] team0: Port device team_slave_0 added
[   56.156551][ T5843] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   56.161289][ T5843] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   56.166907][ T5848] team0: Port device team_slave_1 added
[   56.189008][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.191579][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.200998][ T5850] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.212657][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.215253][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.225056][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.229645][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.231933][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.239908][ T5850] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.249997][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.252548][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.262511][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.273489][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.275917][ T5843] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.278865][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.281268][ T5843] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.305334][ T5850] hsr_slave_0: entered promiscuous mode
[   56.307555][ T5850] hsr_slave_1: entered promiscuous mode
[   56.309638][ T5850] debugfs: 'hsr0' already exists in 'hsr'
[   56.312187][ T5850] Cannot create hsr debugfs directory
[   56.333824][ T5848] hsr_slave_0: entered promiscuous mode
[   56.336389][ T5848] hsr_slave_1: entered promiscuous mode
[   56.338893][ T5848] debugfs: 'hsr0' already exists in 'hsr'
[   56.343768][ T5848] Cannot create hsr debugfs directory
[   56.484191][ T1949] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.488617][ T1949] bridge0: port 2(bridge_slave_1) entered disabled state
[   56.508033][ T5843] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.539061][ T5843] 8021q: adding VLAN 0 to HW filter on device team0
[   56.545269][ T5848] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   56.553033][ T5848] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   56.560134][ T5848] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   56.568374][ T5848] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   56.574896][ T1949] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.577319][ T1949] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.594512][ T1949] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.596932][ T1949] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.645600][ T5850] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   56.652280][ T5850] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   56.657617][ T5850] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   56.662787][ T5850] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   56.737320][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.765734][ T5850] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.769614][ T5848] 8021q: adding VLAN 0 to HW filter on device team0
[   56.782544][ T5850] 8021q: adding VLAN 0 to HW filter on device team0
[   56.789541][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.792319][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.806266][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.809223][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.816799][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.819153][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.827584][ T1089] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.830660][ T1089] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.847009][ T5843] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.903184][ T5843] veth0_vlan: entered promiscuous mode
[   56.908965][ T5843] veth1_vlan: entered promiscuous mode
[   56.955513][ T5843] veth0_macvtap: entered promiscuous mode
[   56.960150][ T5843] veth1_macvtap: entered promiscuous mode
[   56.972846][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.986020][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.004383][ T5864] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.011402][ T5864] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.022773][ T5864] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.025577][ T5864] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.036896][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.073459][ T5850] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.080318][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.084831][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.116971][ T5848] veth0_vlan: entered promiscuous mode
[   57.119369][ T3577] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.123162][ T3577] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.128561][ T5850] veth0_vlan: entered promiscuous mode
[   57.134151][ T5848] veth1_vlan: entered promiscuous mode
[   57.149309][ T5850] veth1_vlan: entered promiscuous mode
[   57.165338][ T5848] veth0_macvtap: entered promiscuous mode
[   57.167470][ T5843] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   57.173526][ T5848] veth1_macvtap: entered promiscuous mode
[   57.185700][ T5850] veth0_macvtap: entered promiscuous mode
[   57.199373][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.202991][ T5909] loop0: detected capacity change from 0 to 1024
[   57.207090][ T5850] veth1_macvtap: entered promiscuous mode
[   57.212629][ T5909] =======================================================
[   57.212629][ T5909] WARNING: The mand mount option has been deprecated and
[   57.212629][ T5909]          and is ignored by this kernel. Remove the mand
[   57.212629][ T5909]          option from the mount to silence this warning.
[   57.212629][ T5909] =======================================================
[   57.226952][ T5909] EXT4-fs: Ignoring removed nobh option
[   57.229565][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.233259][ T5909] EXT4-fs: Ignoring removed bh option
[   57.246532][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.249486][ T5909] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   57.255751][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.260115][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.279282][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.284786][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.292262][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.300928][   T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.305241][   T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.313631][   T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.328039][   T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.341260][ T5846] Bluetooth: hci0: command tx timeout
[   57.355765][ T5843] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   57.393094][ T3577] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.398054][ T3577] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.420973][ T5846] Bluetooth: hci2: command tx timeout
[   57.421093][   T55] Bluetooth: hci1: command tx timeout
[   57.433012][   T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.435599][   T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.478824][ T5917] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only
[   57.479743][ T1949] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.487322][ T1949] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.500373][   T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.506328][   T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.636067][ T5929] loop1: detected capacity change from 0 to 512
[   57.639041][ T5929] EXT4-fs: Ignoring removed bh option
[   57.645237][ T5929] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem
[   57.657236][ T5929] EXT4-fs (loop1): 1 truncate cleaned up
[   57.664017][ T5929] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   57.849103][ T5934] loop2: detected capacity change from 0 to 32768
[   57.862846][ T5934] ocfs2: Slot 0 on device (7,2) was already allocated to this node!
[   57.888876][ T5934] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode.
[   57.895051][   T12] (kworker/u8:0,12,0):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #72: rec_len % 4 != 0 - offset=312, inode=13845347915746889, rec_len=25793, name_len=214
[   57.926027][ T5938] lo speed is unknown, defaulting to 1000
[   57.928874][ T5938] lo speed is unknown, defaulting to 1000
[   57.936155][ T5938] lo speed is unknown, defaulting to 1000
[   57.950716][ T5938] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   57.979196][ T5938] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[   58.046327][ T5938] lo speed is unknown, defaulting to 1000
[   58.049744][ T5938] lo speed is unknown, defaulting to 1000
[   58.052714][ T5938] lo speed is unknown, defaulting to 1000
[   58.108945][ T5934] syz.2.11 (5934) used greatest stack depth: 19528 bytes left
[   58.118575][ T5848] ocfs2: Unmounting device (7,2) on (node local)
[   58.199393][ T5944] hsr_slave_0: hsr_addr_subst_dest: Unknown node
[   58.201739][ T5944] hsr_slave_1: hsr_addr_subst_dest: Unknown node
[   58.516757][ T5883] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[   58.526972][ T5850] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   58.564138][ T5948] loop1: detected capacity change from 0 to 8
[   58.569474][ T5948] Major/Minor mismatch, trying to mount newer 5.0 filesystem
[   58.574503][ T5948] Please update your kernel
[   58.680863][ T5883] usb 3-1: Using ep0 maxpacket: 8
[   58.686374][ T5883] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[   58.696649][ T5883] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0
[   58.706700][ T5883] usb 3-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52
[   58.709861][ T5883] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   58.718698][ T5883] usb 3-1: Product: syz
[   58.720182][ T5883] usb 3-1: Manufacturer: syz
[   58.722289][ T5883] usb 3-1: SerialNumber: syz
[   58.726498][ T5883] usb 3-1: config 0 descriptor??
[   58.882718][ T5956] loop1: detected capacity change from 0 to 32768
[   58.886835][ T5956] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.19 (5956)
[   58.902229][ T5956] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[   58.911105][ T5956] BTRFS info (device loop1): using crc32c (crc32c-lib) checksum algorithm
[   58.914048][ T5956] BTRFS info (device loop1): using free-space-tree
[   58.943695][ T5883] usb 3-1: USB disconnect, device number 2
[   59.015343][ T5850] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[   59.133257][ T5979] netlink: 'syz.1.22': attribute type 10 has an invalid length.
[   59.140238][ T5979] team0: Port device dummy0 added
[   59.145276][ T5979] netlink: 'syz.1.22': attribute type 10 has an invalid length.
[   59.150839][ T5979] team0: Port device dummy0 removed
[   59.154232][ T5979] bond0: (slave dummy0): Enslaving as an active interface with an up link
[   59.306856][ T5983] loop1: detected capacity change from 0 to 32768
[   59.309810][ T5983] XFS: attr2 mount option is deprecated.
[   59.317253][ T5983] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[   59.327831][ T5983] XFS (loop1): Ending clean mount
[   59.343850][ T5850] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[   59.425103][ T5993] Illegal XDP return value 3457 on prog  (id 3) dev syz_tun, expect packet loss!
[   59.430778][   T55] Bluetooth: hci0: command tx timeout
[   59.464106][ T5997] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0)
[   59.467554][   T12] bond0: (slave bond_slave_0): interface is now down
[   59.469779][   T12] bond0: (slave bond_slave_1): interface is now down
[   59.474868][   T12] bond0: now running without any active interface!
[   59.500670][   T55] Bluetooth: hci1: command tx timeout
[   59.507976][ T5999] netlink: 40 bytes leftover after parsing attributes in process `syz.2.28'.
[   59.510997][   T55] Bluetooth: hci2: command tx timeout
[   59.526045][ T5999] netlink: 56 bytes leftover after parsing attributes in process `syz.2.28'.
[   59.619631][ T5995] loop1: detected capacity change from 0 to 32768
[   59.623550][ T5995] XFS: ikeep mount option is deprecated.
[   59.633622][ T5995] XFS (loop1): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[   59.651670][ T5995] XFS (loop1): Ending clean mount
[   59.655477][ T5995] XFS (loop1): Quotacheck needed: Please wait.
[   59.670247][ T5995] XFS (loop1): Quotacheck: Done.
[   59.693848][ T5850] XFS (loop1): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[   59.836813][ T6015] loop1: detected capacity change from 0 to 2048
[   59.850776][ T5883] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[   59.857245][ T6015] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   59.862389][ T6015] ext4 filesystem being mounted at /14/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[   59.893564][ T5850] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   60.001042][ T5883] usb 3-1: Using ep0 maxpacket: 8
[   60.004358][ T5883] usb 3-1: unable to get BOS descriptor or descriptor too short
[   60.007641][ T5883] usb 3-1: config 250 has an invalid interface number: 4 but max is 0
[   60.010192][ T5883] usb 3-1: config 250 has no interface number 0
[   60.013491][ T5883] usb 3-1: config 250 interface 4 altsetting 43 endpoint 0x6 has invalid wMaxPacketSize 0
[   60.016694][ T5883] usb 3-1: config 250 interface 4 has no altsetting 0
[   60.020502][ T5883] usb 3-1: New USB device found, idVendor=077d, idProduct=0410, bcdDevice=1b.8a
[   60.024256][ T5883] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   60.026902][ T5883] usb 3-1: Product: syz
[   60.028249][ T5883] usb 3-1: Manufacturer: syz
[   60.029730][ T5883] usb 3-1: SerialNumber: syz
[   60.053606][ T6022] loop1: detected capacity change from 0 to 32768
[   60.059216][ T6022] bcachefs (/dev/loop1): error reading default superblock: unknown checksum type 63
[   60.067112][ T6022] syz.1.34: attempt to access beyond end of device
[   60.067112][ T6022] loop1: rw=6144, sector=4611686018427418624, nr_sectors = 16 limit=32768
[   60.072172][ T6022] bcachefs (/dev/loop1): error reading superblock: checksum error, type crc32c_nonzero: got 575417db should be 49607f70IO error: -5
[   60.076754][ T6022] bcachefs: bch2_fs_get_tree() error: EIO
[   60.245721][ T5883] powermate 3-1:250.4: probe with driver powermate failed with error -5
[   60.261390][ T5883] usb 3-1: USB disconnect, device number 3
[   61.501542][   T55] Bluetooth: hci0: command tx timeout
[   61.581214][   T55] Bluetooth: hci2: command tx timeout
[   61.583059][   T55] Bluetooth: hci1: command tx timeout
[  165.500562][    C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
[  165.503486][    C0] rcu: 	(detected by 0, t=10502 jiffies, g=7325, q=466 ncpus=2)
[  165.507413][    C0] rcu: All QSes seen, last rcu_preempt kthread activity 10502 (4294953696-4294943194), jiffies_till_next_fqs=1, root ->qsmask 0x0
[  165.512676][    C0] rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g7325 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x200
[  165.517472][    C0] rcu: 	Possible timer handling issue on cpu=1 timer-softirq=2566
[  165.520744][    C0] rcu: rcu_preempt kthread starved for 10502 jiffies! g7325 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x200 ->cpu=1
[  165.525420][    C0] rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
[  165.529609][    C0] rcu: RCU grace-period kthread stack dump:
[  165.532122][    C0] task:rcu_preempt     state:R stack:26792 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00004000
[  165.537087][    C0] Call Trace:
[  165.538538][    C0]  <TASK>
[  165.539814][    C0]  __schedule+0x1798/0x4cc0
[  165.541736][    C0]  ? preempt_schedule+0xae/0xc0
[  165.543734][    C0]  ? __pfx_preempt_schedule+0x10/0x10
[  165.546033][    C0]  ? __lock_acquire+0xab9/0xd20
[  165.548173][    C0]  ? __pfx___schedule+0x10/0x10
[  165.550295][    C0]  ? schedule+0x91/0x360
[  165.552100][    C0]  schedule+0x165/0x360
[  165.553916][    C0]  schedule_timeout+0x12b/0x270
[  165.555934][    C0]  ? __pfx_schedule_timeout+0x10/0x10
[  165.558152][    C0]  ? __pfx_process_timeout+0x10/0x10
[  165.560390][    C0]  ? prepare_to_swait_event+0x341/0x380
[  165.562724][    C0]  rcu_gp_fqs_loop+0x301/0x1540
[  165.564812][    C0]  ? __pfx_rcu_gp_init+0x10/0x10
[  165.566884][    C0]  ? lockdep_hardirqs_on+0x9c/0x150
[  165.569034][    C0]  ? __pfx_rcu_gp_fqs_loop+0x10/0x10
[  165.571296][    C0]  ? _raw_spin_unlock_irq+0x2e/0x50
[  165.573513][    C0]  ? finish_swait+0xcd/0x1f0
[  165.575516][    C0]  rcu_gp_kthread+0x99/0x390
[  165.577527][    C0]  ? __pfx_rcu_gp_kthread+0x10/0x10
[  165.579744][    C0]  ? __kthread_parkme+0x7b/0x200
[  165.581851][    C0]  ? __kthread_parkme+0x1a1/0x200
[  165.584010][    C0]  kthread+0x711/0x8a0
[  165.585764][    C0]  ? __pfx_rcu_gp_kthread+0x10/0x10
[  165.587888][    C0]  ? __pfx_kthread+0x10/0x10
[  165.589757][    C0]  ? _raw_spin_unlock_irq+0x23/0x50
[  165.591816][    C0]  ? lockdep_hardirqs_on+0x9c/0x150
[  165.593974][    C0]  ? __pfx_kthread+0x10/0x10
[  165.595963][    C0]  ret_from_fork+0x3fc/0x770
[  165.597955][    C0]  ? __pfx_ret_from_fork+0x10/0x10
[  165.600157][    C0]  ? __switch_to_asm+0x39/0x70
[  165.602185][    C0]  ? __switch_to_asm+0x33/0x70
[  165.604250][    C0]  ? __pfx_kthread+0x10/0x10
[  165.606233][    C0]  ret_from_fork_asm+0x1a/0x30
[  165.608290][    C0]  </TASK>
[  165.609577][    C0] rcu: Stack dump where RCU GP kthread last ran:
[  165.612157][    C0] Sending NMI from CPU 0 to CPUs 1:
[  165.614405][    C1] NMI backtrace for cpu 1
[  165.614421][    C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) 
[  165.614433][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  165.614440][    C1] RIP: 0010:do_raw_spin_lock+0x19f/0x290
[  165.614458][    C1] Code: 20 0e 36 e0 45 48 8b 44 24 18 4a c7 04 38 00 00 00 00 65 48 8b 05 f1 36 02 11 48 3b 44 24 60 0f 85 e4 00 00 00 48 8d 65 d8 5b <41> 5c 41 5d 41 5e 41 5f 5d e9 93 22 de 09 cc e8 ed 7f 26 03 85 c0
[  165.614468][    C1] RSP: 0018:ffffc900001e0bd0 EFLAGS: 00000046
[  165.614479][    C1] RAX: 8c8520c8c0725700 RBX: ffffffff99d37a90 RCX: dffffc0000000000
[  165.614487][    C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc900001e0b80
[  165.614494][    C1] RBP: ffffc900001e0bf0 R08: 0000000000000003 R09: 0000000000000004
[  165.614501][    C1] R10: dffffc0000000000 R11: fffff5200003c170 R12: ffffffff99d37aa0
[  165.614509][    C1] R13: ffffffff99d37a98 R14: 1ffffffff33a6f54 R15: dffffc0000000000
[  165.614516][    C1] FS:  0000000000000000(0000) GS:ffff8881a3c1c000(0000) knlGS:0000000000000000
[  165.614525][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  165.614532][    C1] CR2: 0000001b3231bff8 CR3: 000000002a93e000 CR4: 00000000000006f0
[  165.614566][    C1] Call Trace:
[  165.614573][    C1]  <IRQ>
[  165.614579][    C1]  _raw_spin_lock_irqsave+0xb3/0xf0
[  165.614593][    C1]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[  165.614609][    C1]  debug_object_deactivate+0x9a/0x250
[  165.614625][    C1]  debug_deactivate+0x1d/0x200
[  165.614637][    C1]  __hrtimer_run_queues+0x2b0/0xc60
[  165.614653][    C1]  ? __pfx___hrtimer_run_queues+0x10/0x10
[  165.614667][    C1]  hrtimer_interrupt+0x45b/0xaa0
[  165.614685][    C1]  __sysvec_apic_timer_interrupt+0x10b/0x410
[  165.614699][    C1]  sysvec_apic_timer_interrupt+0xa1/0xc0
[  165.614713][    C1]  </IRQ>
[  165.614717][    C1]  <TASK>
[  165.614721][    C1]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  165.614732][    C1] RIP: 0010:pv_native_safe_halt+0x13/0x20
[  165.614745][    C1] Code: 13 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d f3 e6 0e 00 f3 0f 1e fa fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90
[  165.614752][    C1] RSP: 0018:ffffc90000177de0 EFLAGS: 00000282
[  165.614762][    C1] RAX: 8c8520c8c0725700 RBX: ffffffff81968b88 RCX: 8c8520c8c0725700
[  165.614769][    C1] RDX: 0000000000000001 RSI: ffffffff8d9b6963 RDI: ffffffff8be33300
[  165.614776][    C1] RBP: ffffc90000177f20 R08: ffff888136632f9b R09: 1ffff11026cc65f3
[  165.614783][    C1] R10: dffffc0000000000 R11: ffffed1026cc65f4 R12: ffffffff8fa37e30
[  165.614790][    C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff1102001f000
[  165.614798][    C1]  ? do_idle+0x1e8/0x510
[  165.614811][    C1]  default_idle+0x13/0x20
[  165.614819][    C1]  default_idle_call+0x74/0xb0
[  165.614829][    C1]  do_idle+0x1e8/0x510
[  165.614840][    C1]  ? __pfx_do_idle+0x10/0x10
[  165.614849][    C1]  ? _raw_spin_unlock_irqrestore+0x85/0x110
[  165.614861][    C1]  ? lockdep_hardirqs_on+0x9c/0x150
[  165.614874][    C1]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  165.614886][    C1]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  165.614901][    C1]  cpu_startup_entry+0x44/0x60
[  165.614911][    C1]  start_secondary+0x101/0x110
[  165.614926][    C1]  common_startup_64+0x13e/0x147
[  165.614946][    C1]  </TASK>

VM DIAGNOSIS:
00:55:52  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90000007430
R8 =ffff888020640237 R9 =1ffff110040c8046 R10=dffffc0000000000 R11=ffffffff854f0c30
R12=dffffc0000000000 R13=ffffffff99af98f5 R14=ffffffff99dee3a0 R15=0000000000000000
RIP=ffffffff854f0cac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007ff90330fc80 ffffffff 00c00000
GS =0000 ffff8880b861c000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055d2244cf200 CR3=000000010a9a0000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=ffffffffffff0000 0000000000000000 XMM05=2a2f332d305b2f32 2e6461680000312d
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00000000ffff0000 XMM09=332f336273752f32 2e6463685f796d6d
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=00000000ffffffff RBX=ffff88802aa7d2e8 RCX=ffffffff819e08b2 RDX=0000000000000000
RSI=0000000000000004 RDI=ffff88802aa7d2e8 RBP=ffffc900001e0c60 RSP=ffffc900001e0b98
R8 =0000000000000000 R9 =ffffffff899a6dc4 R10=dffffc0000000000 R11=ffffffff899a6d00
R12=ffff88802aa7d2f8 R13=ffff88802aa7d2f0 R14=1ffff1100554fa5f R15=1ffff1100554fa5e
RIP=ffffffff8223207a RFL=00000082 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1c000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b3231bff8 CR3=000000002a93e000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffff8167994f ffffffff8167991b
XMM02=ffffffff8167994f ffffffff8167994f XMM03=ffffffff81688452 ffffffff8168840d
XMM04=ffffffff816884cd ffffffff81688452 XMM05=ffffffff8168840d ffffffff8167994f
XMM06=ffffffff8167994f ffffffff8167994f XMM07=ffffffff8167991b ffffffff8167991b
XMM08=0000000000000000 00007f342ca12ee7 XMM09=0000000000000000 00007f342ca12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
