last executing test programs: 2m1.017784807s ago: executing program 2 (id=149): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x1020, 0x6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x50, 0xb, "", [{{0x9, 0x4, 0x0, 0xf, 0xfe, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0xc, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x420, 0xb4, 0x81, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$MPTCP_PM_CMD_ANNOUNCE(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="202329000000292383efb930a54607b71ea92694359c47"], 0x0, 0x0, 0x0, 0x0}, 0x0) 1m58.974788382s ago: executing program 2 (id=155): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x4, 0xc}, {}, {0xfff1, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@gettfilter={0x24, 0x2e, 0x1, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0xfff2, 0xffe0}, {0x0, 0xfff1}, {0xffff, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 1m56.756046945s ago: executing program 4 (id=159): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000003a80)={0x0, 0x1c, &(0x7f0000003980)=[@in6={0xa, 0x2, 0x8001, @private2, 0xffffffff}]}, &(0x7f0000003ac0)=0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x6d, &(0x7f0000000080), &(0x7f00000000c0)=0x3930) 1m55.541447354s ago: executing program 2 (id=163): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) 1m55.297960713s ago: executing program 4 (id=164): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000180)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() ptrace$peek(0x3, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000380)={'tunl0\x00', 0x0}) r3 = socket(0x1d, 0x2, 0x6) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x0, @multicast1}}, {{0x2, 0x400, @multicast2}}}, 0x108) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000480)={0x3, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @multicast2}}}, 0x108) getsockopt$nfc_llcp(r3, 0x6a, 0x1, 0x0, 0x20000071) 1m53.471135089s ago: executing program 2 (id=167): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x90) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(0xffffffffffffffff, 0x40089413, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 1m51.966286987s ago: executing program 2 (id=171): syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYRES64=0x0], 0x5) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x84) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000100)=0xc) ptrace$peek(0x3, r2, &(0x7f0000000140)) sendmsg$nl_route(r1, 0x0, 0x4040) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x40012020, 0x0, 0xfffffffffffffe08) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000380)={'tunl0\x00', &(0x7f0000000080)=@ethtool_perm_addr={0x4b, 0xe, "43488172070000000000476f6094"}}) r5 = socket(0x1d, 0x2, 0x6) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r6, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x0, @multicast1}}, {{0x2, 0x400, @multicast2}}}, 0x108) setsockopt$inet_group_source_req(r6, 0x0, 0x2e, &(0x7f0000000480)={0x3, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @multicast2}}}, 0x108) getsockopt$nfc_llcp(r5, 0x6a, 0x1, 0x0, 0x20000071) 1m51.884464168s ago: executing program 4 (id=172): syz_ublk_setup_io_uring(0x7ded, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, 0x0, 0x0) setsockopt$TIPC_SRC_DROPPABLE(r3, 0x10f, 0x80, 0x0, 0x0) r5 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) 1m49.146231524s ago: executing program 2 (id=175): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, 0x0) r5 = fsmount(r4, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup=r5, 0x6, 0x0, 0x50d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000005c0)={r7, r6, 0x15, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0}}, 0x30) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) ioctl$TUNSETDEBUG(r2, 0x400454c9, 0x0) write$cgroup_devices(r1, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d6b71ef288563"], 0xffdd) close_range(r0, 0xffffffffffffffff, 0x0) 1m49.141655287s ago: executing program 4 (id=176): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) shutdown(r3, 0x2) 1m46.837098477s ago: executing program 4 (id=179): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0x3, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x9}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendmmsg$inet(r4, &(0x7f0000000400)=[{{&(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000a80)="3532e45a2a47b082daed2070cfb7486d610cbf2c61047b598bfe9cd45d4f49e6dc94c3258897ce5d1c79245647804c273df7b1f3a090a6db8597d29d858b3192fe623f600cb431634f4182a8b945a95d3c65a8a15745fac45de5b1988172b0e1e7b06a4f3127d260c9dd68402b1c9fbc5f8f1642170dbad52b1c5c43c486a4a957b356916878cd74336ee8f570470acfc47c4fecf1dc4fa15e34231cd2416c365555ac8d16494170df8159af76b077cdea7582961b8b53c94f63f69b2cd2ddd0e70342cb024c085d413f58279cd1f023f6a70bba2764028cd6bd76b24c0cf74de2deb2", 0xe3}], 0x1}}], 0x4, 0x2400c0a2) writev(r4, &(0x7f0000000080)=[{&(0x7f0000000a40)="b0", 0x1}], 0x1) bind$inet(r3, 0x0, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x300) recvmmsg(r3, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) socket(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, 0x0, 0x0) 1m43.84980578s ago: executing program 4 (id=182): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) mknodat$null(0xffffffffffffff9c, 0x0, 0x408, 0x103) r2 = socket$packet(0x11, 0xa, 0x300) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4e, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100000008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="05000000010900"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="00000000010000000000000080000000d7c139a0d4fe372efa7e8cdba3417665ff"], 0x80}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x200000000000000) r7 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14) r8 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r8, 0x5412, &(0x7f0000000000)=0x13) ioctl$TCSETSW2(r8, 0x402c542c, &(0x7f0000000180)={0xfbfffff8, 0x1008, 0xfbfbfffd, 0x2, 0x0, "1fb73a6900f4ff0900000000000000d3861000", 0x1, 0x5}) ioctl$TIOCSTI(r8, 0x5412, &(0x7f0000000080)=0xd) sendmsg$nl_route_sched(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x1, 0x2, 0x0, {}, [{0x54, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PTYPE={0x6, 0x4}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x0, 0x20000000}}]}, {0x4}, {0xc}, {0xc, 0x9, {0x47}}}}]}]}, 0x68}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000002bc0)={0x0, 0x0, &(0x7f0000002b80)={&(0x7f0000000680)=ANY=[@ANYBLOB="340000001100010027bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="c0000000001400001400350077673200000000000000000000000000abb7f63ed35099e3411534493d89d5d38f5ddb4094e282a5183304e7a062258af3704cf100f2a91ec3acdf62b74dd0381a2de12ea13209d48c8d0f7d298d85267aae451eb08c563612a1ae92c48f3528332f468c387d5f6f90b4217fd363521bbabbe7c2d335a0282333c6cf40278321150a7f98cee666ac2680ebd8e41c1271cb36df89a1090eec507ba31eac1bbf6e82efbd0c7c9795ade9a8a36d98218187eb830eee33506f"], 0x34}, 0x1, 0x0, 0x0, 0x40000100}, 0x40004) 1m33.862064938s ago: executing program 32 (id=175): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, 0x0) r5 = fsmount(r4, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup=r5, 0x6, 0x0, 0x50d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000005c0)={r7, r6, 0x15, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0}}, 0x30) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) ioctl$TUNSETDEBUG(r2, 0x400454c9, 0x0) write$cgroup_devices(r1, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d6b71ef288563"], 0xffdd) close_range(r0, 0xffffffffffffffff, 0x0) 1m28.58146526s ago: executing program 33 (id=182): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) mknodat$null(0xffffffffffffff9c, 0x0, 0x408, 0x103) r2 = socket$packet(0x11, 0xa, 0x300) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4e, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100000008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="05000000010900"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="00000000010000000000000080000000d7c139a0d4fe372efa7e8cdba3417665ff"], 0x80}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x200000000000000) r7 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14) r8 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r8, 0x5412, &(0x7f0000000000)=0x13) ioctl$TCSETSW2(r8, 0x402c542c, &(0x7f0000000180)={0xfbfffff8, 0x1008, 0xfbfbfffd, 0x2, 0x0, "1fb73a6900f4ff0900000000000000d3861000", 0x1, 0x5}) ioctl$TIOCSTI(r8, 0x5412, &(0x7f0000000080)=0xd) sendmsg$nl_route_sched(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x1, 0x2, 0x0, {}, [{0x54, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PTYPE={0x6, 0x4}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x0, 0x20000000}}]}, {0x4}, {0xc}, {0xc, 0x9, {0x47}}}}]}]}, 0x68}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000002bc0)={0x0, 0x0, &(0x7f0000002b80)={&(0x7f0000000680)=ANY=[@ANYBLOB="340000001100010027bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="c0000000001400001400350077673200000000000000000000000000abb7f63ed35099e3411534493d89d5d38f5ddb4094e282a5183304e7a062258af3704cf100f2a91ec3acdf62b74dd0381a2de12ea13209d48c8d0f7d298d85267aae451eb08c563612a1ae92c48f3528332f468c387d5f6f90b4217fd363521bbabbe7c2d335a0282333c6cf40278321150a7f98cee666ac2680ebd8e41c1271cb36df89a1090eec507ba31eac1bbf6e82efbd0c7c9795ade9a8a36d98218187eb830eee33506f"], 0x34}, 0x1, 0x0, 0x0, 0x40000100}, 0x40004) 9.373122188s ago: executing program 3 (id=325): bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) syz_usb_connect(0x6, 0x1fc, &(0x7f0000000780)=ANY=[@ANYBLOB="12015002b8005108101407a0683e010203010902ea01030e00300309040309027f54cc00090502040004040403800109661bede31b6d40ffd5a6457d3483a7c64a2cf09c6b30e3"], 0x0) syz_emit_vhci(&(0x7f00000007c0)=ANY=[], 0x9) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x20) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) unshare(0x8000480) 8.945453552s ago: executing program 0 (id=328): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102"], 0x14}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x1c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}]}], {0x14, 0x11, 0x1, 0x4}}, 0x90}, 0x1, 0x0, 0x0, 0x2004c899}, 0x0) recvmmsg(r0, &(0x7f000000c2c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 8.511973532s ago: executing program 3 (id=330): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, @in={0x2, 0x4e23, @empty}}}, 0x90) 7.37213412s ago: executing program 0 (id=331): prlimit64(0x0, 0xe, &(0x7f0000000180)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x0, @multicast1}}, {{0x2, 0x400, @multicast2}}}, 0x108) 6.603804282s ago: executing program 1 (id=332): r0 = socket(0xa, 0x5, 0x0) listen(r0, 0x100) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @loopback=0x7f00fffd}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000300)="d9", 0x1}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000084"], 0x18, 0x48d5}, 0x20008050) 6.469464919s ago: executing program 3 (id=333): socket(0x1, 0x2, 0x3) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) socket$inet6_udp(0xa, 0x2, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = shmget(0x1, 0x4000, 0xa20, &(0x7f0000ffb000/0x4000)=nil) shmat(r5, &(0x7f0000ffd000/0x2000)=nil, 0x4000) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r6, 0x3) accept4$bt_l2cap(r6, &(0x7f0000000200), 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) 6.359611171s ago: executing program 1 (id=334): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x140d, 0x4, 0x70bd28, 0x25dfdbfc}, 0x10}, 0x1, 0x0, 0x0, 0x4008065}, 0x4014) 5.218907404s ago: executing program 1 (id=335): r0 = socket$tipc(0x1e, 0x5, 0x0) shutdown(r0, 0x0) 5.116577219s ago: executing program 3 (id=336): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x400, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000080000000000000000000001811", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 4.835408164s ago: executing program 0 (id=337): readahead(0xffffffffffffffff, 0x4c05, 0x5) 4.786425194s ago: executing program 3 (id=338): bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) syz_usb_connect(0x6, 0x1fc, &(0x7f0000000780)=ANY=[@ANYBLOB="12015002b8005108101407a0683e010203010902ea01030e00300309040309027f54cc00090502040004040403800109661bede31b6d40ffd5a6457d3483a7c64a2cf09c6b30e3"], 0x0) syz_emit_vhci(&(0x7f00000007c0)=ANY=[@ANYBLOB], 0x9) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x20) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) unshare(0x8000480) 4.786102767s ago: executing program 1 (id=339): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102"], 0x14}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x1c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}]}], {0x14, 0x11, 0x1, 0x4}}, 0x90}, 0x1, 0x0, 0x0, 0x2004c899}, 0x0) recvmmsg(r0, &(0x7f000000c2c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 4.437633078s ago: executing program 0 (id=340): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0x3, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x9}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000400)=[{{&(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000a80)="3532e45a2a47b082daed2070cfb7486d610cbf2c61047b598bfe9cd45d4f49e6dc94c3258897ce5d1c79245647804c273df7b1f3a090a6db8597d29d858b3192fe623f600cb431634f4182a8b945a95d3c65a8a15745fac45de5b1988172b0e1e7b06a4f3127d260c9dd68402b1c9fbc5f8f1642170dbad52b1c5c43c486a4a957b356916878cd74336ee8f570470acfc47c4fecf1dc4fa15e34231cd2416c365555ac8d16494170df8159af76b077cdea7582961b8b53c94f63f69b2cd2ddd0e70342cb024c085d413f58279cd1f023f6a70bba2764028cd6bd76b24c0cf74de2deb2", 0xe3}], 0x1}}], 0x4, 0x2400c0a2) writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000a40)="b0", 0x1}], 0x1) 4.35494686s ago: executing program 1 (id=341): socket$netlink(0x10, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknodat$loop(0xffffffffffffff9c, 0x0, 0x6000, 0x1) add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r3, 0x6, 0x5, &(0x7f0000000180)=0x1, 0x4) 2.160856666s ago: executing program 3 (id=342): read$FUSE(0xffffffffffffffff, &(0x7f00000021c0)={0x2020}, 0x2020) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1, 0x4, 0x0, 0xfffffffffffffff8, 0x0, 0x6}, {0x0, 0xffffffff, 0x400000003, 0xfffffffffffffffc}, 0xfffffffc, 0x0, 0x1, 0x0, 0x6}, {{@in=@private=0xa010102, 0x4, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x1c) 781.34194ms ago: executing program 0 (id=343): r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x8, 0x0, 0x180) 217.69708ms ago: executing program 1 (id=344): socket(0x1, 0x2, 0x3) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) socket$inet6_udp(0xa, 0x2, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = shmget(0x1, 0x4000, 0xa20, &(0x7f0000ffb000/0x4000)=nil) shmat(r5, &(0x7f0000ffd000/0x2000)=nil, 0x4000) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r6, 0x3) accept4$bt_l2cap(r6, &(0x7f0000000200), 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) 0s ago: executing program 0 (id=345): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4) connect$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0x541b, 0x0) socket$kcm(0x21, 0x2, 0x2) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0xf, @empty, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000ac0)=[{{&(0x7f0000000440)={0xa, 0x4e20, 0x2, @empty, 0x6}, 0x1c, &(0x7f0000000c40)=[{&(0x7f0000000300)}], 0x1}}], 0x1, 0x20080058) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) close_range(r1, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.68' (ED25519) to the list of known hosts. [ 70.710107][ T5590] cgroup: Unknown subsys name 'net' [ 70.950639][ T5590] cgroup: Unknown subsys name 'cpuset' [ 71.005745][ T5590] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 71.430300][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.430369][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.586874][ T5590] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.188097][ T5607] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.203698][ T5607] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.217283][ T5607] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.218008][ T5607] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.231318][ T5607] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.241121][ T5607] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.243560][ T5607] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.246251][ T5607] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.247282][ T5615] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.247741][ T5615] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.249373][ T5608] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.252691][ T5608] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.255814][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.263524][ T4918] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.264810][ T4918] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.351053][ T5611] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.371273][ T4918] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.384265][ T4918] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.388142][ T4918] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.388914][ T4918] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.395073][ T4918] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 76.425674][ T60] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 76.443376][ T60] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 76.447052][ T60] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 76.447705][ T60] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 78.306348][ T5611] Bluetooth: hci1: command tx timeout [ 78.306353][ T60] Bluetooth: hci0: command tx timeout [ 78.385233][ T60] Bluetooth: hci2: command tx timeout [ 78.465243][ T60] Bluetooth: hci3: command tx timeout [ 78.547798][ T60] Bluetooth: hci4: command tx timeout [ 78.616508][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.616664][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.616981][ T5605] bridge_slave_0: entered allmulticast mode [ 78.619099][ T5605] bridge_slave_0: entered promiscuous mode [ 78.654433][ T5603] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.654524][ T5603] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.654635][ T5603] bridge_slave_0: entered allmulticast mode [ 78.666939][ T5603] bridge_slave_0: entered promiscuous mode [ 78.685672][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.685796][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.686144][ T5605] bridge_slave_1: entered allmulticast mode [ 78.687495][ T5605] bridge_slave_1: entered promiscuous mode [ 78.720884][ T5603] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.720999][ T5603] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.721469][ T5603] bridge_slave_1: entered allmulticast mode [ 78.725697][ T5603] bridge_slave_1: entered promiscuous mode [ 78.869648][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.869882][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.870051][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.870206][ T5614] bridge_slave_0: entered allmulticast mode [ 78.871765][ T5614] bridge_slave_0: entered promiscuous mode [ 78.903858][ T5603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.904488][ T5604] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.904592][ T5604] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.904738][ T5604] bridge_slave_0: entered allmulticast mode [ 78.907983][ T5604] bridge_slave_0: entered promiscuous mode [ 78.920102][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.941618][ T5603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.941865][ T5604] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.942016][ T5604] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.942170][ T5604] bridge_slave_1: entered allmulticast mode [ 78.944720][ T5604] bridge_slave_1: entered promiscuous mode [ 78.967658][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.967828][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.968292][ T5613] bridge_slave_0: entered allmulticast mode [ 78.970719][ T5613] bridge_slave_0: entered promiscuous mode [ 79.025872][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.026055][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.026199][ T5613] bridge_slave_1: entered allmulticast mode [ 79.027803][ T5613] bridge_slave_1: entered promiscuous mode [ 79.028656][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.028736][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.028827][ T5614] bridge_slave_1: entered allmulticast mode [ 79.030264][ T5614] bridge_slave_1: entered promiscuous mode [ 79.091467][ T5605] team0: Port device team_slave_0 added [ 79.228435][ T5603] team0: Port device team_slave_0 added [ 79.232546][ T5604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.236996][ T5605] team0: Port device team_slave_1 added [ 79.268777][ T5603] team0: Port device team_slave_1 added [ 79.270723][ T5604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.301877][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.308185][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.350708][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.353206][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.389528][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.389539][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.389552][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.437028][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.437044][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.437067][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.441342][ T5604] team0: Port device team_slave_0 added [ 79.443306][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.443320][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.443343][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.488074][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.488090][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.488114][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.491708][ T5604] team0: Port device team_slave_1 added [ 79.513381][ T5613] team0: Port device team_slave_0 added [ 79.533748][ T5614] team0: Port device team_slave_0 added [ 79.563038][ T5613] team0: Port device team_slave_1 added [ 79.567618][ T5614] team0: Port device team_slave_1 added [ 79.631736][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.631752][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.631776][ T5604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.698608][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.698623][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.698647][ T5604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.713282][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.713296][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.713326][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.746849][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.746864][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.746887][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.774573][ T5605] hsr_slave_0: entered promiscuous mode [ 79.776414][ T5605] hsr_slave_1: entered promiscuous mode [ 79.779023][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.779036][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.779060][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.791762][ T5603] hsr_slave_0: entered promiscuous mode [ 79.792974][ T5603] hsr_slave_1: entered promiscuous mode [ 79.794514][ T5603] debugfs: 'hsr0' already exists in 'hsr' [ 79.794616][ T5603] Cannot create hsr debugfs directory [ 79.796147][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.796159][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.796182][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.038643][ T5604] hsr_slave_0: entered promiscuous mode [ 80.039467][ T5604] hsr_slave_1: entered promiscuous mode [ 80.039947][ T5604] debugfs: 'hsr0' already exists in 'hsr' [ 80.039965][ T5604] Cannot create hsr debugfs directory [ 80.071070][ T5613] hsr_slave_0: entered promiscuous mode [ 80.071800][ T5613] hsr_slave_1: entered promiscuous mode [ 80.072328][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 80.072343][ T5613] Cannot create hsr debugfs directory [ 80.089365][ T5614] hsr_slave_0: entered promiscuous mode [ 80.090498][ T5614] hsr_slave_1: entered promiscuous mode [ 80.091293][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 80.091314][ T5614] Cannot create hsr debugfs directory [ 80.385360][ T60] Bluetooth: hci1: command tx timeout [ 80.385393][ T60] Bluetooth: hci0: command tx timeout [ 80.465472][ T5611] Bluetooth: hci2: command tx timeout [ 80.545457][ T5611] Bluetooth: hci3: command tx timeout [ 80.625288][ T5611] Bluetooth: hci4: command tx timeout [ 81.118355][ T5603] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 81.181644][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.193584][ T5603] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 81.230008][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.233826][ T5603] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 81.257863][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.280846][ T5603] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 81.310946][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.400601][ T5604] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 81.441064][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.447515][ T5604] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 81.479586][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.482404][ T5604] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 81.513869][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.532303][ T5604] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 81.570799][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.717698][ T10] cfg80211: failed to load regulatory.db [ 81.818284][ T5614] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 81.851186][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.870899][ T5614] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 81.894635][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.911416][ T5614] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 81.949644][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.996209][ T5614] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 82.031507][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.179932][ T5613] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 82.210924][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.221665][ T5613] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 82.248991][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.259673][ T5613] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 82.299108][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.328166][ T5613] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 82.359724][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.465550][ T60] Bluetooth: hci1: command tx timeout [ 82.465635][ T5611] Bluetooth: hci0: command tx timeout [ 82.466219][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.502144][ T5605] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 82.539514][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.547261][ T5611] Bluetooth: hci2: command tx timeout [ 82.559803][ T5605] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 82.590259][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.602380][ T5605] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 82.625282][ T5611] Bluetooth: hci3: command tx timeout [ 82.631348][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.652032][ T5605] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 82.690464][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.716267][ T5611] Bluetooth: hci4: command tx timeout [ 82.737652][ T5604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.742604][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.793123][ T1522] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.793690][ T1522] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.843191][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.843719][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.897206][ T5604] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.940096][ T1486] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.940223][ T1486] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.968357][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.989116][ T1486] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.989209][ T1486] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.079912][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.141248][ T143] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.141516][ T143] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.175034][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.210412][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.210623][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.419514][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.424518][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.555024][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.565167][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.627268][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.627464][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.658842][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.732972][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.733044][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.810615][ T1522] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.810846][ T1522] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.313026][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.545218][ T60] Bluetooth: hci1: command tx timeout [ 84.545285][ T5611] Bluetooth: hci0: command tx timeout [ 84.551825][ T5604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.626675][ T5611] Bluetooth: hci2: command tx timeout [ 84.705270][ T5611] Bluetooth: hci3: command tx timeout [ 84.785289][ T5611] Bluetooth: hci4: command tx timeout [ 85.020891][ T5604] veth0_vlan: entered promiscuous mode [ 85.083818][ T5604] veth1_vlan: entered promiscuous mode [ 85.243096][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.277317][ T5604] veth0_macvtap: entered promiscuous mode [ 85.348922][ T5604] veth1_macvtap: entered promiscuous mode [ 85.460884][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.477403][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.517224][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.562315][ T5603] veth0_vlan: entered promiscuous mode [ 85.574105][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.574439][ T1119] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.604099][ T1119] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.626515][ T1119] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.626688][ T5614] veth0_vlan: entered promiscuous mode [ 85.632230][ T1119] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.649940][ T5603] veth1_vlan: entered promiscuous mode [ 85.801659][ T5614] veth1_vlan: entered promiscuous mode [ 86.037121][ T5613] veth0_vlan: entered promiscuous mode [ 86.141756][ T1187] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.141780][ T1187] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.155222][ T5613] veth1_vlan: entered promiscuous mode [ 86.168875][ T5603] veth0_macvtap: entered promiscuous mode [ 86.176337][ T5605] veth0_vlan: entered promiscuous mode [ 86.227731][ T5614] veth0_macvtap: entered promiscuous mode [ 86.242884][ T5603] veth1_macvtap: entered promiscuous mode [ 86.263105][ T5614] veth1_macvtap: entered promiscuous mode [ 86.293932][ T5605] veth1_vlan: entered promiscuous mode [ 86.326636][ T1486] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.326661][ T1486] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.377379][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.399489][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.402733][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.422189][ T5613] veth0_macvtap: entered promiscuous mode [ 86.451508][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.479520][ T1486] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.483467][ T5613] veth1_macvtap: entered promiscuous mode [ 86.495344][ T1486] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.501728][ T1486] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.542829][ T1486] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.562308][ T1486] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.573433][ T1486] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.574521][ T5605] veth0_macvtap: entered promiscuous mode [ 86.636000][ T1486] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.644915][ T1486] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.676561][ T5605] veth1_macvtap: entered promiscuous mode [ 86.871303][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.125694][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.322202][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.322279][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.362194][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.364813][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.394295][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.414429][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.437927][ T143] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.437946][ T143] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.546843][ T1119] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.562805][ T1119] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.627322][ T1119] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.688543][ T1119] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.709022][ T143] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.709037][ T143] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.892909][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.892929][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.232642][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.232660][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.542333][ T1486] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.542351][ T1486] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.698310][ T1486] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.698330][ T1486] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.929313][ T1486] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.929331][ T1486] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.065148][ T1522] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.065166][ T1522] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.275572][ T5846] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 94.028729][ T822] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 94.028729][ T5716] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 94.253720][ T5716] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 94.256975][ T5716] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 94.257002][ T5716] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.257020][ T5716] usb 3-1: Product: syz [ 94.257033][ T5716] usb 3-1: Manufacturer: syz [ 94.257046][ T5716] usb 3-1: SerialNumber: syz [ 94.304438][ T822] usb 4-1: Using ep0 maxpacket: 8 [ 94.340876][ T822] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 6 [ 94.340908][ T822] usb 4-1: config 0 interface 0 has no altsetting 0 [ 94.340938][ T822] usb 4-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 94.340960][ T822] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.450119][ T822] usb 4-1: config 0 descriptor?? [ 95.281823][ T822] logitech 0003:046D:C24F.0001: unknown main item tag 0x3 [ 95.281859][ T822] logitech 0003:046D:C24F.0001: unknown main item tag 0x0 [ 95.281882][ T822] logitech 0003:046D:C24F.0001: unknown main item tag 0x0 [ 95.281905][ T822] logitech 0003:046D:C24F.0001: unknown main item tag 0x0 [ 95.281928][ T822] logitech 0003:046D:C24F.0001: unknown main item tag 0x0 [ 95.281950][ T822] logitech 0003:046D:C24F.0001: unknown main item tag 0x0 [ 95.281973][ T822] logitech 0003:046D:C24F.0001: unknown main item tag 0x0 [ 95.281995][ T822] logitech 0003:046D:C24F.0001: unknown main item tag 0x0 [ 95.282018][ T822] logitech 0003:046D:C24F.0001: unknown main item tag 0x0 [ 95.282041][ T822] logitech 0003:046D:C24F.0001: unknown main item tag 0x0 [ 95.419116][ T822] logitech 0003:046D:C24F.0001: hidraw0: USB HID v0.04 Device [HID 046d:c24f] on usb-dummy_hcd.3-1/input0 [ 95.419161][ T822] logitech 0003:046D:C24F.0001: no inputs found [ 95.789389][ T822] usb 4-1: USB disconnect, device number 2 [ 95.871130][ T5716] cdc_ncm 3-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 95.871155][ T5716] cdc_ncm 3-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 95.871166][ T5716] cdc_ncm 3-1:1.0: setting rx_max = 2048 [ 96.064692][ T5716] cdc_ncm 3-1:1.0: setting tx_max = 184 [ 96.263335][ T5716] cdc_ncm 3-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.2-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 96.336013][ T5882] netlink: 'syz.1.16': attribute type 13 has an invalid length. [ 96.377959][ T5714] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 96.525541][ T5714] usb 5-1: Using ep0 maxpacket: 8 [ 96.528246][ T5714] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 96.528272][ T5714] usb 5-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 96.528295][ T5714] usb 5-1: config 0 has no interface number 0 [ 96.531970][ T5714] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 96.531997][ T5714] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.532015][ T5714] usb 5-1: Product: syz [ 96.532028][ T5714] usb 5-1: Manufacturer: syz [ 96.532042][ T5714] usb 5-1: SerialNumber: syz [ 96.642625][ T5714] usb 5-1: config 0 descriptor?? [ 96.712024][ T5716] usb 3-1: USB disconnect, device number 2 [ 96.743494][ T5714] uvcvideo 5-1:0.31: probe with driver uvcvideo failed with error -22 [ 96.781883][ T5716] cdc_ncm 3-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.2-1, CDC NCM (NO ZLP) [ 96.885383][ T5714] usb 5-1: USB disconnect, device number 2 [ 99.261323][ T36] audit: type=1326 audit(1779844249.316:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5905 comm="syz.1.25" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd60b4cce59 code=0x7ffc0000 [ 99.261370][ T36] audit: type=1326 audit(1779844249.316:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5905 comm="syz.1.25" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7fd60b4cce59 code=0x7ffc0000 [ 99.282080][ T36] audit: type=1326 audit(1779844249.316:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5905 comm="syz.1.25" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd60b4cce59 code=0x7ffc0000 [ 99.284705][ T36] audit: type=1326 audit(1779844249.336:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5905 comm="syz.1.25" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd60b4cce59 code=0x7ffc0000 [ 99.304652][ T36] audit: type=1326 audit(1779844249.356:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5905 comm="syz.1.25" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd60b4cce59 code=0x7ffc0000 [ 99.307209][ T36] audit: type=1326 audit(1779844249.366:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5905 comm="syz.1.25" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fd60b4cce59 code=0x7ffc0000 [ 99.307253][ T36] audit: type=1326 audit(1779844249.366:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5905 comm="syz.1.25" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fd60b4cce59 code=0x7ffc0000 [ 99.756868][ T5908] Illegal XDP return value 4294967294 on prog (id 4) dev syz_tun, expect packet loss! [ 99.923317][ T5912] usb usb8: usbfs: process 5912 (syz.3.28) did not claim interface 0 before use [ 100.742969][ T5934] netlink: 76 bytes leftover after parsing attributes in process `syz.2.35'. [ 101.059099][ T44] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 101.237549][ T44] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.237580][ T44] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.237601][ T44] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 101.237640][ T44] usb 4-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 101.237661][ T44] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.252622][ T44] usb 4-1: config 0 descriptor?? [ 101.721760][ T44] hid_parser_main: 28 callbacks suppressed [ 101.721782][ T44] steelseries 0003:1038:1410.0002: unknown main item tag 0x0 [ 101.721812][ T44] steelseries 0003:1038:1410.0002: unknown main item tag 0x0 [ 101.721838][ T44] steelseries 0003:1038:1410.0002: unknown main item tag 0x0 [ 101.721863][ T44] steelseries 0003:1038:1410.0002: unknown main item tag 0x0 [ 101.721889][ T44] steelseries 0003:1038:1410.0002: unknown main item tag 0x0 [ 101.721914][ T44] steelseries 0003:1038:1410.0002: unknown main item tag 0x0 [ 101.721938][ T44] steelseries 0003:1038:1410.0002: unknown main item tag 0x0 [ 101.722586][ T44] steelseries 0003:1038:1410.0002: missing HID_OUTPUT_REPORT 0 [ 101.927122][ T5737] usb 4-1: USB disconnect, device number 3 [ 105.036527][ T5977] netlink: 76 bytes leftover after parsing attributes in process `syz.3.49'. [ 112.218391][ T6034] vlan2: entered promiscuous mode [ 112.218416][ T6034] team_slave_0: entered promiscuous mode [ 112.221617][ T6034] vlan2: entered allmulticast mode [ 112.221645][ T6034] team_slave_0: entered allmulticast mode [ 115.915333][ T5738] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 116.122995][ T6077] netlink: 12 bytes leftover after parsing attributes in process `syz.1.83'. [ 117.149159][ T5738] usb 1-1: config 0 interface 0 has no altsetting 0 [ 117.149198][ T5738] usb 1-1: New USB device found, idVendor=046d, idProduct=c090, bcdDevice= 0.00 [ 117.149220][ T5738] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.157253][ T5738] usb 1-1: config 0 descriptor?? [ 118.659259][ T5738] logitech-hidpp-device 0003:046D:C090.0003: unknown main item tag 0x0 [ 118.659298][ T5738] logitech-hidpp-device 0003:046D:C090.0003: unknown main item tag 0x0 [ 118.659326][ T5738] logitech-hidpp-device 0003:046D:C090.0003: unknown main item tag 0x0 [ 118.659352][ T5738] logitech-hidpp-device 0003:046D:C090.0003: unknown main item tag 0x0 [ 118.659377][ T5738] logitech-hidpp-device 0003:046D:C090.0003: unknown main item tag 0x0 [ 118.659403][ T5738] logitech-hidpp-device 0003:046D:C090.0003: unknown main item tag 0x0 [ 118.659428][ T5738] logitech-hidpp-device 0003:046D:C090.0003: unknown main item tag 0x0 [ 118.659454][ T5738] logitech-hidpp-device 0003:046D:C090.0003: unknown main item tag 0x0 [ 118.659487][ T5738] logitech-hidpp-device 0003:046D:C090.0003: unknown main item tag 0x0 [ 118.659511][ T5738] logitech-hidpp-device 0003:046D:C090.0003: unknown main item tag 0x0 [ 118.705751][ T5738] logitech-hidpp-device 0003:046D:C090.0003: hidraw0: USB HID v0.0c Device [HID 046d:c090] on usb-dummy_hcd.0-1/input0 [ 118.749126][ T5738] usb 1-1: USB disconnect, device number 2 [ 118.851989][ T6091] fido_id[6091]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 120.656967][ T6109] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.695595][ T6109] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.913694][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 123.117950][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 123.309263][ T10] usb 1-1: config 0 has an invalid descriptor of length 247, skipping remainder of the config [ 123.361829][ T10] usb 1-1: New USB device found, idVendor=0421, idProduct=0335, bcdDevice=5f.0e [ 123.361859][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.846554][ T10] usb 1-1: config 0 descriptor?? [ 123.851631][ T10] usb 1-1: can't set config #0, error -71 [ 123.869751][ T10] usb 1-1: USB disconnect, device number 3 [ 124.591146][ T6109] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 124.598933][ T6109] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 126.915263][ T5707] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 126.967334][ T6119] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 126.967375][ T6119] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 126.967393][ T6119] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 126.985319][ T36] audit: type=1800 audit(1779844277.016:9): pid=6119 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.2.96" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 127.230570][ T1522] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.237127][ T1522] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.239075][ T1522] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.239170][ T1522] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.305273][ T5707] usb 5-1: Using ep0 maxpacket: 16 [ 127.310054][ T5707] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 127.310069][ T5707] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 127.312364][ T5707] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 127.312391][ T5707] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.312410][ T5707] usb 5-1: Product: syz [ 127.312423][ T5707] usb 5-1: Manufacturer: syz [ 127.312433][ T5707] usb 5-1: SerialNumber: syz [ 127.350302][ T5707] usb 5-1: 0:2 : does not exist [ 127.680283][ T5707] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 128.180237][ T5707] usb 5-1: USB disconnect, device number 3 [ 132.262892][ T6164] syz.0.113 (6164) used greatest stack depth: 18072 bytes left [ 132.867634][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.867699][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.015268][ T5872] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 133.318418][ T5872] usb 1-1: unable to get BOS descriptor or descriptor too short [ 133.318924][ T5872] usb 1-1: not running at top speed; connect to a high speed hub [ 133.320104][ T5872] usb 1-1: config 255 has an invalid interface number: 57 but max is 1 [ 133.320127][ T5872] usb 1-1: config 255 has an invalid interface number: 41 but max is 1 [ 133.320146][ T5872] usb 1-1: config 255 has no interface number 0 [ 133.320161][ T5872] usb 1-1: config 255 has no interface number 1 [ 133.320197][ T5872] usb 1-1: config 255 interface 57 altsetting 9 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 133.320211][ T5872] usb 1-1: config 255 interface 57 altsetting 9 endpoint 0xB has invalid maxpacket 1023, setting to 64 [ 133.320224][ T5872] usb 1-1: config 255 interface 57 has no altsetting 0 [ 133.320232][ T5872] usb 1-1: config 255 interface 41 has no altsetting 0 [ 133.322254][ T5872] usb 1-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=5b.fe [ 133.322278][ T5872] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.322296][ T5872] usb 1-1: Product: syz [ 133.322305][ T5872] usb 1-1: Manufacturer: syz [ 133.322312][ T5872] usb 1-1: SerialNumber: syz [ 134.628663][ T5872] usbhid 1-1:255.57: couldn't find an input interrupt endpoint [ 134.805266][ T5872] usb 1-1: USB disconnect, device number 4 [ 135.580166][ T6194] netlink: 4 bytes leftover after parsing attributes in process `syz.3.123'. [ 137.985219][ T5737] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 138.335210][ T5737] usb 5-1: Using ep0 maxpacket: 16 [ 138.341883][ T5737] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 138.341916][ T5737] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 138.341946][ T5737] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 138.341986][ T5737] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 138.342008][ T5737] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.395950][ T5737] usb 5-1: config 0 descriptor?? [ 138.864418][ T5737] hid_parser_main: 14 callbacks suppressed [ 138.864441][ T5737] microsoft 0003:045E:07DA.0004: unknown main item tag 0x0 [ 138.864471][ T5737] microsoft 0003:045E:07DA.0004: ignoring exceeding usage max [ 138.872284][ T5737] microsoft 0003:045E:07DA.0004: unbalanced collection at end of report description [ 138.873273][ T5737] microsoft 0003:045E:07DA.0004: parse failed [ 138.873367][ T5737] microsoft 0003:045E:07DA.0004: probe with driver microsoft failed with error -22 [ 139.036185][ T5737] usb 5-1: USB disconnect, device number 4 [ 140.482369][ T6235] netlink: 4 bytes leftover after parsing attributes in process `syz.0.137'. [ 141.754149][ T6255] netlink: 'syz.0.145': attribute type 4 has an invalid length. [ 142.979125][ T6264] netlink: 8 bytes leftover after parsing attributes in process `syz.0.148'. [ 143.425458][ T5707] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 143.589707][ T5707] usb 3-1: too many endpoints for config 0 interface 0 altsetting 15: 254, using maximum allowed: 30 [ 143.589762][ T5707] usb 3-1: config 0 interface 0 altsetting 15 endpoint 0x81 has invalid maxpacket 1056, setting to 64 [ 143.589789][ T5707] usb 3-1: config 0 interface 0 altsetting 15 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 143.589814][ T5707] usb 3-1: config 0 interface 0 has no altsetting 0 [ 143.589846][ T5707] usb 3-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice= 0.00 [ 143.589867][ T5707] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.656864][ T5707] usb 3-1: config 0 descriptor?? [ 143.659569][ T6268] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 144.149011][ T5707] belkin 0003:1020:0006.0005: unknown main item tag 0x0 [ 144.149042][ T5707] belkin 0003:1020:0006.0005: unknown main item tag 0x0 [ 144.149067][ T5707] belkin 0003:1020:0006.0005: unknown main item tag 0x0 [ 144.149090][ T5707] belkin 0003:1020:0006.0005: unknown main item tag 0x0 [ 144.149111][ T5707] belkin 0003:1020:0006.0005: unknown main item tag 0x0 [ 144.149134][ T5707] belkin 0003:1020:0006.0005: unknown main item tag 0x0 [ 144.149159][ T5707] belkin 0003:1020:0006.0005: unknown main item tag 0x0 [ 144.149182][ T5707] belkin 0003:1020:0006.0005: unknown main item tag 0x0 [ 144.149206][ T5707] belkin 0003:1020:0006.0005: unknown main item tag 0x0 [ 144.151691][ T5707] belkin 0003:1020:0006.0005: unknown main item tag 0x0 [ 144.262740][ T5707] belkin 0003:1020:0006.0005: hidraw0: USB HID v0.0c Device [HID 1020:0006] on usb-dummy_hcd.2-1/input0 [ 144.305666][ T5707] usb 3-1: USB disconnect, device number 3 [ 144.441571][ T6276] fido_id[6276]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 145.169687][ T6288] netlink: 'syz.1.156': attribute type 4 has an invalid length. [ 146.241356][ T6288] bridge0: port 2(bridge_slave_1) entered disabled state [ 146.242058][ T6288] bridge0: port 1(bridge_slave_0) entered disabled state [ 146.555149][ T6288] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 146.562922][ T6288] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 148.012741][ T5847] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.126286][ T5847] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.126602][ T5847] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.128366][ T5847] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 149.606308][ T6327] netlink: 12 bytes leftover after parsing attributes in process `syz.3.165'. [ 149.795582][ T6331] netlink: 4 bytes leftover after parsing attributes in process `syz.2.163'. [ 150.585901][ T6333] netlink: 'syz.1.166': attribute type 34 has an invalid length. [ 157.532773][ T6382] netlink: 4 bytes leftover after parsing attributes in process `syz.1.177'. [ 157.986897][ T13] Bluetooth: hci5: Frame reassembly failed (-84) [ 158.009312][ T5847] Bluetooth: hci5: Frame reassembly failed (-84) [ 159.992461][ T60] Bluetooth: hci5: command 0x1003 tx timeout [ 159.992617][ T5611] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 170.272263][ T60] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 170.321042][ T60] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 170.323028][ T60] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 170.324260][ T60] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 170.324859][ T60] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 172.465928][ T5611] Bluetooth: hci5: command tx timeout [ 174.545218][ T5611] Bluetooth: hci5: command tx timeout [ 175.188522][ T6415] netlink: 8 bytes leftover after parsing attributes in process `syz.0.187'. [ 175.205502][ T6415] netlink: 8 bytes leftover after parsing attributes in process `syz.0.187'. [ 175.205708][ T6415] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 175.459616][ T60] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 175.511524][ T60] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 175.512819][ T60] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 175.515002][ T60] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 175.541783][ T60] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 175.775282][ T6441] netlink: 12 bytes leftover after parsing attributes in process `syz.1.190'. [ 176.625276][ T5611] Bluetooth: hci5: command tx timeout [ 176.637840][ T168] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.591182][ T5611] Bluetooth: hci4: command tx timeout [ 179.275351][ T5611] Bluetooth: hci5: command tx timeout [ 180.061983][ T5611] Bluetooth: hci4: command tx timeout [ 180.976849][ T168] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.066311][ T5611] Bluetooth: hci4: command tx timeout [ 182.216546][ T6464] tipc: Started in network mode [ 182.216580][ T6464] tipc: Node identity ac14142f, cluster identity 4711 [ 182.220906][ T6464] tipc: Enabled bearer , priority 10 [ 182.266045][ T6467] tipc: Can't add remote ip to TIPC UDP multicast bearer [ 183.083204][ T168] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.135738][ T6473] v: renamed from vlan0 [ 183.419314][ T5707] tipc: Node number set to 2886997039 [ 183.608162][ T168] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.145894][ T5611] Bluetooth: hci4: command tx timeout [ 185.078553][ T6494] netlink: 12 bytes leftover after parsing attributes in process `syz.1.202'. [ 187.425584][ T168] bridge_slave_1: left allmulticast mode [ 187.425802][ T168] bridge_slave_1: left promiscuous mode [ 187.448097][ T168] bridge0: port 2(bridge_slave_1) entered disabled state [ 187.598619][ T168] bridge_slave_0: left allmulticast mode [ 187.598653][ T168] bridge_slave_0: left promiscuous mode [ 187.598844][ T168] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.448402][ T5716] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 189.086565][ T5716] usb 2-1: Using ep0 maxpacket: 8 [ 189.089220][ T5716] usb 2-1: unable to get BOS descriptor or descriptor too short [ 189.091728][ T5716] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 189.091751][ T5716] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 189.091796][ T5716] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 189.169375][ T5716] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 189.169406][ T5716] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.169425][ T5716] usb 2-1: Product: syz [ 189.169439][ T5716] usb 2-1: Manufacturer: syz [ 189.169452][ T5716] usb 2-1: SerialNumber: syz [ 191.627990][ T5716] cdc_ncm 2-1:1.0: skipping garbage [ 191.628012][ T5716] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 191.628055][ T5716] cdc_ncm 2-1:1.0: bind() failure [ 191.706456][ T5716] usb 2-1: USB disconnect, device number 2 [ 191.984878][ T6537] netlink: 12 bytes leftover after parsing attributes in process `syz.0.212'. [ 192.877468][ T168] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 192.981016][ T168] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 192.998153][ T168] bond0 (unregistering): Released all slaves [ 193.040965][ T6538] mmap: syz.1.213 (6538) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 193.433491][ T6420] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.433648][ T6420] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.433832][ T6420] bridge_slave_0: entered allmulticast mode [ 193.466580][ T6420] bridge_slave_0: entered promiscuous mode [ 193.569981][ T6420] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.570098][ T6420] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.570262][ T6420] bridge_slave_1: entered allmulticast mode [ 193.603847][ T6420] bridge_slave_1: entered promiscuous mode [ 194.528671][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.528738][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.873678][ T6554] netlink: 52 bytes leftover after parsing attributes in process `syz.0.215'. [ 195.330180][ T6420] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 195.480387][ T6420] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 195.980806][ T6429] bridge0: port 1(bridge_slave_0) entered blocking state [ 195.980945][ T6429] bridge0: port 1(bridge_slave_0) entered disabled state [ 195.981171][ T6429] bridge_slave_0: entered allmulticast mode [ 195.991096][ T6429] bridge_slave_0: entered promiscuous mode [ 196.050318][ T6562] netlink: 52 bytes leftover after parsing attributes in process `syz.0.217'. [ 196.300867][ T6562] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.302262][ T6562] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.331594][ T6429] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.331718][ T6429] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.331926][ T6429] bridge_slave_1: entered allmulticast mode [ 196.334545][ T6429] bridge_slave_1: entered promiscuous mode [ 197.931499][ T6420] team0: Port device team_slave_0 added [ 197.971333][ T6420] team0: Port device team_slave_1 added [ 198.977028][ T6429] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 199.062252][ T6429] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 199.064869][ T6420] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 199.064883][ T6420] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 199.064907][ T6420] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 199.178504][ T6420] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 199.178520][ T6420] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 199.178551][ T6420] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 199.233213][ T5264] 8021q: adding VLAN 0 to HW filter on device eth1 [ 199.326628][ T6429] team0: Port device team_slave_0 added [ 199.597628][ T6592] netlink: 12 bytes leftover after parsing attributes in process `syz.3.222'. [ 200.435220][ T168] hsr_slave_0: left promiscuous mode [ 200.455195][ T168] hsr_slave_1: left promiscuous mode [ 200.455997][ T168] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 200.456069][ T168] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 200.498661][ T168] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 200.498684][ T168] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 200.559015][ T168] veth1_macvtap: left promiscuous mode [ 200.559226][ T168] veth0_macvtap: left promiscuous mode [ 200.559387][ T168] veth1_vlan: left promiscuous mode [ 200.559555][ T168] veth0_vlan: left promiscuous mode [ 201.060358][ T6597] kvm: apic: phys broadcast and lowest prio [ 201.306302][ T168] team0 (unregistering): Port device team_slave_1 removed [ 201.355975][ T168] team0 (unregistering): Port device team_slave_0 removed [ 201.532903][ T5611] Bluetooth: hci1: command 0x0406 tx timeout [ 201.543563][ T6429] team0: Port device team_slave_1 added [ 201.585284][ T5611] Bluetooth: hci3: command 0x0406 tx timeout [ 201.595593][ T5611] Bluetooth: hci2: command 0x0406 tx timeout [ 201.887512][ T6601] netlink: 52 bytes leftover after parsing attributes in process `syz.1.226'. [ 201.946766][ T6604] netlink: 76 bytes leftover after parsing attributes in process `syz.1.226'. [ 201.997806][ T6420] hsr_slave_0: entered promiscuous mode [ 201.998768][ T6420] hsr_slave_1: entered promiscuous mode [ 201.999265][ T6420] debugfs: 'hsr0' already exists in 'hsr' [ 201.999286][ T6420] Cannot create hsr debugfs directory [ 202.001408][ T6604] netlink: 52 bytes leftover after parsing attributes in process `syz.1.226'. [ 202.006246][ T6429] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 202.006261][ T6429] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 202.006292][ T6429] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 202.026034][ T6429] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 202.026049][ T6429] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 202.026074][ T6429] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 202.106405][ T36] audit: type=1326 audit(1779844352.156:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6598 comm="syz.0.225" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f6f7c5ce1d9 code=0x7ffc0000 [ 202.112407][ T36] audit: type=1326 audit(1779844352.166:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6598 comm="syz.0.225" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f6f7c5ce1d9 code=0x7ffc0000 [ 202.112456][ T36] audit: type=1326 audit(1779844352.166:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6598 comm="syz.0.225" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f6f7c5ce1d9 code=0x7ffc0000 [ 202.114062][ T36] audit: type=1326 audit(1779844352.166:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6598 comm="syz.0.225" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f6f7c5ce1d9 code=0x7ffc0000 [ 202.118982][ T36] audit: type=1326 audit(1779844352.166:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6598 comm="syz.0.225" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f6f7c5ce1d9 code=0x7ffc0000 [ 202.119100][ T36] audit: type=1326 audit(1779844352.176:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6598 comm="syz.0.225" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f6f7c5ce1d9 code=0x7ffc0000 [ 202.121177][ T36] audit: type=1326 audit(1779844352.176:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6598 comm="syz.0.225" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f6f7c5ce1d9 code=0x7ffc0000 [ 202.124421][ T36] audit: type=1326 audit(1779844352.176:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6598 comm="syz.0.225" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f6f7c5ce1d9 code=0x7ffc0000 [ 202.134054][ T36] audit: type=1326 audit(1779844352.186:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6598 comm="syz.0.225" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f6f7c5ce1d9 code=0x7ffc0000 [ 202.134100][ T36] audit: type=1326 audit(1779844352.186:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6598 comm="syz.0.225" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f6f7c5ce1d9 code=0x7ffc0000 [ 202.732845][ T6429] hsr_slave_0: entered promiscuous mode [ 202.743107][ T6429] hsr_slave_1: entered promiscuous mode [ 202.744000][ T6429] debugfs: 'hsr0' already exists in 'hsr' [ 202.744023][ T6429] Cannot create hsr debugfs directory [ 202.765145][ T5707] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 202.915935][ T5707] usb 2-1: Using ep0 maxpacket: 32 [ 202.918377][ T5707] usb 2-1: unable to get BOS descriptor or descriptor too short [ 202.941940][ T5707] usb 2-1: New USB device found, idVendor=0582, idProduct=0102, bcdDevice= 0.40 [ 202.941968][ T5707] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.941987][ T5707] usb 2-1: Product: syz [ 202.942001][ T5707] usb 2-1: Manufacturer: syz [ 202.942014][ T5707] usb 2-1: SerialNumber: syz [ 203.315689][ T5707] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 203.714938][ T5707] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 203.928720][ T6442] udevd[6442]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 204.408465][ T5264] 8021q: adding VLAN 0 to HW filter on device eth2 [ 205.560338][ T5738] usb 2-1: USB disconnect, device number 3 [ 205.887919][ T168] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.369660][ T6655] netlink: 12 bytes leftover after parsing attributes in process `syz.1.235'. [ 207.169508][ T5264] 8021q: adding VLAN 0 to HW filter on device eth3 [ 207.459857][ T168] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 207.793819][ T6420] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 208.529144][ T6420] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 208.547716][ T6420] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 208.686827][ T6420] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 209.063101][ T168] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 209.149139][ T6420] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 209.234076][ T6420] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 209.394788][ T6420] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 209.441775][ T6420] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 209.446201][ T5264] 8021q: adding VLAN 0 to HW filter on device eth4 [ 210.647416][ T168] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.777587][ T6429] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 212.906055][ T6429] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 212.949396][ T6429] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 212.992011][ T6429] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 213.018688][ T6429] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 213.066371][ T6429] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 213.099751][ T6429] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 213.158097][ T6429] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 213.237767][ T6725] netlink: 12 bytes leftover after parsing attributes in process `syz.0.247'. [ 214.513278][ T6420] 8021q: adding VLAN 0 to HW filter on device bond0 [ 215.595739][ T168] bridge_slave_1: left allmulticast mode [ 215.595771][ T168] bridge_slave_1: left promiscuous mode [ 215.596034][ T168] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.836749][ T168] bridge_slave_0: left allmulticast mode [ 216.836783][ T168] bridge_slave_0: left promiscuous mode [ 216.837023][ T168] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.207807][ T168] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 218.296597][ T168] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 218.337571][ T168] bond0 (unregistering): Released all slaves [ 218.434644][ T5264] 8021q: adding VLAN 0 to HW filter on device eth5 [ 218.434913][ T6764] tipc: Enabling of bearer rejected, already enabled [ 218.455418][ T6772] bridge0: port 3(syz_tun) entered blocking state [ 218.455490][ T6772] bridge0: port 3(syz_tun) entered disabled state [ 218.521304][ T6772] syz_tun: entered allmulticast mode [ 218.530853][ T6772] syz_tun: entered promiscuous mode [ 218.612811][ T6766] tipc: Can't add remote ip to TIPC UDP multicast bearer [ 218.693608][ T6420] 8021q: adding VLAN 0 to HW filter on device team0 [ 218.732522][ T1522] bridge0: port 1(bridge_slave_0) entered blocking state [ 218.732699][ T1522] bridge0: port 1(bridge_slave_0) entered forwarding state [ 218.758129][ T6784] netlink: 32 bytes leftover after parsing attributes in process `syz.0.258'. [ 218.758296][ T6784] netlink: 32 bytes leftover after parsing attributes in process `syz.0.258'. [ 218.758359][ T6784] Zero length message leads to an empty skb [ 219.527428][ T1187] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.527565][ T1187] bridge0: port 2(bridge_slave_1) entered forwarding state [ 219.708463][ T6429] 8021q: adding VLAN 0 to HW filter on device bond0 [ 219.963104][ T6429] 8021q: adding VLAN 0 to HW filter on device team0 [ 220.023426][ T1119] bridge0: port 1(bridge_slave_0) entered blocking state [ 220.030667][ T1119] bridge0: port 1(bridge_slave_0) entered forwarding state [ 223.388869][ T6812] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 223.388908][ T6812] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 223.388927][ T6812] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 223.596574][ T5264] 8021q: adding VLAN 0 to HW filter on device eth6 [ 223.616848][ T1187] bridge0: port 2(bridge_slave_1) entered blocking state [ 223.621508][ T1187] bridge0: port 2(bridge_slave_1) entered forwarding state [ 224.397743][ T168] hsr_slave_0: left promiscuous mode [ 224.436244][ T168] hsr_slave_1: left promiscuous mode [ 224.437157][ T168] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 224.437180][ T168] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 224.488241][ T168] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 224.488268][ T168] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 224.803467][ T168] veth1_macvtap: left promiscuous mode [ 224.803560][ T168] veth0_macvtap: left promiscuous mode [ 224.803780][ T168] veth1_vlan: left promiscuous mode [ 224.803936][ T168] veth0_vlan: left promiscuous mode [ 227.159224][ T168] team0 (unregistering): Port device team_slave_1 removed [ 227.195911][ T168] team0 (unregistering): Port device team_slave_0 removed [ 228.407425][ T5264] 8021q: adding VLAN 0 to HW filter on device eth7 [ 229.913273][ T6420] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 229.931247][ T6429] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 230.721193][ T5264] 8021q: adding VLAN 0 to HW filter on device eth8 [ 231.413864][ T5608] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 231.473293][ T5608] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 231.482955][ T5608] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 231.485140][ T5608] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 231.485801][ T5608] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 231.702390][ T6429] veth0_vlan: entered promiscuous mode [ 231.775346][ T6429] veth1_vlan: entered promiscuous mode [ 233.666023][ T5608] Bluetooth: hci0: command tx timeout [ 233.899671][ T6429] veth0_macvtap: entered promiscuous mode [ 233.917151][ T6429] veth1_macvtap: entered promiscuous mode [ 234.093205][ T6429] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 234.304069][ T6429] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 235.044250][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.045557][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.051807][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.052650][ T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.758882][ T5608] Bluetooth: hci0: command tx timeout [ 236.056576][ T60] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 236.155801][ T60] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 236.158065][ T60] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 236.185467][ T60] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 236.194793][ T60] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 237.825241][ T60] Bluetooth: hci0: command tx timeout [ 238.396168][ T5608] Bluetooth: hci5: command tx timeout [ 239.926933][ T5608] Bluetooth: hci0: command tx timeout [ 240.518830][ T5608] Bluetooth: hci5: command tx timeout [ 242.212002][ T5608] block nbd1: Receive control failed (result -107) [ 242.261720][ T7043] nbd1: detected capacity change from 0 to 8589934592 [ 242.310291][ T6530] block nbd1: Dead connection, failed to find a fallback [ 242.310317][ T6530] block nbd1: shutting down sockets [ 242.311508][ T6530] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 242.311704][ T6530] Buffer I/O error on dev nbd1, logical block 0, async page read [ 242.312007][ T6530] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 242.312030][ T6530] Buffer I/O error on dev nbd1, logical block 0, async page read [ 242.312172][ T6530] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 242.312192][ T6530] Buffer I/O error on dev nbd1, logical block 0, async page read [ 242.312331][ T6530] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 242.312352][ T6530] Buffer I/O error on dev nbd1, logical block 0, async page read [ 242.312487][ T6530] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 242.312508][ T6530] Buffer I/O error on dev nbd1, logical block 0, async page read [ 242.312668][ T6530] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 242.312688][ T6530] Buffer I/O error on dev nbd1, logical block 0, async page read [ 242.312842][ T6530] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 242.312862][ T6530] Buffer I/O error on dev nbd1, logical block 0, async page read [ 242.313010][ T6530] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 242.313030][ T6530] Buffer I/O error on dev nbd1, logical block 0, async page read [ 242.313117][ T6530] ldm_validate_partition_table(): Disk read failed. [ 242.313180][ T6530] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 242.313200][ T6530] Buffer I/O error on dev nbd1, logical block 0, async page read [ 242.313338][ T6530] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 242.313358][ T6530] Buffer I/O error on dev nbd1, logical block 0, async page read [ 242.313695][ T6530] Dev nbd1: unable to read RDB block 0 [ 242.314443][ T6530] nbd1: unable to read partition table [ 242.545671][ T5608] Bluetooth: hci5: command tx timeout [ 242.584318][ T6530] ldm_validate_partition_table(): Disk read failed. [ 242.584602][ T6530] Dev nbd1: unable to read RDB block 0 [ 242.600720][ T6530] nbd1: unable to read partition table [ 243.945306][ T6923] bridge0: port 1(bridge_slave_0) entered blocking state [ 243.947541][ T6923] bridge0: port 1(bridge_slave_0) entered disabled state [ 243.947762][ T6923] bridge_slave_0: entered allmulticast mode [ 243.976041][ T6923] bridge_slave_0: entered promiscuous mode [ 244.029654][ T6923] bridge0: port 2(bridge_slave_1) entered blocking state [ 244.029735][ T6923] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.030402][ T6923] bridge_slave_1: entered allmulticast mode [ 244.086348][ T6923] bridge_slave_1: entered promiscuous mode [ 244.362917][ T6923] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 244.399286][ T6923] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 244.626526][ T5608] Bluetooth: hci5: command tx timeout [ 244.703327][ T7090] bridge_slave_0: left allmulticast mode [ 244.703356][ T7090] bridge_slave_0: left promiscuous mode [ 244.703671][ T7090] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.846994][ T7090] bridge_slave_1: left allmulticast mode [ 244.847015][ T7090] bridge_slave_1: left promiscuous mode [ 244.851741][ T7090] bridge0: port 2(bridge_slave_1) entered disabled state [ 245.048129][ T7090] bond0: (slave bond_slave_0): Releasing backup interface [ 245.126097][ T7090] bond0: (slave bond_slave_1): Releasing backup interface [ 245.212667][ T7090] team0: Port device team_slave_0 removed [ 245.248394][ T7090] team0: Port device team_slave_1 removed [ 245.248990][ T7090] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 245.249013][ T7090] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 245.296998][ T7090] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 245.297016][ T7090] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 245.337142][ T7090] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 245.472672][ T7093] team0: Mode changed to "random" [ 245.498308][ T6923] team0: Port device team_slave_0 added [ 245.549883][ T6923] team0: Port device team_slave_1 added [ 245.682535][ T6923] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 245.682550][ T6923] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 245.682573][ T6923] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 245.740758][ T6923] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 245.740773][ T6923] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 245.740797][ T6923] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 245.955345][ T1522] bridge_slave_1: left allmulticast mode [ 245.955381][ T1522] bridge_slave_1: left promiscuous mode [ 245.955628][ T1522] bridge0: port 2(bridge_slave_1) entered disabled state [ 247.610198][ T1522] bridge_slave_0: left allmulticast mode [ 247.610233][ T1522] bridge_slave_0: left promiscuous mode [ 247.625822][ T1522] bridge0: port 1(bridge_slave_0) entered disabled state [ 248.455119][ T5592] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 248.605164][ T5592] usb 4-1: Using ep0 maxpacket: 8 [ 248.607605][ T5592] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 248.607629][ T5592] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 248.607761][ T5592] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 248.607784][ T5592] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.667440][ T5592] hub 4-1:1.0: bad descriptor, ignoring hub [ 248.667475][ T5592] hub 4-1:1.0: probe with driver hub failed with error -5 [ 248.891579][ T7121] usb usb5: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 249.215470][ T5592] usb 4-1: USB disconnect, device number 4 [ 249.586281][ T1522] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 249.657294][ T1522] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 249.709767][ T1522] bond0 (unregistering): Released all slaves [ 249.875752][ T6923] hsr_slave_0: entered promiscuous mode [ 249.881835][ T6923] hsr_slave_1: entered promiscuous mode [ 249.898693][ T6923] debugfs: 'hsr0' already exists in 'hsr' [ 249.898718][ T6923] Cannot create hsr debugfs directory [ 250.350959][ T1522] hsr_slave_0: left promiscuous mode [ 250.369292][ T1522] hsr_slave_1: left promiscuous mode [ 250.370250][ T1522] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 250.422471][ T1522] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 250.899534][ T7161] netlink: 12 bytes leftover after parsing attributes in process `syz.0.319'. [ 253.245720][ T1522] team0 (unregistering): Port device team_slave_1 removed [ 253.286632][ T1522] team0 (unregistering): Port device team_slave_0 removed [ 253.677380][ T5608] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 253.677428][ T5608] CPU: 0 UID: 0 PID: 5608 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 253.677452][ T5608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 253.677470][ T5608] Workqueue: hci1 hci_rx_work [ 253.677533][ T5608] Call Trace: [ 253.677540][ T5608] [ 253.677550][ T5608] dump_stack_lvl+0xe8/0x150 [ 253.677577][ T5608] sysfs_create_dir_ns+0x271/0x2a0 [ 253.677617][ T5608] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 253.677645][ T5608] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 253.677679][ T5608] ? rt_spin_unlock+0x160/0x200 [ 253.677707][ T5608] kobject_add_internal+0x631/0xd10 [ 253.677738][ T5608] kobject_add+0x163/0x240 [ 253.677764][ T5608] ? __pfx_kobject_add+0x10/0x10 [ 253.677793][ T5608] ? get_device_parent+0x370/0x3a0 [ 253.677827][ T5608] device_add+0x408/0xbb0 [ 253.677860][ T5608] hci_conn_add_sysfs+0xd5/0x210 [ 253.677892][ T5608] le_conn_complete_evt+0x10e6/0x16b0 [ 253.677924][ T5608] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 253.677948][ T5608] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 253.677978][ T5608] ? lockdep_hardirqs_on+0x7a/0x110 [ 253.677999][ T5608] ? skb_pull_data+0xfb/0x200 [ 253.678025][ T5608] hci_le_conn_complete_evt+0x187/0x470 [ 253.678055][ T5608] hci_event_packet+0x659/0xef0 [ 253.678089][ T5608] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 253.678113][ T5608] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 253.678132][ T5608] ? __pfx_hci_event_packet+0x10/0x10 [ 253.678160][ T5608] ? rt_spin_unlock+0x14f/0x200 [ 253.678194][ T5608] ? hci_send_to_monitor+0xe2/0x590 [ 253.678221][ T5608] hci_rx_work+0x3ee/0x1040 [ 253.678257][ T5608] ? process_scheduled_works+0xa70/0x1860 [ 253.678280][ T5608] process_scheduled_works+0xb5d/0x1860 [ 253.678331][ T5608] ? __pfx_process_scheduled_works+0x10/0x10 [ 253.678358][ T5608] ? assign_work+0x3d5/0x5e0 [ 253.678383][ T5608] worker_thread+0xa53/0xfc0 [ 253.678430][ T5608] kthread+0x388/0x470 [ 253.678456][ T5608] ? __pfx_worker_thread+0x10/0x10 [ 253.678476][ T5608] ? __pfx_kthread+0x10/0x10 [ 253.678502][ T5608] ret_from_fork+0x514/0xb70 [ 253.678527][ T5608] ? __pfx_ret_from_fork+0x10/0x10 [ 253.678548][ T5608] ? __switch_to+0xc79/0x1410 [ 253.678590][ T5608] ? __pfx_kthread+0x10/0x10 [ 253.678618][ T5608] ret_from_fork_asm+0x1a/0x30 [ 253.678659][ T5608] [ 253.683113][ T5608] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 253.683161][ T5608] Bluetooth: hci1: failed to register connection device [ 254.163459][ T5264] 8021q: adding VLAN 0 to HW filter on device eth9 [ 254.348153][ T6978] bridge0: port 1(bridge_slave_0) entered blocking state [ 254.348262][ T6978] bridge0: port 1(bridge_slave_0) entered disabled state [ 254.348466][ T6978] bridge_slave_0: entered allmulticast mode [ 254.353049][ T6978] bridge_slave_0: entered promiscuous mode [ 254.456491][ T6978] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.456556][ T6978] bridge0: port 2(bridge_slave_1) entered disabled state [ 254.456712][ T6978] bridge_slave_1: entered allmulticast mode [ 254.459106][ T6978] bridge_slave_1: entered promiscuous mode [ 254.621955][ T6978] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 254.647679][ T6978] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 254.830589][ T6978] team0: Port device team_slave_0 added [ 254.891749][ T6978] team0: Port device team_slave_1 added [ 255.022307][ T6978] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 255.022324][ T6978] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 255.022345][ T6978] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 255.079914][ T6978] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 255.079928][ T6978] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 255.079948][ T6978] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 255.879099][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.884544][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.374531][ T6978] hsr_slave_0: entered promiscuous mode [ 257.382791][ T6978] hsr_slave_1: entered promiscuous mode [ 257.383409][ T6978] debugfs: 'hsr0' already exists in 'hsr' [ 257.383430][ T6978] Cannot create hsr debugfs directory [ 257.387499][ T5264] 8021q: adding VLAN 0 to HW filter on device eth10 [ 258.289274][ T60] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 262.967494][ T5608] Bluetooth: hci1: command 0x0406 tx timeout [ 263.270704][ T1522] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.567033][ T60] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 264.567083][ T60] CPU: 0 UID: 0 PID: 60 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 264.567120][ T60] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 264.567134][ T60] Workqueue: hci3 hci_rx_work [ 264.567169][ T60] Call Trace: [ 264.567180][ T60] [ 264.567191][ T60] dump_stack_lvl+0xe8/0x150 [ 264.567217][ T60] sysfs_create_dir_ns+0x271/0x2a0 [ 264.567249][ T60] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 264.567277][ T60] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 264.567312][ T60] ? rt_spin_unlock+0x160/0x200 [ 264.567340][ T60] kobject_add_internal+0x631/0xd10 [ 264.567375][ T60] kobject_add+0x163/0x240 [ 264.567402][ T60] ? __pfx_kobject_add+0x10/0x10 [ 264.567438][ T60] device_add+0x408/0xbb0 [ 264.567474][ T60] hci_conn_add_sysfs+0xd5/0x210 [ 264.567505][ T60] le_conn_complete_evt+0x10e6/0x16b0 [ 264.567540][ T60] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 264.567540][ T60] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 264.567564][ T60] ? irqentry_exit+0x218/0x8b0 [ 264.567588][ T60] ? skb_pull_data+0xfb/0x200 [ 264.567615][ T60] hci_le_conn_complete_evt+0x187/0x470 [ 264.567645][ T60] hci_event_packet+0x659/0xef0 [ 264.567681][ T60] ? __pfx____migrate_enable+0x10/0x10 [ 264.567704][ T60] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 264.567724][ T60] ? __pfx_hci_event_packet+0x10/0x10 [ 264.567753][ T60] ? preempt_schedule_common+0x82/0xd0 [ 264.567782][ T60] ? preempt_schedule_thunk+0x16/0x30 [ 264.567816][ T60] ? hci_send_to_monitor+0xe2/0x590 [ 264.567843][ T60] hci_rx_work+0x3ee/0x1040 [ 264.567874][ T60] ? preempt_schedule_thunk+0x16/0x30 [ 264.567905][ T60] ? process_scheduled_works+0xa70/0x1860 [ 264.567928][ T60] process_scheduled_works+0xb5d/0x1860 [ 264.567980][ T60] ? __pfx_process_scheduled_works+0x10/0x10 [ 264.568007][ T60] ? assign_work+0x3d5/0x5e0 [ 264.568032][ T60] worker_thread+0xa53/0xfc0 [ 264.568081][ T60] kthread+0x388/0x470 [ 264.568113][ T60] ? __pfx_worker_thread+0x10/0x10 [ 264.568132][ T60] ? __pfx_kthread+0x10/0x10 [ 264.568159][ T60] ret_from_fork+0x514/0xb70 [ 264.568186][ T60] ? __pfx_ret_from_fork+0x10/0x10 [ 264.568208][ T60] ? __switch_to+0xc79/0x1410 [ 264.568240][ T60] ? __pfx_kthread+0x10/0x10 [ 264.568267][ T60] ret_from_fork_asm+0x1a/0x30 [ 264.568308][ T60] [ 264.568783][ T60] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 264.569075][ T60] Bluetooth: hci3: failed to register connection device [ 264.787835][ T60] ================================================================== [ 264.787855][ T60] BUG: KASAN: slab-use-after-free in l2cap_sock_new_connection_cb+0x208/0x2f0 [ 264.787894][ T60] Read of size 8 at addr ffff88803b7c6830 by task kworker/u9:0/60 [ 264.787912][ T60] [ 264.787924][ T60] CPU: 0 UID: 0 PID: 60 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 264.787947][ T60] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 264.787961][ T60] Workqueue: hci3 hci_rx_work [ 264.787993][ T60] Call Trace: [ 264.788001][ T60] [ 264.788010][ T60] dump_stack_lvl+0xe8/0x150 [ 264.788035][ T60] print_address_description+0x55/0x1e0 [ 264.788057][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 264.788082][ T60] print_report+0x58/0x70 [ 264.788099][ T60] kasan_report+0x117/0x150 [ 264.788124][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 264.788156][ T60] l2cap_sock_new_connection_cb+0x208/0x2f0 [ 264.788185][ T60] l2cap_connect_cfm+0x368/0x1560 [ 264.788215][ T60] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 264.788241][ T60] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 264.788272][ T60] ? mutex_lock_nested+0x152/0x1d0 [ 264.788295][ T60] ? hci_connect_cfm+0x2c/0x140 [ 264.788315][ T60] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 264.788340][ T60] hci_connect_cfm+0x95/0x140 [ 264.788361][ T60] le_conn_complete_evt+0x1134/0x16b0 [ 264.788389][ T60] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 264.788412][ T60] ? irqentry_exit+0x218/0x8b0 [ 264.788433][ T60] ? skb_pull_data+0xfb/0x200 [ 264.788457][ T60] hci_le_conn_complete_evt+0x187/0x470 [ 264.788482][ T60] hci_event_packet+0x659/0xef0 [ 264.788514][ T60] ? __pfx____migrate_enable+0x10/0x10 [ 264.788537][ T60] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 264.788556][ T60] ? __pfx_hci_event_packet+0x10/0x10 [ 264.788584][ T60] ? preempt_schedule_common+0x82/0xd0 [ 264.788612][ T60] ? preempt_schedule_thunk+0x16/0x30 [ 264.788643][ T60] ? hci_send_to_monitor+0xe2/0x590 [ 264.788668][ T60] hci_rx_work+0x3ee/0x1040 [ 264.788703][ T60] ? preempt_schedule_thunk+0x16/0x30 [ 264.788733][ T60] ? process_scheduled_works+0xa70/0x1860 [ 264.788755][ T60] process_scheduled_works+0xb5d/0x1860 [ 264.788793][ T60] ? __pfx_process_scheduled_works+0x10/0x10 [ 264.788817][ T60] ? assign_work+0x3d5/0x5e0 [ 264.788839][ T60] worker_thread+0xa53/0xfc0 [ 264.788876][ T60] kthread+0x388/0x470 [ 264.788901][ T60] ? __pfx_worker_thread+0x10/0x10 [ 264.788920][ T60] ? __pfx_kthread+0x10/0x10 [ 264.788945][ T60] ret_from_fork+0x514/0xb70 [ 264.788968][ T60] ? __pfx_ret_from_fork+0x10/0x10 [ 264.788989][ T60] ? __switch_to+0xc79/0x1410 [ 264.789018][ T60] ? __pfx_kthread+0x10/0x10 [ 264.789043][ T60] ret_from_fork_asm+0x1a/0x30 [ 264.789076][ T60] [ 264.789083][ T60] [ 264.789087][ T60] Allocated by task 60: [ 264.789097][ T60] kasan_save_track+0x3e/0x80 [ 264.789115][ T60] __kasan_kmalloc+0x93/0xb0 [ 264.789133][ T60] __kmalloc_noprof+0x3e7/0x7b0 [ 264.789152][ T60] sk_prot_alloc+0xe7/0x210 [ 264.789178][ T60] sk_alloc+0x3a/0x390 [ 264.789202][ T60] bt_sock_alloc+0x3b/0x340 [ 264.789218][ T60] l2cap_sock_new_connection_cb+0xf1/0x2f0 [ 264.789256][ T60] l2cap_connect_cfm+0x368/0x1560 [ 264.789278][ T60] hci_connect_cfm+0x95/0x140 [ 264.789296][ T60] le_conn_complete_evt+0x1134/0x16b0 [ 264.789317][ T60] hci_le_conn_complete_evt+0x187/0x470 [ 264.789335][ T60] hci_event_packet+0x659/0xef0 [ 264.789360][ T60] hci_rx_work+0x3ee/0x1040 [ 264.789385][ T60] process_scheduled_works+0xb5d/0x1860 [ 264.789402][ T60] worker_thread+0xa53/0xfc0 [ 264.789420][ T60] kthread+0x388/0x470 [ 264.789442][ T60] ret_from_fork+0x514/0xb70 [ 264.789460][ T60] ret_from_fork_asm+0x1a/0x30 [ 264.789480][ T60] [ 264.789485][ T60] Freed by task 7276: [ 264.789494][ T60] kasan_save_track+0x3e/0x80 [ 264.789510][ T60] kasan_save_free_info+0x46/0x50 [ 264.789535][ T60] __kasan_slab_free+0x5c/0x80 [ 264.789553][ T60] kfree+0x1c5/0x6c0 [ 264.789568][ T60] __sk_destruct+0x74b/0x9d0 [ 264.789583][ T60] l2cap_sock_cleanup_listen+0x1d9/0x580 [ 264.789607][ T60] l2cap_sock_release+0x6e/0x270 [ 264.789629][ T60] sock_close+0xc3/0x240 [ 264.789647][ T60] __fput+0x461/0xa70 [ 264.789661][ T60] task_work_run+0x1d9/0x270 [ 264.789692][ T60] get_signal+0x11eb/0x1330 [ 264.789708][ T60] arch_do_signal_or_restart+0xbc/0x840 [ 264.789735][ T60] exit_to_user_mode_loop+0xa9/0x680 [ 264.789757][ T60] do_syscall_64+0x353/0x580 [ 264.789773][ T60] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.789791][ T60] [ 264.789795][ T60] The buggy address belongs to the object at ffff88803b7c6000 [ 264.789795][ T60] which belongs to the cache kmalloc-4k of size 4096 [ 264.789812][ T60] The buggy address is located 2096 bytes inside of [ 264.789812][ T60] freed 4096-byte region [ffff88803b7c6000, ffff88803b7c7000) [ 264.789832][ T60] [ 264.789837][ T60] The buggy address belongs to the physical page: [ 264.789860][ T60] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3b7c0 [ 264.789879][ T60] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 264.789895][ T60] flags: 0x80000000000040(head|node=0|zone=1) [ 264.789916][ T60] page_type: f5(slab) [ 264.789936][ T60] raw: 0080000000000040 ffff88813fe0d140 dead000000000100 dead000000000122 [ 264.789953][ T60] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 264.789972][ T60] head: 0080000000000040 ffff88813fe0d140 dead000000000100 dead000000000122 [ 264.789988][ T60] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 264.790006][ T60] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 264.790022][ T60] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 264.790032][ T60] page dumped because: kasan: bad access detected [ 264.790047][ T60] page_owner tracks the page as allocated [ 264.790053][ T60] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1575, tgid 1575 (kworker/u8:15), ts 191477759885, free_ts 191412133842 [ 264.790087][ T60] post_alloc_hook+0x22d/0x280 [ 264.790107][ T60] get_page_from_freelist+0x28b2/0x2930 [ 264.790130][ T60] __alloc_frozen_pages_noprof+0x18d/0x380 [ 264.790153][ T60] allocate_slab+0x77/0x660 [ 264.790178][ T60] refill_objects+0x33c/0x3d0 [ 264.790198][ T60] __pcs_replace_empty_main+0x373/0x720 [ 264.790223][ T60] __kmalloc_node_track_caller_noprof+0x60b/0x7e0 [ 264.790244][ T60] __alloc_skb+0x2c1/0x7d0 [ 264.790267][ T60] nsim_dev_trap_report_work+0x29f/0xbd0 [ 264.790289][ T60] process_scheduled_works+0xb5d/0x1860 [ 264.790306][ T60] worker_thread+0xa53/0xfc0 [ 264.790324][ T60] kthread+0x388/0x470 [ 264.790345][ T60] ret_from_fork+0x514/0xb70 [ 264.790362][ T60] ret_from_fork_asm+0x1a/0x30 [ 264.790382][ T60] page last free pid 4969 tgid 4969 stack trace: [ 264.790394][ T60] __free_frozen_pages+0xfe5/0x10d0 [ 264.790414][ T60] __slab_free+0x252/0x2a0 [ 264.790434][ T60] qlist_free_all+0x99/0x100 [ 264.790449][ T60] kasan_quarantine_reduce+0x148/0x160 [ 264.790466][ T60] __kasan_slab_alloc+0x22/0x80 [ 264.790484][ T60] kmem_cache_alloc_noprof+0x33b/0x680 [ 264.790503][ T60] do_getname+0x2e/0x250 [ 264.790526][ T60] do_readlinkat+0xc8/0x510 [ 264.790541][ T60] __x64_sys_readlink+0x7f/0x90 [ 264.790567][ T60] do_syscall_64+0x174/0x580 [ 264.790582][ T60] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.790600][ T60] [ 264.790604][ T60] Memory state around the buggy address: [ 264.790614][ T60] ffff88803b7c6700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 264.790627][ T60] ffff88803b7c6780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 264.790640][ T60] >ffff88803b7c6800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 264.790649][ T60] ^ [ 264.790659][ T60] ffff88803b7c6880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 264.790672][ T60] ffff88803b7c6900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 264.790682][ T60] ================================================================== [ 264.790732][ T60] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 264.790748][ T60] CPU: 0 UID: 0 PID: 60 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 264.790771][ T60] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 264.790784][ T60] Workqueue: hci3 hci_rx_work [ 264.790815][ T60] Call Trace: [ 264.790822][ T60] [ 264.790831][ T60] vpanic+0x56c/0xa60 [ 264.790856][ T60] ? __pfx_vpanic+0x10/0x10 [ 264.790879][ T60] ? __pfx___schedule+0x10/0x10 [ 264.790909][ T60] panic+0xc5/0xd0 [ 264.790930][ T60] ? __pfx_panic+0x10/0x10 [ 264.790955][ T60] ? preempt_schedule_common+0x82/0xd0 [ 264.790985][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 264.791012][ T60] check_panic_on_warn+0x89/0xb0 [ 264.791038][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 264.791065][ T60] end_report+0x73/0x170 [ 264.791086][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 264.791112][ T60] kasan_report+0x128/0x150 [ 264.791135][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 264.791166][ T60] l2cap_sock_new_connection_cb+0x208/0x2f0 [ 264.791193][ T60] l2cap_connect_cfm+0x368/0x1560 [ 264.791221][ T60] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 264.791247][ T60] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 264.791276][ T60] ? mutex_lock_nested+0x152/0x1d0 [ 264.791299][ T60] ? hci_connect_cfm+0x2c/0x140 [ 264.791318][ T60] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 264.791341][ T60] hci_connect_cfm+0x95/0x140 [ 264.791362][ T60] le_conn_complete_evt+0x1134/0x16b0 [ 264.791389][ T60] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 264.791411][ T60] ? irqentry_exit+0x218/0x8b0 [ 264.791430][ T60] ? skb_pull_data+0xfb/0x200 [ 264.791453][ T60] hci_le_conn_complete_evt+0x187/0x470 [ 264.791477][ T60] hci_event_packet+0x659/0xef0 [ 264.791507][ T60] ? __pfx____migrate_enable+0x10/0x10 [ 264.791529][ T60] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 264.791548][ T60] ? __pfx_hci_event_packet+0x10/0x10 [ 264.791575][ T60] ? preempt_schedule_common+0x82/0xd0 [ 264.791603][ T60] ? preempt_schedule_thunk+0x16/0x30 [ 264.791632][ T60] ? hci_send_to_monitor+0xe2/0x590 [ 264.791657][ T60] hci_rx_work+0x3ee/0x1040 [ 264.791691][ T60] ? preempt_schedule_thunk+0x16/0x30 [ 264.791719][ T60] ? process_scheduled_works+0xa70/0x1860 [ 264.791740][ T60] process_scheduled_works+0xb5d/0x1860 [ 264.791773][ T60] ? __pfx_process_scheduled_works+0x10/0x10 [ 264.791796][ T60] ? assign_work+0x3d5/0x5e0 [ 264.791817][ T60] worker_thread+0xa53/0xfc0 [ 264.791849][ T60] kthread+0x388/0x470 [ 264.791873][ T60] ? __pfx_worker_thread+0x10/0x10 [ 264.791892][ T60] ? __pfx_kthread+0x10/0x10 [ 264.791918][ T60] ret_from_fork+0x514/0xb70 [ 264.791939][ T60] ? __pfx_ret_from_fork+0x10/0x10 [ 264.791959][ T60] ? __switch_to+0xc79/0x1410 [ 264.791987][ T60] ? __pfx_kthread+0x10/0x10 [ 264.792012][ T60] ret_from_fork_asm+0x1a/0x30 [ 264.792041][ T60] [ 264.792302][ T60] Kernel Offset: disabled