last executing test programs: 6.435013624s ago: executing program 0 (id=1): openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x10000, 0x6, 0x2, 0x0, 0x7, 0xb, 0x651, 0xfffffffffffffffc, 0x9657, 0x1, 0x7fffffff, 0x0, 0x10, 0xb, 0x80000000000000, 0xcc0, 0x1, 0x1, 0x94d6, 0x0, 0x0, 0x809, 0x0, 0xfffffffffffffffa, 0x3, 0x2000000000004}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) poll(&(0x7f0000000180), 0x0, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) epoll_create1(0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x0) pselect6(0x40, &(0x7f0000000000)={0x0, 0x40000000002, 0xbc, 0x8000e, 0x2, 0x0, 0x100, 0x10001000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0x0, 0x4, 0x2, 0x0, 0x2, 0x7}, 0x0, 0x0) 6.319877296s ago: executing program 0 (id=6): syz_mount_image$udf(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', 0x4000, &(0x7f00000011c0)=ANY=[@ANYBLOB='mode=00000000000000000000177,mode=00000000000000000000005,shortad,utf8,shortad,shortad,session=00000000000016777223,umask=00000000000000000000250,uid=ignore,shortad,dmode=00000000000000000170430,gid=ignore,adinicb,gid=forget,mode=00000000000000000002000,lastblock=00000000000000001024,shortad,euid>', @ANYRESDEC=0x0, @ANYBLOB=',fsmagic=0x0000000000000002,smackfsfloor=smackfstransmute,fowner>', @ANYRESDEC=0x0, @ANYBLOB="2c736d61636b6673747261736d7574653d001c0b235ffdce27803854a81c498e5bc58fdfc2e25738bee597df2c00"/55], 0x2, 0xc2d, &(0x7f00000001c0)="$eJzs3U9sHNd9B/DfGy3FldxWTOwoThoXm7ZIZcVy9S+mYhXuqqbZBpBlIhRzC8AVSakLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBcgoYzOxbcUmRNi2KEmV9Pjb13Z19b+a9eesZWdCbFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAxB+8cun0mfSwWwEAPEhXRr96+qz7PwA8Vq76/38AAAAAAAAAAAAAADjoUhTxZKSYu7KWxqv3HfXL7b5bt8eGhrevdiRVNQ9V5cuf+pmz585/6YXBC9283J75gPr322fjtdGrlxovz96cm59aWJiabIzNtCdmJ6d2vYe91t/qZHUCGjdfvzV5/fpC4+zz5zZ9fHvg/f4njg9cHHz21DPdsmNDw8OjG0XqveVr99yQjp1meByOIk5Fiue+99PUiogi9n4u6g927Lc6UnXiZNWJsaHhqiPT7dbMYvnhSPdEFBGNnkrN7jnafiyi1vdA+7CzZsRS2fyywSfL7o3OteZb16anGiOt+cX2Ynt2ZiR1Wlv2pxFFXEgRyxGx2n/37vqiiFqk+M6xtXQtIg51z8MXq4nBO7ej2Mc+7kLZzkZfxHLxCIzZAdYfRbwaKX72zomYyNeZ6lrzhYhXy/xBxFtlvhSRyi/G+Yj3tvke8WiqRRF/WY7/xbU0WV0PuteVy19rfGXm+mxP2e515SPeH+66Ujyk+8ORLflgHPBrUz2KaFVX/LV077/ZAQAAAAAAAAAAAAAAAOB+OxJFfCZSvPIff1LNK45qXvqxi4N/OPCrvXPGn/6Q/ZRln4+IpWJ3c3IP54mBI2kkpYc8l/hxVo8i/jTP//vWw24MAAAAAAAAAAAAAAAAAADAY62In0SKF989kZajd03x9syNxtXWtenOqrDdtX+7a6avr6+vN1InmznHcy7lXM65knM1ZxS5fs5mzvGcSzmXc67kXM0Zh3L9nM2c4zmXci7nXMm5mjNquX7OZs7xnEs5l3Ou5FzNGQdk7V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgI+TIor4RaT49jfWUqSIaEaMRydX+h926wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAUn8q4vuRovFHzTvbahGRqn87TpS/nI/m4TI/Gc3BMl+K5qWcrSprzW89hPazN32piB9Hiv7623cGPI9/X+fdna9BvPXNjXefrXXyUPfDgff7nzh+7OLg8G88vdPrtF0DTl5uz9y63RgbGh4e7dlcy0f/ZM+2gXzc4v50nYhYeOPN11vT01Pz9/6i/Arsofoj9CLVHpeeelG9iNqBaMbD6TuPgfL+/16k+N13/7N7w+/c/+vxK513d+7w8fM/27j/v7h1R7u8/9e21sv3//Kevt39/8mebS/m34301SLqizfn+o5H1BfeePNU+2brxtSNqZnzp09/eXDwy+dO9x2OqF9vT0/1vLovpwsAAAAAAAAAAAAAAADgwUlF/H6kaP14LTUi4nY1X2vg4uCzp545FIeq+Vab5m2/Nnr1UuPl2Ztz81MLC1OTjbGZ9sTs5NRuD1evpnuNDQ3vS2c+1JF9bv+R+suzc2/Mt2/88eK2nx+tX7q2sDjfmtj+4zgSRUSzd8vJqsFjQ8NVo6fbrZmq6si2k+k/ur5UxH9FionzjfT5vC3P/986w3/T/P+lrTvap/n/n+jZVh4zpSJ+Hil+56+ejs9X7Twad52zXO7vIsXJC5/L5eJwWa7bhs5zBTozA8uy/xcp/ukXm8t250M+uVH2zK5P7COiHP9jkeL7f/Hd+M28bfPzH7Yf/6Nbd7RP4/9Uz7ajm55XsOeuk8f/VKR46cm347fytg96/kf32RsncuE7z+fYp/H/VM+2gXzc374/XQcAAAAAAAAAAHik9aUi/j5S/HC4ll7I23bz9/8mt+5on/7+16d7tk3en/WKPvTFnk8qAAAAABwQfamIn0SKG4tv35lDvXn+d8/8z9/bmP85lLZ8Wv05369Vzw24n3/+12sgH3d8790GAAAAAAAAAAAAAAAAAACAAyWlIl7I66mPV/P5J3dcT30lUrzyP8/lcul4Wa67DvxA9Wv9yuzMqUvT07MTrcXWtempxuhca2KqrPtUpFj728/lukW1vnp3vfnOGu8ba7HPR4rhf+iW7azF3l2b/KmNsmfKsp+IFP/9j5vLdtex/tRG2bNl2b+JFF//l+3LHt8oe64s+91I8aOvN7plj5Zlu89H/fRG2ecnZot9GBUAAAAAAAAAAAAAAAAAAAAeN32piD+PFP97c/nOXP68/n9fz9vKW9/sWe9/i9vVOv8D1fr/O72+l/X/q+cKLO10VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+HhKUcSbkWLuylpa6S/fd9Qvt2du3R4bGt6+2pFU1TxUlS9/6mfOnjv/pRcGL3Tzg+vfb5+J10avXmq8PHtzbn5qYWFqsjE2056YnZza9R72Wn+rk9UJaNx8/dbk9esLjbPPn9v08e2B9/ufOD5wcfDZU890y44NDQ+P9pSp9d3z0e+Sdth+OIr460jx3Pd+mn7YH1HE3s/Fh3x39tuRqhMnq06MDQ1XHZlut2YWyw9HuieiiGj0VGp2z9EDGIs9aUYslc0vG3yy7N7oXGu+dW16qjHSml9sL7ZnZ0ZSp7VlfxpRxIUUsRwRq/13764ving9Unzn2Fr61/6IQ93z8MUro189fXbndhT72MddKNvZ6ItYLh6BMTvA+qOIf44UP3vnRPxbf0QtOj/xhYhXy/xBxFvRGe9UfjHOR7y3zfeIR1Mtivj/cvwvrqV3+svrQfe6cvlrja/MXJ/tKdu9rjzy94cH6YBfm+pRxI+qK/5a+nf/XQMAAAAAAAAAAAAAAAAcIEX8eqR48d0TqZoffGdOcXvmRuNq69p0Z1pfd+5fd870+vr6eiN1splzPOdSzuWcKzlXc0aR6+dslllfXx/P75dyLudcybmaMw7l+jmbOcdzLuVczrmSczVn1HL9nM2c4zmXci7nXMm5mjMOyNw9AAAAAAAAAAAAAAAAAADg46Wo/knx7W+spfX+zvrS49HJFeuBfuz9MgAA//8hX/ir") sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x20040000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x103042, 0x0) write$FUSE_LK(r0, &(0x7f0000000000)={0x28, 0xffffffffffffffda, 0x0, {{0x8123, 0x6, 0x1}}}, 0x28) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file0\x00', 0x3000010, &(0x7f0000000040)={[{@journal_dev={'journal_dev', 0x3d, 0xd353}}, {@auto_da_alloc}]}, 0x1, 0x512, &(0x7f0000000380)="$eJzs3d9rY1kdAPDvvW1mOzNdk1WRdcF1cVc6i07Sbt3dIqLriz4tqOv7WNu0lCZNadJ1Whbt4H8ggoJPPvki+AcIwzz4B8jAgL6ID6KiiM7og6DOlSQ3TidN2rrTNp3m84HTnHPvzf2ec0NO7o/TewMYWy9FxFsRMRERr0ZEMZ+e5in2uqm93IP77y21UxJZ9s5fk0jyab11tcuTEXE1f9tURHztyxHfTA7Gbe7sri/WatWtvFxp1TcrzZ3d62v1xdXqanVjfn7ujYU3F15fmM1yT9TOUi/zky99/vanv/W7G3++9u12tT73kShEXztOUrfphc626Glvo63TCDYCE3l7CqOuCAAAx9Lex/9gRHyis/9fjInO3lyfiVHUDAAAADgp2Rem499JRAYAAABcWGlETEeSlvOxANORppfycwMfjitprdFsfWqlsb2x3J4XUYpCurJWq87mY4VLUUja5bl8jG2v/FpfeT4inouI7xcvd8rlpUZtecTnPgAAAGBcXO07/v9HMe3kjzbg/wQAAACA86s0tAAAAABcFA75AQAA4OLrP/6/PaJ6AAAAAKfiK2+/3U5Z7/nXy+/ubK833r2+XG2ul+vbS+WlxtZmebXRWO3cs69+1PpqjcbmZ2Jj+2alVW22Ks2d3Rv1xvZG68baY4/ABgAAAM7Qcx+/8+skIvY+e7mTIr8PIMBj/jDqCgAnaWLUFQBGxl28YXwVRl0BYOSSI+YbvAMAAE+/mY8evP7fe/6/cwNwsRnrAwDjx/V/GF8FIwBhrKUR8YFu9plhywy9/v/L40bJsoi7xf1TnF8EAICzNd1JSVrOjwOmI03L5YhnI9JSFJKVtVp1Nj8++FWx8Ey7PNd5Z3LkmGEAAAAAAAAAAAAAAAAAAAAAAAAAoCvLksgAAACACy0i/VPSuZt/xEzxlen+8wOXkn8W44954Ufv/ODmYqu1Ndee/rfOs7wuRUTrh/n014Y+PgwAAAA4acne0Fnd4/T8de5MawUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAGHhw/72lXjrLuH/5YkSUBsWfjKnO61QUIuLK35OY3Pe+JCImTiD+3q2IeH5Q/CQeZllWymsxKP7lU45f6myawfHTiLh6AvFhnN1p9z9vDfr+pfFS53Xw928yT09qeP+X5pGf7/Rzg/qfZw+srT4wxgv3flYZGv9WxAuTg/ufXv+bDIn/8oG1/SvLsoMxvvH13d1h8bMfR8wM/P1JHotVadU3K82d3etr9cXV6mp1Y35+7o2FNxdeX5itrKzVqvnfgTG+97GfPzys/VcGxP/tb7r972Htf2XYSvv8597N+x/qZguD4l97eeDv71QMiZ/mv32fzPPt+TO9/F43v9+LP7374mHtXx6y/Y/6/K8ds/2vfvW7vz/mogDAGWju7K4v1mrVrUMyU8dY5mnM/GLqXFTj/8xk3+l+cuelPu83095bfTSl16pzULF9mezMYk3EOWny/zIj7ZYAAIBT8Ginf9Q1AQAAAAAAAAAAAAAAAAAAgPF1FrcT64+5N5qmAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAc6r8BAAD//0wa4Aw=") setitimer(0x0, &(0x7f0000000580)={{0x0, 0xea60}, {0x0, 0x2710}}, 0x0) r1 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) mkdir(&(0x7f0000000140)='./control\x00', 0x5) close(r1) r2 = inotify_init1(0x800) fcntl$setstatus(r1, 0x4, 0x2c00) r3 = gettid() fcntl$setown(r1, 0x8, r3) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r4, 0x40384708, &(0x7f0000000040)={0x8, 0x1, 0x9, 0x3, 0x1a, "3eccd2000500"}) fcntl$setsig(r2, 0xa, 0xe) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) rt_sigtimedwait(&(0x7f0000000040)={[0xffffffffffff7ff8]}, 0x0, 0x0, 0x8) inotify_add_watch(r2, &(0x7f0000000180)='./control\x00', 0xa4000960) rmdir(&(0x7f0000000100)='./control\x00') chmod(&(0x7f0000000080)='./file0\x00', 0x1) 5.607176728s ago: executing program 0 (id=8): r0 = syz_mount_image$erofs(&(0x7f0000000200), &(0x7f0000000100)='./file1\x00', 0x810803, &(0x7f0000000140)=ANY=[], 0x4, 0x230, &(0x7f0000000240)="$eJzsmL9rFEEUx78zd7d3CRK10MLmLAJGMHu7eyppLLQXhETU8tAxRCe5c3NFEhAMNjbW4n9hZZHKwi5W1hYqCBamFATBkZmd3Z272z29XLq8D9zsd978fvPuLSwIgji2fP3y8/PLG0srlwCcwDzq1v69kvfhTv9Prys1K99vzD3dG56PAVAqr1dLV57J1Lv93KqUOxqYB3AKwAq40Zrb4Lho9R0w+BVnsB0twHDPmh/1VHaabrqsFOx+Vz54uCZFoItQF5Eu2oAa2P/BLlMnATTsEszZ3+b2zuOOBOJESJGKmkrXGWmaVJS6MN3fdY5rmQs8c193Xzzf1XXf2gPHfyE4QqvbYFi2egl1+L7ftFUR5ufHuWru4grgZRt4NslJGkVNT1Dgvv8Q+jrG9zm9WNCkI3z8zDNS6NNOdWeu+KPG99HBeYiZvYEQPJqtdqTkOETgouQufqmE4lG8OTrK+8ediulPyoYtzA2Jswd7+6Ojvh2Ve6cSHCLulUdvmmyHmkziGoqxVzpsPs5KebNwrTMDlvMlf5k0AktDIskfrApccFJ01XkrtPrrvdbm9s7i2npnVayKjShqXw0uB8GVqGVyc1KOyX8Nk59mnflrJX095mGr0+/H4RbQj8M0j8eRsUbZAd5g+W33h2njJv9xLPy2kQyb/NIXJRtcg9kfN0+tFiqlmycIgiAIgiAIgiAIgiAIgpiIJhg+zGXV5Ktl3T4zqtEt0/w3AAD//9FJTX4=") socketpair$unix(0x1, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ptrace(0x10, 0x1) r4 = add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x2f) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000040)={0x5}, 0x8) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000080)) ioctl$BTRFS_IOC_RM_DEV_V2(0xffffffffffffffff, 0x5000943a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYRES32=r0], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_NODELAY(r5, 0x84, 0x3, &(0x7f0000000180), &(0x7f0000000c40)=0x4) 5.522138079s ago: executing program 4 (id=5): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMIWAIT(r1, 0x545c, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 5.381860411s ago: executing program 3 (id=4): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fc00101}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, 0x0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 4.298032179s ago: executing program 3 (id=9): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x40, &(0x7f00000001c0)=ANY=[@ANYBLOB="000a000000000fd60730000000000a0000000000000000000000000000000000000000000000000000000d00000000000000000000ef60fc4bd8ecc4e3200000000006004dee00000000000032acaace3269d47147"], 0xd0060) 4.297485109s ago: executing program 4 (id=10): syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/bus/input/devices\x00', 0x0, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f00000002c0)=""/4094, 0xffe}], 0x1, 0xf0, 0x3) 4.27084921s ago: executing program 0 (id=11): syz_open_dev$vim2m(0x0, 0x3, 0x2) socket$packet(0x11, 0xa, 0x300) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r0, 0x11, 0x64, 0x0, 0x0) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmsg$unix(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/210, 0xf6}], 0x1}, 0x61) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) 4.25706528s ago: executing program 1 (id=12): openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x10000, 0x6, 0x2, 0x0, 0x7, 0xb, 0x651, 0xfffffffffffffffc, 0x9657, 0x1, 0x7fffffff, 0x0, 0x10, 0xb, 0x80000000000000, 0xcc0, 0x1, 0x1, 0x94d6, 0x0, 0x0, 0x809, 0x0, 0xfffffffffffffffa, 0x3, 0x2000000000004}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) poll(&(0x7f0000000180), 0x0, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) epoll_create1(0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x0) pselect6(0x40, &(0x7f0000000000)={0x0, 0x40000000002, 0xbc, 0x8000e, 0x2, 0x0, 0x100, 0x10001000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0x0, 0x4, 0x2, 0x0, 0x2, 0x7}, 0x0, 0x0) 4.200007041s ago: executing program 3 (id=13): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x2, &(0x7f0000000200)=@raw=[@call={0x85, 0x0, 0x0, 0x96}, @exit], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) 3.06115379s ago: executing program 3 (id=14): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, &(0x7f00000003c0)='wg1\x00', 0x4) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0xe0) 2.948145752s ago: executing program 1 (id=15): r0 = gettid() pause() tkill(r0, 0x7) close(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) syz_open_procfs(0x0, 0x0) r1 = syz_open_procfs(0x0, 0x0) writev(r1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 2.941490282s ago: executing program 2 (id=3): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, &(0x7f00000003c0)='wg1\x00', 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010100}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0xe0) 2.881878892s ago: executing program 1 (id=16): syz_mount_image$udf(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', 0x4000, &(0x7f00000011c0)=ANY=[@ANYBLOB='mode=00000000000000000000177,mode=00000000000000000000005,shortad,utf8,shortad,shortad,session=00000000000016777223,umask=00000000000000000000250,uid=ignore,shortad,dmode=00000000000000000170430,gid=ignore,adinicb,gid=forget,mode=00000000000000000002000,lastblock=00000000000000001024,shortad,euid>', @ANYRESDEC=0x0, @ANYBLOB=',fsmagic=0x0000000000000002,smackfsfloor=smackfstransmute,fowner>', @ANYRESDEC=0x0, @ANYBLOB="2c736d61636b6673747261736d7574653d001c0b235ffdce27803854a81c498e5bc58fdfc2e25738bee597df2c00"/55], 0x2, 0xc2d, &(0x7f00000001c0)="$eJzs3U9sHNd9B/DfGy3FldxWTOwoThoXm7ZIZcVy9S+mYhXuqqbZBpBlIhRzC8AVSakLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBcgoYzOxbcUmRNi2KEmV9Pjb13Z19b+a9eesZWdCbFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAxB+8cun0mfSwWwEAPEhXRr96+qz7PwA8Vq76/38AAAAAAAAAAAAAADjoUhTxZKSYu7KWxqv3HfXL7b5bt8eGhrevdiRVNQ9V5cuf+pmz585/6YXBC9283J75gPr322fjtdGrlxovz96cm59aWJiabIzNtCdmJ6d2vYe91t/qZHUCGjdfvzV5/fpC4+zz5zZ9fHvg/f4njg9cHHz21DPdsmNDw8OjG0XqveVr99yQjp1meByOIk5Fiue+99PUiogi9n4u6g927Lc6UnXiZNWJsaHhqiPT7dbMYvnhSPdEFBGNnkrN7jnafiyi1vdA+7CzZsRS2fyywSfL7o3OteZb16anGiOt+cX2Ynt2ZiR1Wlv2pxFFXEgRyxGx2n/37vqiiFqk+M6xtXQtIg51z8MXq4nBO7ej2Mc+7kLZzkZfxHLxCIzZAdYfRbwaKX72zomYyNeZ6lrzhYhXy/xBxFtlvhSRyi/G+Yj3tvke8WiqRRF/WY7/xbU0WV0PuteVy19rfGXm+mxP2e515SPeH+66Ujyk+8ORLflgHPBrUz2KaFVX/LV077/ZAQAAAAAAAAAAAAAAAOB+OxJFfCZSvPIff1LNK45qXvqxi4N/OPCrvXPGn/6Q/ZRln4+IpWJ3c3IP54mBI2kkpYc8l/hxVo8i/jTP//vWw24MAAAAAAAAAAAAAAAAAADAY62In0SKF989kZajd03x9syNxtXWtenOqrDdtX+7a6avr6+vN1InmznHcy7lXM65knM1ZxS5fs5mzvGcSzmXc67kXM0Zh3L9nM2c4zmXci7nXMm5mjNquX7OZs7xnEs5l3Ou5FzNGQdk7V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgI+TIor4RaT49jfWUqSIaEaMRydX+h926wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAUn8q4vuRovFHzTvbahGRqn87TpS/nI/m4TI/Gc3BMl+K5qWcrSprzW89hPazN32piB9Hiv7623cGPI9/X+fdna9BvPXNjXefrXXyUPfDgff7nzh+7OLg8G88vdPrtF0DTl5uz9y63RgbGh4e7dlcy0f/ZM+2gXzc4v50nYhYeOPN11vT01Pz9/6i/Arsofoj9CLVHpeeelG9iNqBaMbD6TuPgfL+/16k+N13/7N7w+/c/+vxK513d+7w8fM/27j/v7h1R7u8/9e21sv3//Kevt39/8mebS/m34301SLqizfn+o5H1BfeePNU+2brxtSNqZnzp09/eXDwy+dO9x2OqF9vT0/1vLovpwsAAAAAAAAAAAAAAADgwUlF/H6kaP14LTUi4nY1X2vg4uCzp545FIeq+Vab5m2/Nnr1UuPl2Ztz81MLC1OTjbGZ9sTs5NRuD1evpnuNDQ3vS2c+1JF9bv+R+suzc2/Mt2/88eK2nx+tX7q2sDjfmtj+4zgSRUSzd8vJqsFjQ8NVo6fbrZmq6si2k+k/ur5UxH9FionzjfT5vC3P/986w3/T/P+lrTvap/n/n+jZVh4zpSJ+Hil+56+ejs9X7Twad52zXO7vIsXJC5/L5eJwWa7bhs5zBTozA8uy/xcp/ukXm8t250M+uVH2zK5P7COiHP9jkeL7f/Hd+M28bfPzH7Yf/6Nbd7RP4/9Uz7ajm55XsOeuk8f/VKR46cm347fytg96/kf32RsncuE7z+fYp/H/VM+2gXzc374/XQcAAAAAAAAAAHik9aUi/j5S/HC4ll7I23bz9/8mt+5on/7+16d7tk3en/WKPvTFnk8qAAAAABwQfamIn0SKG4tv35lDvXn+d8/8z9/bmP85lLZ8Wv05369Vzw24n3/+12sgH3d8790GAAAAAAAAAAAAAAAAAACAAyWlIl7I66mPV/P5J3dcT30lUrzyP8/lcul4Wa67DvxA9Wv9yuzMqUvT07MTrcXWtempxuhca2KqrPtUpFj728/lukW1vnp3vfnOGu8ba7HPR4rhf+iW7azF3l2b/KmNsmfKsp+IFP/9j5vLdtex/tRG2bNl2b+JFF//l+3LHt8oe64s+91I8aOvN7plj5Zlu89H/fRG2ecnZot9GBUAAAAAAAAAAAAAAAAAAAAeN32piD+PFP97c/nOXP68/n9fz9vKW9/sWe9/i9vVOv8D1fr/O72+l/X/q+cKLO10VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+HhKUcSbkWLuylpa6S/fd9Qvt2du3R4bGt6+2pFU1TxUlS9/6mfOnjv/pRcGL3Tzg+vfb5+J10avXmq8PHtzbn5qYWFqsjE2056YnZza9R72Wn+rk9UJaNx8/dbk9esLjbPPn9v08e2B9/ufOD5wcfDZU890y44NDQ+P9pSp9d3z0e+Sdth+OIr460jx3Pd+mn7YH1HE3s/Fh3x39tuRqhMnq06MDQ1XHZlut2YWyw9HuieiiGj0VGp2z9EDGIs9aUYslc0vG3yy7N7oXGu+dW16qjHSml9sL7ZnZ0ZSp7VlfxpRxIUUsRwRq/13764ving9Unzn2Fr61/6IQ93z8MUro189fXbndhT72MddKNvZ6ItYLh6BMTvA+qOIf44UP3vnRPxbf0QtOj/xhYhXy/xBxFvRGe9UfjHOR7y3zfeIR1Mtivj/cvwvrqV3+svrQfe6cvlrja/MXJ/tKdu9rjzy94cH6YBfm+pRxI+qK/5a+nf/XQMAAAAAAAAAAAAAAAAcIEX8eqR48d0TqZoffGdOcXvmRuNq69p0Z1pfd+5fd870+vr6eiN1splzPOdSzuWcKzlXc0aR6+dslllfXx/P75dyLudcybmaMw7l+jmbOcdzLuVczrmSczVn1HL9nM2c4zmXci7nXMm5mjMOyNw9AAAAAAAAAAAAAAAAAADg46Wo/knx7W+spfX+zvrS49HJFeuBfuz9MgAA//8hX/ir") sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x20040000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x103042, 0x0) write$FUSE_LK(r0, &(0x7f0000000000)={0x28, 0xffffffffffffffda, 0x0, {{0x8123, 0x6, 0x1}}}, 0x28) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file0\x00', 0x3000010, &(0x7f0000000040)={[{@journal_dev={'journal_dev', 0x3d, 0xd353}}, {@auto_da_alloc}]}, 0x1, 0x512, &(0x7f0000000380)="$eJzs3d9rY1kdAPDvvW1mOzNdk1WRdcF1cVc6i07Sbt3dIqLriz4tqOv7WNu0lCZNadJ1Whbt4H8ggoJPPvki+AcIwzz4B8jAgL6ID6KiiM7og6DOlSQ3TidN2rrTNp3m84HTnHPvzf2ec0NO7o/TewMYWy9FxFsRMRERr0ZEMZ+e5in2uqm93IP77y21UxJZ9s5fk0jyab11tcuTEXE1f9tURHztyxHfTA7Gbe7sri/WatWtvFxp1TcrzZ3d62v1xdXqanVjfn7ujYU3F15fmM1yT9TOUi/zky99/vanv/W7G3++9u12tT73kShEXztOUrfphc626Glvo63TCDYCE3l7CqOuCAAAx9Lex/9gRHyis/9fjInO3lyfiVHUDAAAADgp2Rem499JRAYAAABcWGlETEeSlvOxANORppfycwMfjitprdFsfWqlsb2x3J4XUYpCurJWq87mY4VLUUja5bl8jG2v/FpfeT4inouI7xcvd8rlpUZtecTnPgAAAGBcXO07/v9HMe3kjzbg/wQAAACA86s0tAAAAABcFA75AQAA4OLrP/6/PaJ6AAAAAKfiK2+/3U5Z7/nXy+/ubK833r2+XG2ul+vbS+WlxtZmebXRWO3cs69+1PpqjcbmZ2Jj+2alVW22Ks2d3Rv1xvZG68baY4/ABgAAAM7Qcx+/8+skIvY+e7mTIr8PIMBj/jDqCgAnaWLUFQBGxl28YXwVRl0BYOSSI+YbvAMAAE+/mY8evP7fe/6/cwNwsRnrAwDjx/V/GF8FIwBhrKUR8YFu9plhywy9/v/L40bJsoi7xf1TnF8EAICzNd1JSVrOjwOmI03L5YhnI9JSFJKVtVp1Nj8++FWx8Ey7PNd5Z3LkmGEAAAAAAAAAAAAAAAAAAAAAAAAAoCvLksgAAACACy0i/VPSuZt/xEzxlen+8wOXkn8W44954Ufv/ODmYqu1Ndee/rfOs7wuRUTrh/n014Y+PgwAAAA4acne0Fnd4/T8de5MawUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAGHhw/72lXjrLuH/5YkSUBsWfjKnO61QUIuLK35OY3Pe+JCImTiD+3q2IeH5Q/CQeZllWymsxKP7lU45f6myawfHTiLh6AvFhnN1p9z9vDfr+pfFS53Xw928yT09qeP+X5pGf7/Rzg/qfZw+srT4wxgv3flYZGv9WxAuTg/ufXv+bDIn/8oG1/SvLsoMxvvH13d1h8bMfR8wM/P1JHotVadU3K82d3etr9cXV6mp1Y35+7o2FNxdeX5itrKzVqvnfgTG+97GfPzys/VcGxP/tb7r972Htf2XYSvv8597N+x/qZguD4l97eeDv71QMiZ/mv32fzPPt+TO9/F43v9+LP7374mHtXx6y/Y/6/K8ds/2vfvW7vz/mogDAGWju7K4v1mrVrUMyU8dY5mnM/GLqXFTj/8xk3+l+cuelPu83095bfTSl16pzULF9mezMYk3EOWny/zIj7ZYAAIBT8Ginf9Q1AQAAAAAAAAAAAAAAAAAAgPF1FrcT64+5N5qmAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAc6r8BAAD//0wa4Aw=") setitimer(0x0, &(0x7f0000000580)={{0x0, 0xea60}, {0x0, 0x2710}}, 0x0) r1 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) mkdir(&(0x7f0000000140)='./control\x00', 0x5) close(r1) r2 = inotify_init1(0x800) fcntl$setstatus(r1, 0x4, 0x2c00) r3 = gettid() fcntl$setown(r1, 0x8, r3) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r4, 0x40384708, &(0x7f0000000040)={0x8, 0x1, 0x9, 0x3, 0x1a, "3eccd2000500"}) fcntl$setsig(r2, 0xa, 0xe) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) rt_sigtimedwait(&(0x7f0000000040)={[0xffffffffffff7ff8]}, 0x0, 0x0, 0x8) inotify_add_watch(r2, &(0x7f0000000180)='./control\x00', 0xa4000960) rmdir(&(0x7f0000000100)='./control\x00') chmod(&(0x7f0000000080)='./file0\x00', 0x1) 2.771882794s ago: executing program 3 (id=17): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) shmget$private(0x0, 0x2000, 0x800, &(0x7f0000ffd000/0x2000)=nil) 2.504110429s ago: executing program 3 (id=18): syz_usb_connect(0x5, 0x36, &(0x7f0000000380)={{0x12, 0x1, 0x0, 0x23, 0x20, 0xc2, 0x10, 0x424, 0xc001, 0x49e4, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xe4, 0x0, 0x2, 0x6c, 0x62, 0x1c, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x400, 0x0, 0xfa}}, {{0x9, 0x5, 0xd, 0x2, 0x40, 0xfc}}]}}]}}]}}, 0x0) 2.44433782s ago: executing program 0 (id=19): socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$ax25(0x3, 0x5, 0x7) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f00000008c0)=[{&(0x7f00000000c0)="580000001400", 0x6}], 0x1) rt_sigprocmask(0x0, 0x0, 0x0, 0x8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x94, 0x30, 0x1, 0x0, 0x25dfdbfd, {}, [{0x80, 0x1, [@m_ct={0x34, 0x2, 0x0, 0x0, {{0x7}, {0xc, 0x2, 0x0, 0x1, [@TCA_CT_NAT_IPV4_MIN={0x8, 0x9, @broadcast}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_mount_image$hfs(&(0x7f0000002c80), &(0x7f0000000080)='./bus\x00', 0x4490, &(0x7f0000002cc0)=ANY=[], 0xfd, 0x278, &(0x7f0000000200)="$eJzs3c9qE1EUx/HfnaRttKVO/4ggrqoFV9LWjbgpSN/AjStRmwjFUEErqKvqWnwA976CD+DSlbgW3LnyAbKL3DM3ZpJmMnFoOkn6/UBC0rln5tzMnd57ppQIwLl1b+/X59u//cNJFVUk3ZUiSTWpKumyrtReHR4dHDUb9WE7qliEfzglke5Em/3DxqBQH2cRQezfVbWU/hnGo/ZTx2XngPLZ1T9AJC2Eq9O21848s/E474PetdTSay2XnQcAoFxh/o/CPL8U1u9RJG2Gab93/p/yCbRVdgJj9jVne2r+tyqr7fz5vWSbuvWelXB+e9SpEovkMq9kZPUsMF1eVWm5RBeeHjQbt/afN+uR3ms3mOs2W7fnejJ0O9LZvju5640BtekQxfu+aH2Y833YSeefarJ2ukfM57657+6hi/VJ9X/rv2rb+dNkZyruO1NJ/lvZe7RezstaZfRyxQ5yNRwhGNrLijIqEnVG1Ip6bxDEeXla1GpfVNK77ZyotYFROzlR6/1R3dGcHTlu7qN74Db0R1+0l1r/R/7T3tQoV6ZvYy3DyBjan6q1jG0+CVfd8bWBLaOiPUIBH/REd7T88s3bZ4+bzcaLmX3hr8QJSGOiXnQGwaTkM7Mv/IdcytE7807x/ZT2mwlnqHvS/zOQv83MCr/uckn9l6pXtmyx5p/i3nX6Qjq2nbfz1B63M2qDVXu+mF3B9XB262Exu4Ibtea6flO6McoRE3HIc/LsFglye/qhR9z/BwAAAAAAAAAAAAAAAAAAmDan9y8HNWVtKruPAAAAAAAAAAAAAAAAAAAAAABMu4n7/t/7St7x/b/A2P0NAAD//1Bodro=") r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) write$binfmt_aout(r1, &(0x7f0000000480)={{0xcc, 0x9, 0x6, 0x376, 0x2de, 0x44, 0xfc, 0x2}, "", ['\x00', '\x00']}, 0x220) write$FUSE_WRITE(r1, &(0x7f00000000c0)={0x18}, 0xfffffdef) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = inotify_init() inotify_add_watch(r5, &(0x7f0000000340)='.\x00', 0xa50003d1) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETLINK(r6, 0x400454cd, 0x6) r7 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_group_source_req(r7, 0x29, 0x2e, &(0x7f00000001c0)={0x7, {{0xa, 0x0, 0x0, @mcast1={0xff, 0xf}}}, {{0xa, 0x0, 0x0, @private0}}}, 0x108) setsockopt$inet6_group_source_req(r7, 0x29, 0x2e, &(0x7f0000000300)={0x4, {{0xa, 0x0, 0x0, @mcast1={0xff, 0xf}}}, {{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x108) 2.286433402s ago: executing program 2 (id=20): socket(0x1e, 0x805, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x21081e, &(0x7f0000000040)={[{@grpquota}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x800}}, {@minixdf}]}, 0x1, 0x4fa, &(0x7f0000000b80)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") r0 = open(&(0x7f0000000200)='.\x00', 0x0, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) read$FUSE(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000240)=0xc) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) timer_create(0x2, &(0x7f0000000340)={0x0, 0x36}, &(0x7f0000000380)) prlimit64(r3, 0xa, 0x0, &(0x7f0000000300)) tgkill(r2, r3, 0x23) sendto$inet6(0xffffffffffffffff, 0x0, 0x2c, 0x20044851, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) mknodat$null(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x103) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0900000000000000000002000000140001800500020001"], 0x28}}, 0x0) r6 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r6, 0x110, 0x2, &(0x7f0000000080)=',,&\x00', 0x4) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0xc0185879, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'bridge_slave_0\x00', 0x800}) 2.235805973s ago: executing program 1 (id=21): r0 = syz_mount_image$erofs(&(0x7f0000000200), &(0x7f0000000100)='./file1\x00', 0x810803, &(0x7f0000000140)=ANY=[], 0x4, 0x230, &(0x7f0000000240)="$eJzsmL9rFEEUx78zd7d3CRK10MLmLAJGMHu7eyppLLQXhETU8tAxRCe5c3NFEhAMNjbW4n9hZZHKwi5W1hYqCBamFATBkZmd3Z272z29XLq8D9zsd978fvPuLSwIgji2fP3y8/PLG0srlwCcwDzq1v69kvfhTv9Prys1K99vzD3dG56PAVAqr1dLV57J1Lv93KqUOxqYB3AKwAq40Zrb4Lho9R0w+BVnsB0twHDPmh/1VHaabrqsFOx+Vz54uCZFoItQF5Eu2oAa2P/BLlMnATTsEszZ3+b2zuOOBOJESJGKmkrXGWmaVJS6MN3fdY5rmQs8c193Xzzf1XXf2gPHfyE4QqvbYFi2egl1+L7ftFUR5ufHuWru4grgZRt4NslJGkVNT1Dgvv8Q+jrG9zm9WNCkI3z8zDNS6NNOdWeu+KPG99HBeYiZvYEQPJqtdqTkOETgouQufqmE4lG8OTrK+8ediulPyoYtzA2Jswd7+6Ojvh2Ve6cSHCLulUdvmmyHmkziGoqxVzpsPs5KebNwrTMDlvMlf5k0AktDIskfrApccFJ01XkrtPrrvdbm9s7i2npnVayKjShqXw0uB8GVqGVyc1KOyX8Nk59mnflrJX095mGr0+/H4RbQj8M0j8eRsUbZAd5g+W33h2njJv9xLPy2kQyb/NIXJRtcg9kfN0+tFiqlmycIgiAIgiAIgiAIgiAIgpiIJhg+zGXV5Ktl3T4zqtEt0/w3AAD//9FJTX4=") socketpair$unix(0x1, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ptrace(0x10, 0x1) r4 = add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x2f) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000040)={0x5}, 0x8) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000080)) ioctl$BTRFS_IOC_RM_DEV_V2(0xffffffffffffffff, 0x5000943a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYRES32=r0], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_NODELAY(r5, 0x84, 0x3, &(0x7f0000000180), &(0x7f0000000c40)=0x4) 1.106533452s ago: executing program 1 (id=22): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_dccp(0x2, 0x6, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000019140)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) socket(0x10, 0x803, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r5 = syz_io_uring_setup(0x10d2, &(0x7f0000000540)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f0000000600)=0x0, &(0x7f00000005c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x1cd83f7c25e05491, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x100, 0x1, {0x3}}) io_uring_enter(r5, 0x47bc, 0x0, 0x0, 0x0, 0x0) 232.085327ms ago: executing program 2 (id=23): socket$unix(0x1, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_WOWLAN(0xffffffffffffffff, 0x0, 0x4010) capset(&(0x7f0000000300)={0x20071026}, 0x0) close(0xffffffffffffffff) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x44f, 0xb304, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x10, 0x8, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x0, 0x3, {0x9, 0x21, 0x4, 0x0, 0x1, {0x22, 0xd8f}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x39, 0x4, 0x1}}}}}]}}]}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) close(0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) vmsplice(r1, 0x0, 0x0, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043ef502"], 0xf8) 0s ago: executing program 1 (id=24): openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x10000, 0x6, 0x2, 0x0, 0x7, 0xb, 0x651, 0xfffffffffffffffc, 0x9657, 0x1, 0x7fffffff, 0x0, 0x10, 0xb, 0x80000000000000, 0xcc0, 0x1, 0x1, 0x94d6, 0x0, 0x0, 0x809, 0x0, 0xfffffffffffffffa, 0x3, 0x2000000000004}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) poll(&(0x7f0000000180), 0x0, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) epoll_create1(0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x0) pselect6(0x40, &(0x7f0000000000)={0x0, 0x40000000002, 0xbc, 0x8000e, 0x2, 0x0, 0x100, 0x10001000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0x0, 0x4, 0x2, 0x0, 0x2, 0x7}, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.153' (ED25519) to the list of known hosts. [ 64.398460][ T4156] cgroup: Unknown subsys name 'net' [ 64.530764][ T4156] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 66.055123][ T4156] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 67.964193][ T4167] chnl_net:caif_netlink_parms(): no params data found [ 68.105139][ T4173] chnl_net:caif_netlink_parms(): no params data found [ 68.125843][ T4168] chnl_net:caif_netlink_parms(): no params data found [ 68.151356][ T4176] chnl_net:caif_netlink_parms(): no params data found [ 68.166373][ T4167] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.173520][ T4167] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.183680][ T4167] device bridge_slave_0 entered promiscuous mode [ 68.197831][ T4167] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.204961][ T4167] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.213175][ T4167] device bridge_slave_1 entered promiscuous mode [ 68.272594][ T4178] chnl_net:caif_netlink_parms(): no params data found [ 68.309136][ T4167] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.336714][ T4167] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.423596][ T4167] team0: Port device team_slave_0 added [ 68.438949][ T4176] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.446130][ T4176] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.454706][ T4176] device bridge_slave_0 entered promiscuous mode [ 68.462122][ T4173] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.470183][ T4173] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.478723][ T4173] device bridge_slave_0 entered promiscuous mode [ 68.491098][ T4167] team0: Port device team_slave_1 added [ 68.505173][ T4176] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.512278][ T4176] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.521909][ T4176] device bridge_slave_1 entered promiscuous mode [ 68.529244][ T4173] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.536699][ T4173] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.545312][ T4173] device bridge_slave_1 entered promiscuous mode [ 68.565432][ T4168] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.572539][ T4168] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.581223][ T4168] device bridge_slave_0 entered promiscuous mode [ 68.619544][ T4168] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.626937][ T4168] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.635508][ T4168] device bridge_slave_1 entered promiscuous mode [ 68.668912][ T4167] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.676274][ T4167] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.702582][ T4167] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.723191][ T4176] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.735178][ T4176] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.746183][ T4173] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.756051][ T4178] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.763232][ T4178] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.771496][ T4178] device bridge_slave_0 entered promiscuous mode [ 68.780459][ T4178] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.787731][ T4178] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.796028][ T4178] device bridge_slave_1 entered promiscuous mode [ 68.804332][ T4167] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.811386][ T4167] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.838241][ T4167] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.867916][ T4173] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.890720][ T4168] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.927523][ T4178] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.940548][ T4168] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.960601][ T4176] team0: Port device team_slave_0 added [ 68.982642][ T4178] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.009325][ T4176] team0: Port device team_slave_1 added [ 69.017662][ T4173] team0: Port device team_slave_0 added [ 69.051500][ T4168] team0: Port device team_slave_0 added [ 69.059156][ T4173] team0: Port device team_slave_1 added [ 69.087409][ T4178] team0: Port device team_slave_0 added [ 69.097910][ T4167] device hsr_slave_0 entered promiscuous mode [ 69.104897][ T4167] device hsr_slave_1 entered promiscuous mode [ 69.113619][ T4168] team0: Port device team_slave_1 added [ 69.128297][ T4176] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.135632][ T4176] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.162326][ T4176] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.174969][ T4178] team0: Port device team_slave_1 added [ 69.181596][ T4176] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.188755][ T4176] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.215438][ T4176] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.275336][ T4173] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.282317][ T4173] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.308640][ T4173] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.331164][ T4178] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.338319][ T4178] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.364384][ T4178] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.376285][ T4168] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.383250][ T4168] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.409909][ T4168] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.426030][ T4173] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.433146][ T4173] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.459606][ T4173] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.479489][ T4178] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.486632][ T4178] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.512772][ T4178] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.524590][ T4168] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.531602][ T4168] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.557900][ T4168] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.626313][ T4176] device hsr_slave_0 entered promiscuous mode [ 69.633110][ T4176] device hsr_slave_1 entered promiscuous mode [ 69.640732][ T4158] Bluetooth: hci1: command 0x0409 tx timeout [ 69.647156][ T4176] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 69.647695][ T4158] Bluetooth: hci2: command 0x0409 tx timeout [ 69.661456][ T4158] Bluetooth: hci3: command 0x0409 tx timeout [ 69.663052][ T4176] Cannot create hsr debugfs directory [ 69.667541][ T4158] Bluetooth: hci0: command 0x0409 tx timeout [ 69.711520][ T4168] device hsr_slave_0 entered promiscuous mode [ 69.717829][ T1110] Bluetooth: hci4: command 0x0409 tx timeout [ 69.725871][ T4168] device hsr_slave_1 entered promiscuous mode [ 69.732671][ T4168] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 69.740443][ T4168] Cannot create hsr debugfs directory [ 69.780770][ T4178] device hsr_slave_0 entered promiscuous mode [ 69.788590][ T4178] device hsr_slave_1 entered promiscuous mode [ 69.796127][ T4178] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 69.803717][ T4178] Cannot create hsr debugfs directory [ 69.816945][ T4173] device hsr_slave_0 entered promiscuous mode [ 69.828570][ T4173] device hsr_slave_1 entered promiscuous mode [ 69.835423][ T4173] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 69.842988][ T4173] Cannot create hsr debugfs directory [ 70.159822][ T4167] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.173390][ T4167] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.183155][ T4167] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.193427][ T4167] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.248537][ T4176] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 70.261901][ T4176] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 70.288592][ T4176] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 70.311458][ T4176] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 70.371112][ T4173] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 70.381102][ T4173] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 70.408411][ T4173] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 70.420823][ T4173] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 70.472199][ T4178] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 70.488805][ T4167] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.506807][ T4178] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 70.517545][ T4178] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 70.531444][ T4178] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 70.560301][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.570740][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.591662][ T4167] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.631632][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.641038][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 70.651071][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.658460][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.699679][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 70.709322][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.720618][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 70.730103][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.737268][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.746533][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 70.779114][ T4173] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.790650][ T4168] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 70.803105][ T4168] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 70.832858][ T4176] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.840447][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 70.849778][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 70.859241][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 70.868555][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 70.878730][ T4168] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 70.897780][ T4173] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.914794][ T4168] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 70.933473][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.942165][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.950452][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.959060][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.968204][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 70.978135][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 70.991198][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.000480][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.009162][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.016658][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.027793][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.046336][ T4176] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.054048][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.063783][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.073679][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.083540][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.092856][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.099996][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.128435][ T4167] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.141196][ T4167] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.153084][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.164446][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.173661][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.183083][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.190433][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.199919][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.209101][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.218925][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.227569][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.261165][ T4178] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.273627][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.286850][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.296795][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.306327][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.315265][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.322415][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.330500][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.340308][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.349442][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.359252][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.368368][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.394708][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.411365][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.433322][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.448846][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.459153][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.472896][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.485462][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.508569][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.517665][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.538906][ T4173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.561815][ T4176] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 71.573085][ T4176] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.590923][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.601297][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.609689][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.618958][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.628084][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.641127][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.644540][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.648237][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.666771][ T4178] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.673778][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.725143][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.732758][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.734344][ T4214] Bluetooth: hci0: command 0x041b tx timeout [ 71.753986][ T4214] Bluetooth: hci3: command 0x041b tx timeout [ 71.761820][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.770108][ T4214] Bluetooth: hci2: command 0x041b tx timeout [ 71.770308][ T4214] Bluetooth: hci1: command 0x041b tx timeout [ 71.794492][ T1108] Bluetooth: hci4: command 0x041b tx timeout [ 71.807272][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.822652][ T461] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.829839][ T461] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.839231][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.852858][ T4168] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.873783][ T4167] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.881893][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.910886][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.928657][ T461] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.935839][ T461] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.944825][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.995129][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 72.005702][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 72.013739][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.022385][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 72.034791][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 72.043374][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 72.053152][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 72.062230][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 72.070913][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.080015][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 72.095704][ T4168] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.119768][ T4178] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 72.132459][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.142140][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.152560][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 72.160334][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 72.168081][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 72.177167][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.189254][ T4173] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.216021][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.231132][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.258585][ T4176] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.271567][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.284897][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.293002][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 72.301211][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 72.313084][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 72.322705][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 72.332953][ T1235] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.340125][ T1235] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.357041][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 72.366256][ T4167] device veth0_vlan entered promiscuous mode [ 72.397852][ T4167] device veth1_vlan entered promiscuous mode [ 72.408482][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 72.419097][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 72.428409][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 72.451049][ T461] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.458264][ T461] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.511682][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 72.536734][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.555930][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.570962][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 72.622611][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 72.632192][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.641088][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.650688][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.659853][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.669431][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 72.677566][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 72.692399][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.701270][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.710251][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 72.719962][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 72.729630][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 72.738572][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 72.758418][ T4176] device veth0_vlan entered promiscuous mode [ 72.774930][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 72.783026][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 72.794144][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.805143][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 72.813722][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.824513][ T4167] device veth0_macvtap entered promiscuous mode [ 72.837598][ T4167] device veth1_macvtap entered promiscuous mode [ 72.847079][ T4178] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.877886][ T4168] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 72.889290][ T4168] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 72.900347][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 72.909509][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 72.920453][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.933543][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.942705][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 72.951267][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.960835][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.969011][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.979124][ T4176] device veth1_vlan entered promiscuous mode [ 73.011464][ T4173] device veth0_vlan entered promiscuous mode [ 73.052446][ T4167] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.063934][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 73.072989][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 73.091177][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 73.101041][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 73.110621][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.120220][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.138978][ T4178] device veth0_vlan entered promiscuous mode [ 73.152138][ T4176] device veth0_macvtap entered promiscuous mode [ 73.166523][ T4173] device veth1_vlan entered promiscuous mode [ 73.181884][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 73.191078][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 73.207279][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.220520][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.232121][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 73.240871][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 73.250524][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.271808][ T4167] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.281894][ T4176] device veth1_macvtap entered promiscuous mode [ 73.297784][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 73.307311][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.317448][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.335291][ T4167] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.345198][ T4167] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.354703][ T4167] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.363967][ T4167] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.378686][ T4178] device veth1_vlan entered promiscuous mode [ 73.434281][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 73.443497][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 73.453612][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.463016][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.485218][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 73.492859][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 73.502764][ T4173] device veth0_macvtap entered promiscuous mode [ 73.528608][ T4168] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.547330][ T4176] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.559889][ T4176] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.575418][ T4176] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.588253][ T4173] device veth1_macvtap entered promiscuous mode [ 73.604542][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.612847][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 73.622521][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.631810][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.650393][ T4178] device veth0_macvtap entered promiscuous mode [ 73.659374][ T4176] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.670441][ T4176] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.682386][ T4176] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.709452][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.719190][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.729716][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.739312][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.749613][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.764971][ T4178] device veth1_macvtap entered promiscuous mode [ 73.799069][ T4176] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.808421][ T13] Bluetooth: hci1: command 0x040f tx timeout [ 73.810029][ T4176] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.822411][ T13] Bluetooth: hci2: command 0x040f tx timeout [ 73.824256][ T4176] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.830338][ T13] Bluetooth: hci3: command 0x040f tx timeout [ 73.838273][ T4176] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.851722][ T13] Bluetooth: hci0: command 0x040f tx timeout [ 73.858109][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 73.867737][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 73.878176][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 73.889143][ T4173] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.894364][ T13] Bluetooth: hci4: command 0x040f tx timeout [ 73.901932][ T4173] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.916761][ T4173] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.927876][ T4173] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.939797][ T4173] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.967426][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.976820][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.992680][ T4173] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.008207][ T4173] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.018137][ T4173] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.029089][ T4173] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.041318][ T4173] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.066625][ T461] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.074926][ T461] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.089249][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.100234][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 74.109633][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 74.126220][ T4173] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.135485][ T4173] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.146091][ T4173] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.155007][ T4173] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.165999][ T4178] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.176942][ T4178] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.186966][ T4178] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.199452][ T4178] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.209586][ T4178] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.220185][ T4178] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.232803][ T4178] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.260785][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 74.269947][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 74.288997][ T4178] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.300740][ T4178] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.311226][ T4178] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.322469][ T4178] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.332590][ T4178] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.343333][ T4178] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.357529][ T4178] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.367455][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.381874][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.389849][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 74.410897][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 74.421313][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.432402][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 74.441379][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 74.458073][ T4178] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.467712][ T4178] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.476936][ T4178] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.487081][ T4178] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.525758][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 74.536707][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 74.545433][ T4168] device veth0_vlan entered promiscuous mode [ 74.601689][ T4168] device veth1_vlan entered promiscuous mode [ 74.622875][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.636027][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.725692][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 74.741752][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 74.750840][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.825471][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 74.839260][ T1235] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.848661][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 74.864011][ T1235] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.892518][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.897162][ T4168] device veth0_macvtap entered promiscuous mode [ 74.913685][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.919356][ T4249] loop0: detected capacity change from 0 to 2048 [ 74.937175][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.955384][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 74.965182][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.989340][ T4168] device veth1_macvtap entered promiscuous mode [ 75.018720][ T4249] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=3932051, location=3932051 [ 75.059414][ T4168] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.067757][ T4249] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 75.071065][ T4168] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.090726][ T4168] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.101746][ T4168] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.114110][ T4168] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.128276][ T4168] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.141279][ T4168] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.152372][ T4168] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.167913][ T4168] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.178341][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.193986][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.208342][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 75.224896][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 75.235168][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 75.252153][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 75.274084][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.292779][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.304878][ T4168] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.329343][ T4168] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.339847][ T4168] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.351147][ T4168] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.361646][ T4168] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.373417][ T4168] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.383851][ T4168] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.405037][ T4168] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.428435][ T4168] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.436973][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 75.446350][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 75.459259][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 75.504772][ T4168] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.513534][ T4168] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.526722][ T1235] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.534379][ T4168] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.538983][ T1235] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.543483][ T4168] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.593220][ T461] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 75.757220][ T4259] loop0: detected capacity change from 0 to 16 [ 75.815061][ T4259] erofs: (device loop0): erofs_fc_fill_super: rootino(nid 36) is not a directory(i_mode 145700) [ 75.874065][ T4245] Bluetooth: hci0: command 0x0419 tx timeout [ 75.884111][ T4245] Bluetooth: hci3: command 0x0419 tx timeout [ 75.897336][ T4245] Bluetooth: hci2: command 0x0419 tx timeout [ 75.905261][ T4245] Bluetooth: hci1: command 0x0419 tx timeout [ 75.965354][ T4245] Bluetooth: hci4: command 0x0419 tx timeout [ 76.200879][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.216975][ T1235] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.228015][ T1235] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.239113][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 76.247962][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.301998][ T4265] ptrace attach of "./syz-executor exec"[4167] was attempted by "./syz-executor exec"[4265] [ 76.388542][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 76.616259][ T26] audit: type=1326 audit(1745019373.688:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4261 comm="syz.3.4" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa07a8a6169 code=0x7fc00000 [ 76.616524][ T26] audit: type=1326 audit(1745019373.688:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4261 comm="syz.3.4" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa07a8a6169 code=0x7fc00000 [ 76.616707][ T26] audit: type=1326 audit(1745019373.688:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4261 comm="syz.3.4" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa07a8a6169 code=0x7fc00000 [ 76.616907][ T26] audit: type=1326 audit(1745019373.688:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4261 comm="syz.3.4" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa07a8a6169 code=0x7fc00000 [ 76.617135][ T26] audit: type=1326 audit(1745019373.688:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4261 comm="syz.3.4" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa07a8a6169 code=0x7fc00000 [ 76.617337][ T26] audit: type=1326 audit(1745019373.688:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4261 comm="syz.3.4" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa07a8a6169 code=0x7fc00000 [ 76.617538][ T26] audit: type=1326 audit(1745019373.688:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4261 comm="syz.3.4" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa07a8a6169 code=0x7fc00000 [ 76.617736][ T26] audit: type=1326 audit(1745019373.688:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4261 comm="syz.3.4" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa07a8a6169 code=0x7fc00000 [ 76.617910][ T26] audit: type=1326 audit(1745019373.688:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4261 comm="syz.3.4" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa07a8a6169 code=0x7fc00000 [ 76.618235][ T26] audit: type=1326 audit(1745019373.688:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4261 comm="syz.3.4" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa07a8a6169 code=0x7fc00000 [ 78.365190][ T2303] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 78.389156][ T4292] loop1: detected capacity change from 0 to 2048 [ 78.496762][ T4292] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=3932051, location=3932051 [ 78.569580][ T4292] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 78.624527][ T2303] usb 5-1: Using ep0 maxpacket: 16 [ 78.744199][ T2303] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 78.770970][ T2303] usb 5-1: config 0 has no interface number 0 [ 78.783950][ T2303] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 78.798585][ T2303] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 78.829325][ T4298] loop0: detected capacity change from 0 to 64 [ 78.874983][ T4301] loop2: detected capacity change from 0 to 512 [ 78.954780][ T2303] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 78.983990][ T1110] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 78.984514][ T2303] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 79.035445][ T2303] usb 5-1: Product: syz [ 79.047996][ T4305] loop1: detected capacity change from 0 to 16 [ 79.074239][ T2303] usb 5-1: SerialNumber: syz [ 79.085422][ T4301] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpquota,inode_readahead_blks=0x0000000000000800,minixdf,,errors=continue. Quota mode: writeback. [ 79.149555][ T4305] erofs: (device loop1): erofs_fc_fill_super: rootino(nid 36) is not a directory(i_mode 145700) [ 79.164744][ T2303] usb 5-1: config 0 descriptor?? [ 79.209647][ T4301] ext4 filesystem being mounted at /1/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 79.256885][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #140!!! [ 79.277160][ T2303] cm109 5-1:0.8: invalid payload size 0, expected 4 [ 79.410582][ T2303] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input5 [ 79.474887][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 79.793398][ T4311] ptrace attach of "./syz-executor exec"[4176] was attempted by "./syz-executor exec"[4311] [ 79.833959][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #02!!! [ 79.844936][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 79.854093][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 79.864734][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 79.873930][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 79.884257][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 79.893373][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 79.904097][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 80.074196][ T1110] usb 4-1: Using ep0 maxpacket: 16 [ 80.084002][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 80.103921][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 80.133933][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 80.153899][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 80.204877][ T1110] usb 4-1: config 0 has an invalid interface number: 228 but max is 0 [ 80.205330][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 80.222052][ T1110] usb 4-1: config 0 has no interface number 0 [ 80.229996][ T1110] usb 4-1: config 0 interface 228 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1024 [ 80.241317][ T1110] usb 4-1: config 0 interface 228 altsetting 0 bulk endpoint 0xD has invalid maxpacket 64 [ 80.415863][ T1110] usb 4-1: New USB device found, idVendor=0424, idProduct=c001, bcdDevice=49.e4 [ 80.459883][ T1110] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.481893][ T1110] usb 4-1: Product: syz [ 80.486253][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 80.498005][ T1110] usb 4-1: Manufacturer: syz [ 80.502766][ T1110] usb 4-1: SerialNumber: syz [ 80.571640][ T1110] usb 4-1: config 0 descriptor?? [ 80.637991][ T4296] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 80.643891][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 80.735941][ T4296] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 80.868368][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 80.892750][ T2303] usb 5-1: USB disconnect, device number 2 [ 80.984891][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 80.991896][ C0] cm109 5-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 81.183387][ T1110] usb 4-1: USB disconnect, device number 2 [ 81.197539][ T1110] ================================================================== [ 81.205934][ T1110] BUG: KASAN: use-after-free in hdm_disconnect+0x109/0x1c0 [ 81.213211][ T1110] Read of size 8 at addr ffff8880797f1960 by task kworker/1:2/1110 [ 81.221140][ T1110] [ 81.223490][ T1110] CPU: 1 PID: 1110 Comm: kworker/1:2 Not tainted 5.15.180-syzkaller #0 [ 81.231783][ T1110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 81.241961][ T1110] Workqueue: usb_hub_wq hub_event [ 81.247050][ T1110] Call Trace: [ 81.250447][ T1110] [ 81.253400][ T1110] dump_stack_lvl+0x1e3/0x2d0 [ 81.258114][ T1110] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 81.263871][ T1110] ? _printk+0xd1/0x120 [ 81.268062][ T1110] ? __wake_up_klogd+0xcc/0x100 [ 81.272941][ T1110] ? panic+0x860/0x860 [ 81.277040][ T1110] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 81.282538][ T1110] print_address_description+0x63/0x3b0 [ 81.288120][ T1110] ? hdm_disconnect+0x109/0x1c0 [ 81.293026][ T1110] kasan_report+0x16b/0x1c0 [ 81.297567][ T1110] ? hdm_disconnect+0x109/0x1c0 [ 81.302459][ T1110] hdm_disconnect+0x109/0x1c0 [ 81.307174][ T1110] usb_unbind_interface+0x1cd/0x840 [ 81.312451][ T1110] ? usb_driver_release_interface+0x1c0/0x1c0 [ 81.318553][ T1110] device_release_driver_internal+0x50e/0x7f0 [ 81.324669][ T1110] bus_remove_device+0x2e5/0x400 [ 81.329836][ T1110] device_del+0x6e2/0xbd0 [ 81.334213][ T1110] ? kill_device+0x160/0x160 [ 81.338832][ T1110] ? kobject_put+0x429/0x460 [ 81.343494][ T1110] usb_disable_device+0x3b8/0x840 [ 81.348582][ T1110] usb_disconnect+0x33c/0x8c0 [ 81.353279][ T1110] hub_event+0x1d58/0x54c0 [ 81.357741][ T1110] ? mark_lock+0x98/0x340 [ 81.362138][ T1110] ? led_work+0x700/0x700 [ 81.366499][ T1110] ? read_lock_is_recursive+0x10/0x10 [ 81.371981][ T1110] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 81.378157][ T1110] ? rwsem_down_write_slowpath+0x520/0x16a0 [ 81.384058][ T1110] ? _raw_spin_unlock_irqrestore+0xd9/0x130 [ 81.389983][ T1110] ? do_raw_spin_unlock+0x137/0x8b0 [ 81.395212][ T1110] process_one_work+0x8a1/0x10c0 [ 81.400177][ T1110] ? worker_detach_from_pool+0x260/0x260 [ 81.405831][ T1110] ? _raw_spin_lock_irqsave+0x120/0x120 [ 81.411416][ T1110] ? kthread_data+0x4e/0xc0 [ 81.415975][ T1110] ? wq_worker_running+0x97/0x170 [ 81.421025][ T1110] worker_thread+0xdcf/0x1280 [ 81.425734][ T1110] kthread+0x3f6/0x4f0 [ 81.429804][ T1110] ? rcu_lock_release+0x20/0x20 [ 81.434674][ T1110] ? kthread_blkcg+0xd0/0xd0 [ 81.439270][ T1110] ret_from_fork+0x1f/0x30 [ 81.443704][ T1110] [ 81.446723][ T1110] [ 81.449053][ T1110] Allocated by task 1110: [ 81.453390][ T1110] ____kasan_kmalloc+0xba/0xf0 [ 81.458170][ T1110] kmem_cache_alloc_trace+0x143/0x290 [ 81.463568][ T1110] hdm_probe+0x91/0x13d0 [ 81.467832][ T1110] usb_probe_interface+0x5c0/0xaf0 [ 81.472960][ T1110] really_probe+0x24e/0xb60 [ 81.477487][ T1110] __driver_probe_device+0x1a2/0x3d0 [ 81.482800][ T1110] driver_probe_device+0x50/0x420 [ 81.487902][ T1110] __device_attach_driver+0x2b9/0x500 [ 81.493314][ T1110] bus_for_each_drv+0x183/0x200 [ 81.498185][ T1110] __device_attach+0x359/0x570 [ 81.502949][ T1110] bus_probe_device+0xba/0x1e0 [ 81.507809][ T1110] device_add+0xb48/0xfd0 [ 81.512174][ T1110] usb_set_configuration+0x19dd/0x2020 [ 81.517672][ T1110] usb_generic_driver_probe+0x84/0x140 [ 81.523157][ T1110] usb_probe_device+0x130/0x260 [ 81.528016][ T1110] really_probe+0x24e/0xb60 [ 81.532521][ T1110] __driver_probe_device+0x1a2/0x3d0 [ 81.537816][ T1110] driver_probe_device+0x50/0x420 [ 81.542853][ T1110] __device_attach_driver+0x2b9/0x500 [ 81.548326][ T1110] bus_for_each_drv+0x183/0x200 [ 81.553206][ T1110] __device_attach+0x359/0x570 [ 81.557992][ T1110] bus_probe_device+0xba/0x1e0 [ 81.562789][ T1110] device_add+0xb48/0xfd0 [ 81.567113][ T1110] usb_new_device+0xc21/0x18f0 [ 81.571890][ T1110] hub_event+0x2cdf/0x54c0 [ 81.576357][ T1110] process_one_work+0x8a1/0x10c0 [ 81.581320][ T1110] worker_thread+0xaca/0x1280 [ 81.586179][ T1110] kthread+0x3f6/0x4f0 [ 81.590260][ T1110] ret_from_fork+0x1f/0x30 [ 81.594684][ T1110] [ 81.597028][ T1110] Freed by task 1110: [ 81.601005][ T1110] kasan_set_track+0x4b/0x80 [ 81.605606][ T1110] kasan_set_free_info+0x1f/0x40 [ 81.610571][ T1110] ____kasan_slab_free+0xd8/0x120 [ 81.615650][ T1110] slab_free_freelist_hook+0xdd/0x160 [ 81.621031][ T1110] kfree+0xf1/0x270 [ 81.624876][ T1110] device_release+0x91/0x1c0 [ 81.629482][ T1110] kobject_put+0x224/0x460 [ 81.634012][ T1110] hdm_disconnect+0xef/0x1c0 [ 81.638737][ T1110] usb_unbind_interface+0x1cd/0x840 [ 81.644089][ T1110] device_release_driver_internal+0x50e/0x7f0 [ 81.650176][ T1110] bus_remove_device+0x2e5/0x400 [ 81.655127][ T1110] device_del+0x6e2/0xbd0 [ 81.659483][ T1110] usb_disable_device+0x3b8/0x840 [ 81.664531][ T1110] usb_disconnect+0x33c/0x8c0 [ 81.669211][ T1110] hub_event+0x1d58/0x54c0 [ 81.673628][ T1110] process_one_work+0x8a1/0x10c0 [ 81.678569][ T1110] worker_thread+0xdcf/0x1280 [ 81.683246][ T1110] kthread+0x3f6/0x4f0 [ 81.687308][ T1110] ret_from_fork+0x1f/0x30 [ 81.691825][ T1110] [ 81.694141][ T1110] The buggy address belongs to the object at ffff8880797f0000 [ 81.694141][ T1110] which belongs to the cache kmalloc-8k of size 8192 [ 81.708290][ T1110] The buggy address is located 6496 bytes inside of [ 81.708290][ T1110] 8192-byte region [ffff8880797f0000, ffff8880797f2000) [ 81.721768][ T1110] The buggy address belongs to the page: [ 81.727506][ T1110] page:ffffea0001e5fc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x797f0 [ 81.737668][ T1110] head:ffffea0001e5fc00 order:3 compound_mapcount:0 compound_pincount:0 [ 81.746032][ T1110] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 81.754044][ T1110] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888017442280 [ 81.762750][ T1110] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 81.771370][ T1110] page dumped because: kasan: bad access detected [ 81.777934][ T1110] page_owner tracks the page as allocated [ 81.783660][ T1110] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3820, ts 39517875775, free_ts 39485441764 [ 81.802074][ T1110] get_page_from_freelist+0x3b78/0x3d40 [ 81.807645][ T1110] __alloc_pages+0x272/0x700 [ 81.812270][ T1110] new_slab+0xbb/0x4b0 [ 81.816450][ T1110] ___slab_alloc+0x6f6/0xe10 [ 81.821069][ T1110] kmem_cache_alloc_trace+0x1a0/0x290 [ 81.826459][ T1110] tomoyo_init_log+0x1140/0x1fe0 [ 81.831408][ T1110] tomoyo_supervisor+0x3b8/0x12c0 [ 81.836463][ T1110] tomoyo_env_perm+0x174/0x210 [ 81.841235][ T1110] tomoyo_find_next_domain+0x1469/0x1d40 [ 81.846877][ T1110] tomoyo_bprm_check_security+0xdb/0x120 [ 81.852552][ T1110] security_bprm_check+0x5f/0xa0 [ 81.857526][ T1110] bprm_execve+0x84e/0x17c0 [ 81.862057][ T1110] do_execveat_common+0x583/0x720 [ 81.867112][ T1110] __x64_sys_execve+0x8e/0xa0 [ 81.871828][ T1110] do_syscall_64+0x3b/0x80 [ 81.876285][ T1110] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 81.882220][ T1110] page last free stack trace: [ 81.886916][ T1110] free_unref_page_prepare+0xc34/0xcf0 [ 81.892413][ T1110] free_unref_page+0x95/0x2d0 [ 81.897119][ T1110] __unfreeze_partials+0x1b7/0x210 [ 81.902256][ T1110] put_cpu_partial+0x132/0x1a0 [ 81.907045][ T1110] ___cache_free+0xe3/0x100 [ 81.911596][ T1110] qlist_free_all+0x36/0x90 [ 81.916134][ T1110] kasan_quarantine_reduce+0x162/0x180 [ 81.921623][ T1110] __kasan_slab_alloc+0x2f/0xc0 [ 81.926525][ T1110] slab_post_alloc_hook+0x53/0x380 [ 81.931681][ T1110] kmem_cache_alloc+0xf3/0x280 [ 81.936516][ T1110] vm_area_alloc+0x20/0xe0 [ 81.940969][ T1110] mmap_region+0xc3c/0x1870 [ 81.945509][ T1110] do_mmap+0x78d/0xe00 [ 81.949611][ T1110] vm_mmap_pgoff+0x1ca/0x2d0 [ 81.954277][ T1110] ksys_mmap_pgoff+0x559/0x780 [ 81.959072][ T1110] do_syscall_64+0x3b/0x80 [ 81.963524][ T1110] [ 81.965867][ T1110] Memory state around the buggy address: [ 81.971524][ T1110] ffff8880797f1800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.979666][ T1110] ffff8880797f1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.987757][ T1110] >ffff8880797f1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.995835][ T1110] ^ [ 82.003108][ T1110] ffff8880797f1980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 82.011204][ T1110] ffff8880797f1a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 82.019291][ T1110] ================================================================== [ 82.027373][ T1110] Disabling lock debugging due to kernel taint [ 82.028946][ T4327] loop4: detected capacity change from 0 to 1024 [ 82.043042][ T2303] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 82.075878][ T1110] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 82.083221][ T1110] CPU: 1 PID: 1110 Comm: kworker/1:2 Tainted: G B 5.15.180-syzkaller #0 [ 82.092877][ T1110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 82.102949][ T1110] Workqueue: usb_hub_wq hub_event [ 82.108156][ T1110] Call Trace: [ 82.111431][ T1110] [ 82.114382][ T1110] dump_stack_lvl+0x1e3/0x2d0 [ 82.119071][ T1110] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 82.124798][ T1110] ? panic+0x860/0x860 [ 82.128900][ T1110] ? rcu_is_watching+0x11/0xa0 [ 82.133672][ T1110] ? preempt_schedule_common+0xa6/0xd0 [ 82.139137][ T1110] panic+0x318/0x860 [ 82.143032][ T1110] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 82.149186][ T1110] ? check_panic_on_warn+0x1d/0xa0 [ 82.154304][ T1110] ? fb_is_primary_device+0xd0/0xd0 [ 82.159503][ T1110] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 82.165488][ T1110] ? _raw_spin_unlock+0x40/0x40 [ 82.170347][ T1110] check_panic_on_warn+0x7e/0xa0 [ 82.175304][ T1110] ? hdm_disconnect+0x109/0x1c0 [ 82.180156][ T1110] end_report+0x6d/0xf0 [ 82.184339][ T1110] kasan_report+0x18e/0x1c0 [ 82.189017][ T1110] ? hdm_disconnect+0x109/0x1c0 [ 82.193872][ T1110] hdm_disconnect+0x109/0x1c0 [ 82.198551][ T1110] usb_unbind_interface+0x1cd/0x840 [ 82.203752][ T1110] ? usb_driver_release_interface+0x1c0/0x1c0 [ 82.209842][ T1110] device_release_driver_internal+0x50e/0x7f0 [ 82.215944][ T1110] bus_remove_device+0x2e5/0x400 [ 82.220900][ T1110] device_del+0x6e2/0xbd0 [ 82.225263][ T1110] ? kill_device+0x160/0x160 [ 82.229886][ T1110] ? kobject_put+0x429/0x460 [ 82.234501][ T1110] usb_disable_device+0x3b8/0x840 [ 82.239654][ T1110] usb_disconnect+0x33c/0x8c0 [ 82.244340][ T1110] hub_event+0x1d58/0x54c0 [ 82.248995][ T1110] ? mark_lock+0x98/0x340 [ 82.253360][ T1110] ? led_work+0x700/0x700 [ 82.257929][ T1110] ? read_lock_is_recursive+0x10/0x10 [ 82.263337][ T1110] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 82.269338][ T1110] ? rwsem_down_write_slowpath+0x520/0x16a0 [ 82.275245][ T1110] ? _raw_spin_unlock_irqrestore+0xd9/0x130 [ 82.281158][ T1110] ? do_raw_spin_unlock+0x137/0x8b0 [ 82.286385][ T1110] process_one_work+0x8a1/0x10c0 [ 82.291411][ T1110] ? worker_detach_from_pool+0x260/0x260 [ 82.297046][ T1110] ? _raw_spin_lock_irqsave+0x120/0x120 [ 82.302593][ T1110] ? kthread_data+0x4e/0xc0 [ 82.307100][ T1110] ? wq_worker_running+0x97/0x170 [ 82.312121][ T1110] worker_thread+0xdcf/0x1280 [ 82.316810][ T1110] kthread+0x3f6/0x4f0 [ 82.320878][ T1110] ? rcu_lock_release+0x20/0x20 [ 82.325725][ T1110] ? kthread_blkcg+0xd0/0xd0 [ 82.330315][ T1110] ret_from_fork+0x1f/0x30 [ 82.334772][ T1110] [ 82.338565][ T1110] Kernel Offset: disabled [ 82.342893][ T1110] Rebooting in 86400 seconds..