last executing test programs: 17.178713118s ago: executing program 2 (id=64): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x5, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000e8f70000000000ff000044850000000e000000650000005000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kfree\x00', r0}, 0x18) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x3, 0x0, 0x0) bind$inet6(r1, 0x0, 0x0) r2 = dup(r1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r2) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x4, 0x0, 0xf7, 0x7, 0x28, @mcast2, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x8000, 0x700, 0x8, 0x1ff}}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000001c0), &(0x7f0000000240)=0x4) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000300)={'syztnl2\x00', &(0x7f00000003c0)={'syztnl0\x00', 0x0, 0x29, 0x0, 0x5, 0xfffffffc, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}, @private0, 0x8, 0x8, 0x0, 0x600}}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB, @ANYBLOB, @ANYBLOB], 0x94}, 0x1, 0x0, 0x0, 0x4008000}, 0x8081) r3 = creat(0x0, 0x0) fallocate(r3, 0x0, 0x0, 0x1000f4) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = dup(r4) ioctl$TIOCL_SETSEL(r5, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x300, 0x23, 0x501}}) 15.142708167s ago: executing program 2 (id=68): pipe(0x0) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@random="8580f83288e1", @multicast, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x1, 0x5, 0x30, 0x67, 0x0, 0x2, 0x2, 0x0, @private=0xa010102, @broadcast}, {0x14, 0x85, 0x0, @remote, "de4930ff951ab967d5cb4d3777b327950e9befd1"}}}}}, 0x0) 15.00171382s ago: executing program 2 (id=70): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000001980)={0x2, 0x1, @loopback}, 0x10) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={0x6c, r4, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MLSCATLST={0x44, 0xc, 0x0, 0x1, [{0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5cc1}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4eb3}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6719635e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xad10}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3615}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xeba3}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xefde}]}]}]}, 0x6c}}, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) 13.9569315s ago: executing program 3 (id=72): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x800000000000012) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000440), 0x0, 0x0) read$msr(r0, &(0x7f000001f6c0)=""/102400, 0x19000) sysinfo(0x0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r1, 0x8982, &(0x7f0000000040)={0x0, 'erspan0\x00', {0x1}, 0xf106}) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) sysinfo(&(0x7f0000000080)=""/95) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000100)=0x3) setitimer(0x0, 0x0, 0x0) landlock_create_ruleset(&(0x7f0000000000)={0x8008, 0x0, 0x2}, 0x18, 0x0) 13.193506105s ago: executing program 2 (id=74): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60140, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f00000001c0)=0x3) 11.848300911s ago: executing program 2 (id=76): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x801, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fcntl$notify(0xffffffffffffffff, 0x402, 0x8000001c) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) r1 = syz_open_dev$media(&(0x7f00000006c0), 0x4007, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r1, 0x80047c05, &(0x7f0000000940)=0xffffffffffffffff) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r2, 0x7c81, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x311082, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) 10.32996394s ago: executing program 4 (id=78): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) keyctl$unlink(0x9, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f2110"], 0x0) r1 = add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$read(0xb, r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r2, 0x0, 0x11) read$char_usb(r2, &(0x7f0000000100)=""/178, 0xb2) syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x2, 0x8000, 0x400246}, &(0x7f0000000340), &(0x7f0000000640)) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, &(0x7f0000000040)) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f00000000c0)="ad") keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000240)={0x0, 0x7c, 0x5d}, &(0x7f0000000480)={'enc=', 'pkcs1', ' hash=', {'crc32c\x00'}}, &(0x7f0000000500)="81942d0a51adf6553bb62280d183f62efc093b8c39cca7317c410fab99e5cea23ec4fa40b5ee1cd10eff3f3f433b32eaf697445a00aa599da594f619a44151534987315b9a23e401fac42ce7245824d8ef2794f87fe7a24de7fb5829f9faff778b5cf17b8f2e2234d3c669faebc7d6dffcb1ae3f94bc1578eef51795", &(0x7f00000005c0)=""/93) syz_usb_connect(0x3, 0x0, 0x0, 0x0) 10.202828013s ago: executing program 3 (id=79): socket$netlink(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0)={0x0, 0x0, 0x2000, 0xfffffffc}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d0b939d60a53067d50000200006241a0000000905810300020000000904010000020d00000904010102020d0000090582020002000000090b"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = socket(0xa, 0x3, 0x3a) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f00000001c0)={0x0, 0x2, "4cf90fba85c830e42a3ca4b10f01bbcb15f3806c4853e7c44a6974759d9f643905a56baa4195fb396d9bfa306999f1586e5d1ca49add100a36b751a7d9fe0b182ebf2c8a0e66f72c1c08260030752f07cd4089473e52885a3c85bacf3ccfac5bb9435fe036dcfccd7254bbd8bce90e2284d29e1f17d6652270fd0abcb8729f16ff602b438bd122a9e09984e2799d0dbfef7533d1a930ea4f4b57605ace45f5815450693650ae122d34aa0c5ca5e793516d156e5a5b34d6c17c40d753426a3d8e15e726d0f2622e873e0cbe63751bb62c68594d4cb0a21b92ad2e80f24a9b290a87ee6779022a0b7f5223e4e8c9f53f501ec8c439724078fdc076a51d50760566"}) setsockopt$bt_l2cap_L2CAP_OPTIONS(r3, 0x6, 0x1, &(0x7f00000000c0)={0x6, 0x1, 0x4, 0x7, 0x4, 0x40}, 0xc) ioctl$USBDEVFS_ALLOC_STREAMS(r4, 0x8008551c, &(0x7f0000000000)={0x184a, 0xb, [{0x1, 0x1}, {0x2}, {0xa}, {0x5, 0x1}, {0x4}, {0x6, 0x1}, {0x6, 0x1}, {0xb}, {0xc, 0x1}, {0x3, 0x1}, {0xe}]}) r5 = socket$inet_smc(0x2b, 0x1, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r6, 0x5402, &(0x7f0000000200)={0xfffffffc, 0x0, 0x6, 0x0, 0xff, "db8f2d2b3b7596160c6981acf8805944823a7f"}) getsockopt$inet_pktinfo(r5, 0x0, 0x8, 0x0, 0x0) unshare(0x1e000480) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000000000408c0d220000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f0000000980)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0}, 0x0) 9.759279411s ago: executing program 1 (id=81): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x7ffffffffffffffe) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) read$FUSE(r3, &(0x7f0000001280)={0x2020}, 0x2020) 9.720487462s ago: executing program 2 (id=82): setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52", 0xc) socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x80108907, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x40c}, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff000000009408048000001700638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb702", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000008000000850000006900000095"], &(0x7f0000005d80)='syzkaller\x00', 0xc}, 0x94) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000004c0)="d80000001a0081044e81f782db4cb904021d0800fe0055a1150015000200142603600e12080005007a010401a8001600200002400400027c035c0461c1d67f6f94007134cf6efb8000a007a290457fffffffffffff0001bace8017cbec4c2ee5a7cef4090000001fb79164d322fe7c9f8775d3f2d5d0683f5aeb4edbb57a5025ccca9e00360db785262f3d40fad95667e006dcdf61951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a94100000000000000000000000000d4da15", 0xd8}], 0x1}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) sendmsg$IEEE802154_ASSOCIATE_REQ(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)={0x68, 0x0, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x18}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x4}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x7}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}]}, 0x68}, 0x1, 0x0, 0x0, 0x8800}, 0x10) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) readlinkat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', &(0x7f0000000240)=""/36, 0x24) openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0xf1, 0x0, 0x0, 0x2) r5 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f0000000100)=0x3) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x2002, 0x0) write$rfkill(r6, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) sysfs$1(0x1, &(0x7f0000000080)='\x00') io_uring_setup(0x29f8, &(0x7f0000000180)={0x0, 0xfffffffc, 0x0, 0x20000000}) openat$kvm(0xffffff9c, &(0x7f0000000000), 0x800, 0x0) 8.735553971s ago: executing program 1 (id=84): syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') unshare(0x40400) pselect6(0x40, &(0x7f0000000180)={0x1f, 0x0, 0x3ff, 0x0, 0x9}, 0x0, 0x0, 0x0, 0x0) 8.631446074s ago: executing program 1 (id=85): socket(0x2, 0x80805, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x5) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) io_uring_enter(0xffffffffffffffff, 0x92, 0x0, 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x185) r3 = inotify_init() inotify_add_watch(r3, &(0x7f0000000000)='./file1\x00', 0x56000129) fallocate(r2, 0x0, 0x1000000, 0x3) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r2, 0x2000000) 7.498669925s ago: executing program 0 (id=87): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x78) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000080)={0x1, 0xfffa, 0x4, 0x4, 0x3, 0xb2, 0x5}, 0xc) connect$bt_l2cap(r0, &(0x7f0000000700)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}, 0xe) sendmsg$inet(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000000c0)="a3", 0x1}], 0x1}, 0x20008850) 7.25833695s ago: executing program 1 (id=88): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000000), 0x4, 0x2080) ioctl$LOOP_SET_FD(r3, 0x4c00, r2) ioctl$LOOP_SET_FD(r3, 0x4c03, r3) dup2(r2, r0) ioctl$SYNC_IOC_FILE_INFO(r2, 0xc0383e04, 0x0) 6.400719866s ago: executing program 0 (id=89): openat$kvm(0xffffffffffffff9c, 0x0, 0x100, 0x0) socket(0x11, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c2e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0x1000}}, 0x1006) syz_emit_vhci(&(0x7f0000001080)=ANY=[@ANYBLOB="040e0503580c"], 0x8) 6.306578648s ago: executing program 4 (id=90): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000060000000000000000008500000007000000850000000e00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000012c0)={&(0x7f0000000040)='kfree\x00', r0, 0x0, 0xaa46}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000740)=@framed, &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000000c0)) r1 = socket(0x2b, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f0000000040)=0x3, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x5, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xc94284a3061bb7fe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ac0)={&(0x7f0000000b00)='kmem_cache_free\x00', r2, 0x0, 0x1034}, 0x18) r3 = openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r4 = syz_io_uring_setup(0xbdf, 0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) r7 = syz_open_dev$evdev(&(0x7f00000002c0), 0xc000, 0x142) ioctl$EVIOCGRAB(r7, 0x40044590, &(0x7f0000000080)=0x76960bb5) write$evdev(r7, &(0x7f0000000640)=[{{0x77359400}, 0x1, 0x7f, 0xb}, {{}, 0x0, 0x0, 0x41}], 0x30) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r3, 0x0, &(0x7f0000000600)}) io_uring_enter(r4, 0x847ba, 0x2000, 0xe, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYRES16], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000b40)=ANY=[@ANYBLOB="180000000000000000000000000000001811000082ee2709fe9b993d85b9e892f1b16b41eff6d14e42e0da465bbabc45d35bc488238328800928c0f353b340078a2c9bd017f9a667c57981228b11047cb05c98f2c95c2ffbd0cabf16a84d48de62cbfa475f36c01df822e2d2194e4f43216366cc8a62442d423af01140e16f9508360dd0567465eff543da4caf57bd28c280b91b2e5d9dfff2f628626d07d9046452f0e51a31e94436d974de53a9628f2776249ec1bb7f0b0bafeae9988359ea", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='block_bio_remap\x00', r8}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000300)='vlan0\x00', 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8fffffff703000008000000b704000600000000855be1213400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 6.278644409s ago: executing program 0 (id=91): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x11, 0xa, 0x0) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000000)=@unlock_all, 0x7) sendmsg$can_bcm(r0, &(0x7f0000000140)={&(0x7f0000000000), 0x12, &(0x7f0000000080)={0x0}, 0x8}, 0x0) 6.175519721s ago: executing program 4 (id=92): mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@metacopy_on}]}) r0 = open(&(0x7f0000000200)='./file0\x00', 0x200081, 0x4c) mknodat$loop(r0, &(0x7f0000001600)='./file1\x00', 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') link(&(0x7f00000002c0)='./file1\x00', &(0x7f0000000380)='./file2\x00') link(&(0x7f0000000000)='./file1\x00', &(0x7f00000001c0)='./file0\x00') 6.146210641s ago: executing program 0 (id=93): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x9, [0x7, 0x5, 0x5, 0x9, 0x8, 0x5, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x8, 0x9, 0xd, 0x2, 0x12a3, 0x6, 0x1, 0x2, 0x3, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x3, 0x0, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x400, 0x7fff, 0x5, 0xa7, 0x81, 0x9, 0xf9a2, 0x6, 0xff, 0x0, 0xfffffffe, 0x2, 0x3, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x6], [0x9, 0x7ff, 0x6, 0x5f, 0x4, 0xc66, 0xa8a9, 0x73, 0x8e, 0x10001, 0x7, 0x5, 0x2, 0x9, 0x4, 0x5, 0x1000, 0x0, 0x200b398, 0x1, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x400, 0xffff58b9, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x762, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x9, 0xfffffff9, 0x200004, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x2, 0xc, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x2, 0x2, 0x400, 0x40, 0x6, 0x7, 0x7, 0x5, 0x0, 0x5, 0x9, 0x0, 0x3, 0x2c, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xfe, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd80, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0x7, 0xc, 0x77, 0x9, 0xfffffffc, 0x10000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0xbfe, 0x8, 0x7c81, 0x2, 0xfffffff8, 0x40, 0xff, 0x5, 0x7fffffff, 0x3, 0x74b, 0x9, 0x81, 0x3, 0x9d86, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x7, 0x101, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x6, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x5337, 0x5, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x13ffd, 0x1, 0x1b10]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 6.145654022s ago: executing program 1 (id=94): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) fadvise64(r0, 0x3, 0xfffffffffffffff9, 0x2) 5.754617499s ago: executing program 4 (id=95): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f00000003c0)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) syz_open_dev$dri(0x0, 0x40100001, 0x189002) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') keyctl$chown(0x4, 0x0, 0xee01, 0x0) keyctl$setperm(0x5, 0x0, 0x30925) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x28, 0x3e, 0xd07, 0xfffffffe, 0x0, {0x1, 0x7c}, [@typed={0x4, 0x8e}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\x1a'}]}, @nested={0x4, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4048011}, 0x4044000) 4.581179742s ago: executing program 4 (id=96): openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x842, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) timerfd_create(0x0, 0x80800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='sched_switch\x00', 0xffffffffffffffff, 0x0, 0xfff7fffffffffff5}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0xffffffffffffff61, 0x0, 0x0}) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) connect(r3, &(0x7f0000000200)=@ll={0x27, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80) 4.477212494s ago: executing program 3 (id=97): r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r4, &(0x7f0000002880)={0x0, 0x0, &(0x7f0000002840)={&(0x7f00000027c0)={0x14, r5, 0x301, 0x70bd25, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x24008040) write$nbd(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="5d6c548e6f4b7d2d81971a6eb181e6525c1a8ef51543459c7759c1583b21ec8317437d2464fcd6588f3db5da65d95c64c21d0ea59550beb8839f7186ec2144b2e7e4a984a99f4611c5fe0c037f42664f65ca34be397c02e27062928258b9480de68cad69240a82185c496b4199380cb66cf20e31b13b2980217196900133ff99e42afbf10650db27c970b8fcf7680c5228aeffaaff2f6ee6735b39dc326c6308fee3521a39b56b015e931ae14dbdc641adf681c9ef04ef1753c75b094c66a2a24b59bca57a6ca85c87ea5c74b24ea35f061da0f220578ba83513f96ff348ddb808e84134e538310e6e7ff5e2a89f38", @ANYBLOB="73efe7f3d5646071fb21d2a03e6216ca0ae20da1b8aedf386fd0a21089ec75d6153c5a7f0d63b02b9bd2c2a39687f5ada52a367d76e46c4e25e8e798592c472c3b456698346fce487a7d62605af8eb59af2cf981"], 0x40) 2.004797742s ago: executing program 4 (id=98): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r3 = dup(r2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r6 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) socket$pppl2tp(0x18, 0x1, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000f7850000002d"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_open_procfs(0x0, &(0x7f00000190c0)='net/ip_tables_targets\x00') pread64(r7, &(0x7f0000000080)=""/102356, 0x18fd4, 0xc2a) write$FUSE_BMAP(r3, &(0x7f0000000180)={0x18}, 0x18) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x88002, 0x0) timer_gettime(0x0, 0x0) write$FUSE_DIRENTPLUS(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x4, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) fcntl$getownex(r0, 0x10, &(0x7f0000019080)={0x0, 0x0}) r9 = syz_open_procfs(r8, &(0x7f0000019100)='net/wireless\x00') read$FUSE(r9, &(0x7f0000000980)={0x2020}, 0x2020) 1.883873574s ago: executing program 3 (id=99): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="180200000000000000000000000000008500000011000000180100002020692500000000002020207b1af8ff00000000bfa110000000be8214b00000f8ffffffb702000008000000b703000000000000850000007b00000095"], &(0x7f0000000040)='syzkaller\x00', 0x1, 0x0, 0x0, 0x40f00}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r3, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="280000000e0601010000000000000000020000000900020073797a32020000000500010007000000"], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x40880) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000640)={0x24, 0x1, 0x1, 0x301, 0x0, 0x0, {0x0, 0x0, 0x8}, [@CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x1}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x10}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000004}, 0x40c4) bpf$MAP_CREATE(0x300000000000000, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000004000000410000000000000001000000", @ANYRES32=0x1, @ANYBLOB="0000000000007acc000000000000000017000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0340000001"], 0x48) 1.782906056s ago: executing program 0 (id=100): socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x8) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x40004}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) setpriority(0x2, 0x0, 0x4) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffffff, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000000c0)='ip6_vti0\x00', 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=']) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r2 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r2, 0x0) setpgid(0x0, r2) syz_emit_ethernet(0xc2, &(0x7f0000000440)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x22}, @val={@val={0x88a8, 0x0, 0x0, 0x2}, {0x8100, 0x1, 0x1, 0x3}}, {@mpls_mc={0x8848, {[{0xa}, {0xd5149}, {0x6}], @ipv4=@icmp={{0x19, 0x4, 0x2, 0x0, 0xa0, 0x67, 0x0, 0x9, 0x1, 0x0, @private=0xa010102, @local, {[@generic={0x83, 0x6, "b94509c4"}, @timestamp_addr={0x44, 0x2c, 0x18, 0x1, 0x3, [{@dev={0xac, 0x14, 0x14, 0x3d}, 0xffffffff}, {@remote}, {@empty, 0x3}, {@multicast2, 0x8}, {@loopback, 0x7f}]}, @end, @lsrr={0x83, 0x13, 0x76, [@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @rr={0x7, 0x7, 0x39, [@multicast1]}]}}, @dest_unreach={0x3, 0x3, 0x0, 0x0, 0x40, 0x9, {0xd, 0x4, 0x3, 0x38, 0x6, 0x65, 0x5, 0xff, 0x1d, 0xd7bd, @broadcast, @multicast2, {[@timestamp={0x44, 0x20, 0xd4, 0x0, 0x4, [0x2, 0x6, 0x8, 0x5, 0x6, 0xfffff801, 0x6]}]}}}}}}}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, 0x0) 865.261734ms ago: executing program 3 (id=101): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x98, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 522.552541ms ago: executing program 3 (id=102): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000060000000000000000008500000007000000850000000e00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000012c0)={&(0x7f0000000040)='kfree\x00', r0, 0x0, 0xaa46}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000740)=@framed, &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000000c0)) r1 = socket(0x2b, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f0000000040)=0x3, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x5, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xc94284a3061bb7fe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ac0)={&(0x7f0000000b00)='kmem_cache_free\x00', r2, 0x0, 0x1034}, 0x18) r3 = openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r4 = syz_io_uring_setup(0xbdf, 0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) r7 = syz_open_dev$evdev(&(0x7f00000002c0), 0xc000, 0x142) ioctl$EVIOCGRAB(r7, 0x40044590, &(0x7f0000000080)=0x76960bb5) write$evdev(r7, &(0x7f0000000640)=[{{0x77359400}, 0x1, 0x7f, 0xb}, {{}, 0x0, 0x0, 0x41}], 0x30) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r3, 0x0, &(0x7f0000000600)}) io_uring_enter(r4, 0x847ba, 0x2000, 0xe, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYRES16], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000b40)=ANY=[@ANYBLOB="180000000000000000000000000000001811000082ee2709fe9b993d85b9e892f1b16b41eff6d14e42e0da465bbabc45d35bc488238328800928c0f353b340078a2c9bd017f9a667c57981228b11047cb05c98f2c95c2ffbd0cabf16a84d48de62cbfa475f36c01df822e2d2194e4f43216366cc8a62442d423af01140e16f9508360dd0567465eff543da4caf57bd28c280b91b2e5d9dfff2f628626d07d9046452f0e51a31e94436d974de53a9628f2776249ec1bb7f0b0bafeae9988359ea", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='block_bio_remap\x00', r8}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000300)='vlan0\x00', 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8fffffff703000008000000b704000600000000855be1213400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 29.76275ms ago: executing program 0 (id=103): syz_usb_connect(0x0, 0x2d, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x0, &(0x7f00000001c0)}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000140)={0x3, &(0x7f00000000c0)=[{0xfff, 0x4, 0x8b, 0x8}, {0xb, 0x1, 0x2, 0x400}, {0x6, 0x7, 0xfb, 0x2}]}) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d", @ANYRES64], 0xf8) socket$netlink(0x10, 0x3, 0x0) 0s ago: executing program 1 (id=104): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x9c, 0xb, 0x0, 0xffffffffffffffff, 0x327}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.165' (ED25519) to the list of known hosts. [ 68.000434][ T4172] cgroup: Unknown subsys name 'net' [ 68.205198][ T4172] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 69.847447][ T4172] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 71.283404][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.291961][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.625328][ T4191] chnl_net:caif_netlink_parms(): no params data found [ 71.723292][ T4185] chnl_net:caif_netlink_parms(): no params data found [ 71.739299][ T4195] chnl_net:caif_netlink_parms(): no params data found [ 71.825226][ T4196] chnl_net:caif_netlink_parms(): no params data found [ 71.856870][ T4191] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.867678][ T4191] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.879558][ T4191] device bridge_slave_0 entered promiscuous mode [ 71.928640][ T4191] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.937622][ T4191] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.949583][ T4191] device bridge_slave_1 entered promiscuous mode [ 71.964572][ T4186] chnl_net:caif_netlink_parms(): no params data found [ 72.053403][ T4185] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.062125][ T4185] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.071305][ T4185] device bridge_slave_0 entered promiscuous mode [ 72.084444][ T4191] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.122466][ T4185] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.131944][ T4185] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.133881][ T4185] device bridge_slave_1 entered promiscuous mode [ 72.150733][ T4191] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.199388][ T4195] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.207780][ T4195] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.218466][ T4195] device bridge_slave_0 entered promiscuous mode [ 72.233803][ T4196] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.241967][ T4196] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.252697][ T4196] device bridge_slave_0 entered promiscuous mode [ 72.281333][ T4195] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.290212][ T4195] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.301424][ T4195] device bridge_slave_1 entered promiscuous mode [ 72.315656][ T4196] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.326250][ T4196] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.336165][ T4196] device bridge_slave_1 entered promiscuous mode [ 72.348967][ T4185] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.364424][ T4191] team0: Port device team_slave_0 added [ 72.373891][ T4191] team0: Port device team_slave_1 added [ 72.410694][ T4185] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.480500][ T4195] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.491724][ T4186] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.500068][ T4186] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.510248][ T4186] device bridge_slave_0 entered promiscuous mode [ 72.521113][ T4196] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.542122][ T4191] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.550921][ T4191] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.583100][ T4191] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.600819][ T4195] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.612330][ T4186] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.623335][ T4186] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.636128][ T4186] device bridge_slave_1 entered promiscuous mode [ 72.649464][ T4196] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.673909][ T4185] team0: Port device team_slave_0 added [ 72.687758][ T4185] team0: Port device team_slave_1 added [ 72.701265][ T4191] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.711248][ T4191] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.748169][ T4191] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.849450][ T4186] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.888496][ T4195] team0: Port device team_slave_0 added [ 72.901389][ T4196] team0: Port device team_slave_0 added [ 72.911218][ T4186] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.924756][ T4185] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.933473][ T4185] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.969348][ T4185] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.995418][ T4195] team0: Port device team_slave_1 added [ 73.003752][ T4196] team0: Port device team_slave_1 added [ 73.020899][ T4185] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.030155][ T4185] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.064487][ T4185] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.084021][ T4191] device hsr_slave_0 entered promiscuous mode [ 73.093253][ T4191] device hsr_slave_1 entered promiscuous mode [ 73.156243][ T4186] team0: Port device team_slave_0 added [ 73.165519][ T4186] team0: Port device team_slave_1 added [ 73.184102][ T4195] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.193579][ T23] Bluetooth: hci2: command 0x0409 tx timeout [ 73.194417][ T4195] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.232473][ T2286] Bluetooth: hci3: command 0x0409 tx timeout [ 73.233764][ T4195] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.238833][ T2286] Bluetooth: hci1: command 0x0409 tx timeout [ 73.238888][ T2286] Bluetooth: hci0: command 0x0409 tx timeout [ 73.238917][ T2286] Bluetooth: hci4: command 0x0409 tx timeout [ 73.272135][ T4196] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.279981][ T4196] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.310579][ T4196] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.347992][ T4195] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.355896][ T4195] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.387073][ T4195] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.402669][ T4196] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.410687][ T4196] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.444072][ T4196] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.471114][ T4186] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.480690][ T4186] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.514877][ T4186] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.554178][ T4186] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.563306][ T4186] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.592431][ T4186] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.633563][ T4185] device hsr_slave_0 entered promiscuous mode [ 73.642554][ T4185] device hsr_slave_1 entered promiscuous mode [ 73.650710][ T4185] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.659974][ T4185] Cannot create hsr debugfs directory [ 73.698398][ T4196] device hsr_slave_0 entered promiscuous mode [ 73.706975][ T4196] device hsr_slave_1 entered promiscuous mode [ 73.715173][ T4196] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.723898][ T4196] Cannot create hsr debugfs directory [ 73.789853][ T4195] device hsr_slave_0 entered promiscuous mode [ 73.798684][ T4195] device hsr_slave_1 entered promiscuous mode [ 73.806058][ T4195] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.815174][ T4195] Cannot create hsr debugfs directory [ 73.904113][ T4186] device hsr_slave_0 entered promiscuous mode [ 73.926292][ T4186] device hsr_slave_1 entered promiscuous mode [ 73.938255][ T4186] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.949368][ T4186] Cannot create hsr debugfs directory [ 74.255292][ T4191] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 74.268774][ T4191] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 74.282898][ T4191] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 74.297674][ T4191] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 74.381137][ T4185] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 74.396165][ T4185] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 74.416958][ T4185] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 74.444304][ T4185] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 74.511486][ T4196] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 74.528453][ T4196] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 74.542930][ T4196] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 74.559926][ T4191] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.578593][ T4196] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 74.635844][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 74.652040][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 74.666625][ T4191] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.719584][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 74.730789][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 74.744171][ T469] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.754716][ T469] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.766305][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 74.778810][ T4186] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 74.790235][ T4186] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 74.804735][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 74.815701][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 74.825451][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.833072][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.866740][ T4186] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 74.886118][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 74.924391][ T4186] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 74.950849][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 74.964980][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 74.983567][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 74.999084][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 75.009158][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 75.019958][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 75.061461][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 75.073318][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 75.092559][ T4185] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.120332][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 75.131107][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 75.155394][ T4191] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 75.166849][ T4195] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 75.182146][ T4195] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 75.194380][ T4195] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 75.216456][ T4195] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 75.236764][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 75.254773][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 75.268727][ T4239] Bluetooth: hci4: command 0x041b tx timeout [ 75.271995][ T4254] Bluetooth: hci2: command 0x041b tx timeout [ 75.289213][ T4185] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.295738][ T4239] Bluetooth: hci0: command 0x041b tx timeout [ 75.303682][ T4239] Bluetooth: hci1: command 0x041b tx timeout [ 75.318943][ T4239] Bluetooth: hci3: command 0x041b tx timeout [ 75.352403][ T4196] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.369675][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 75.381116][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 75.394165][ T469] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.404774][ T469] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.442626][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 75.456993][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 75.475177][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 75.487648][ T469] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.495810][ T469] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.505141][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 75.516937][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 75.526750][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 75.544472][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 75.556609][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 75.570864][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 75.592691][ T4196] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.619839][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 75.643506][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 75.654927][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 75.690820][ T4186] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.708453][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 75.719266][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 75.731972][ T469] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.740319][ T469] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.751747][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 75.762474][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 75.774684][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 75.787525][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 75.799540][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 75.835674][ T4191] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.862975][ T4185] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 75.878541][ T4185] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 75.891681][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 75.903583][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 75.923382][ T469] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.931760][ T469] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.942267][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 75.954926][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 75.967839][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 75.978477][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 76.016722][ T4186] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.050687][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 76.073755][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 76.084646][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 76.094722][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.105509][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 76.116759][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 76.129281][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 76.139233][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 76.149801][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 76.165753][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 76.184042][ T4195] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.201595][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 76.223959][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 76.238622][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 76.256617][ T469] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.264423][ T469] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.292838][ T4196] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 76.334709][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 76.345583][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 76.360793][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 76.370996][ T469] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.382049][ T469] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.394882][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 76.403865][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.416318][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 76.435497][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 76.449131][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 76.462651][ T4195] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.496849][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 76.518469][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 76.534236][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 76.548447][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 76.566321][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 76.580153][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 76.592486][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 76.613016][ T4191] device veth0_vlan entered promiscuous mode [ 76.624501][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 76.635024][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 76.646011][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 76.663706][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 76.677050][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 76.692278][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 76.705476][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 76.728099][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 76.738284][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 76.753921][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 76.766092][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 76.781947][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.790603][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.808599][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 76.832883][ T4185] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.844915][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 76.853812][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 76.869994][ T4186] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 76.892168][ T4191] device veth1_vlan entered promiscuous mode [ 76.906832][ T4196] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.916906][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 76.934277][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 76.947026][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 76.970187][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.978043][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.021336][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 77.041420][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 77.112754][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 77.124184][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 77.135008][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 77.145902][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 77.156774][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 77.168051][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 77.178840][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 77.189532][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 77.200380][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 77.210237][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 77.220105][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 77.230532][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 77.242408][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 77.259796][ T4195] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 77.279251][ T4191] device veth0_macvtap entered promiscuous mode [ 77.321622][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 77.333305][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 77.344531][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 77.353915][ T4240] Bluetooth: hci3: command 0x040f tx timeout [ 77.358107][ T4254] Bluetooth: hci2: command 0x040f tx timeout [ 77.362309][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 77.375954][ T4240] Bluetooth: hci1: command 0x040f tx timeout [ 77.376366][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 77.383006][ T4240] Bluetooth: hci0: command 0x040f tx timeout [ 77.397574][ T4240] Bluetooth: hci4: command 0x040f tx timeout [ 77.399040][ T4186] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.420447][ T4196] device veth0_vlan entered promiscuous mode [ 77.435819][ T4185] device veth0_vlan entered promiscuous mode [ 77.447124][ T4191] device veth1_macvtap entered promiscuous mode [ 77.458935][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 77.468342][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 77.478972][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 77.490629][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 77.500404][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 77.511724][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 77.522546][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 77.532854][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 77.542294][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 77.572769][ T4196] device veth1_vlan entered promiscuous mode [ 77.605598][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.626479][ T4185] device veth1_vlan entered promiscuous mode [ 77.657085][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 77.675088][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 77.684531][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 77.696285][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 77.706830][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 77.717990][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 77.733401][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.753574][ T4186] device veth0_vlan entered promiscuous mode [ 77.777068][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 77.786416][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 77.797327][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 77.808773][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 77.819747][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 77.829962][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 77.844821][ T4191] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.855483][ T4191] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.865424][ T4191] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.875693][ T4191] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.910494][ T4195] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.922257][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 77.932059][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 77.941799][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 77.953577][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 77.976898][ T4196] device veth0_macvtap entered promiscuous mode [ 78.003865][ T4186] device veth1_vlan entered promiscuous mode [ 78.013422][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 78.024905][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 78.035701][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 78.047583][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 78.057020][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 78.078729][ T4196] device veth1_macvtap entered promiscuous mode [ 78.117564][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 78.126493][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 78.141627][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 78.162274][ T4185] device veth0_macvtap entered promiscuous mode [ 78.186332][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.198427][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.210980][ T4196] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.226477][ T4195] device veth0_vlan entered promiscuous mode [ 78.247012][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 78.260629][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 78.273227][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 78.284142][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 78.293639][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 78.307927][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.321294][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.333277][ T4196] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.345932][ T4196] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.355710][ T4196] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.366035][ T4196] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.375970][ T4196] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.392234][ T4185] device veth1_macvtap entered promiscuous mode [ 78.414607][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 78.423614][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 78.433919][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 78.443718][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 78.453893][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 78.464254][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 78.476856][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 78.490309][ T4186] device veth0_macvtap entered promiscuous mode [ 78.504527][ T4186] device veth1_macvtap entered promiscuous mode [ 78.524805][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.537061][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.549838][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.562762][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.575993][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.597708][ T4195] device veth1_vlan entered promiscuous mode [ 78.614306][ T4277] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 78.623639][ T4277] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 78.634355][ T4277] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 78.645551][ T4277] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 78.656016][ T4277] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 78.669103][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.685078][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.697827][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.712867][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.724690][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.745077][ T4185] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.755630][ T4185] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.764762][ T4185] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.774688][ T4185] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.789375][ T4277] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 78.799828][ T4277] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 78.830777][ T4277] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.842713][ T4277] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.879350][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 78.893763][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 78.926892][ T4277] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.949349][ T4277] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.963617][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 78.992407][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.006544][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.018367][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.036835][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.048335][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.059620][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.071464][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.084032][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.095466][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.111486][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.122514][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.132793][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.144889][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.159713][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.173217][ T4195] device veth0_macvtap entered promiscuous mode [ 79.194880][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 79.218394][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 79.230310][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 79.242419][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 79.252698][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 79.262448][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 79.273582][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 79.293973][ T4195] device veth1_macvtap entered promiscuous mode [ 79.329414][ T4186] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.343182][ T4186] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.354496][ T4186] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.365518][ T4186] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.413920][ T4277] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.429470][ T7] Bluetooth: hci4: command 0x0419 tx timeout [ 79.444647][ T21] Bluetooth: hci0: command 0x0419 tx timeout [ 79.456204][ T21] Bluetooth: hci1: command 0x0419 tx timeout [ 79.485067][ T4277] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.494029][ T21] Bluetooth: hci3: command 0x0419 tx timeout [ 79.503509][ T21] Bluetooth: hci2: command 0x0419 tx timeout [ 79.530778][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 79.540095][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 79.557307][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.570523][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.583857][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.604914][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.616763][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.634319][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.646550][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.659042][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.673134][ T4195] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.705868][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 79.719893][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 79.733796][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.751949][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.763219][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.775006][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.786591][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.799517][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.811967][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.823743][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.836825][ T4195] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.865461][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 79.875223][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 79.892732][ T469] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.903429][ T4195] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.916442][ T469] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.924802][ T4195] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.934876][ T4195] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.946167][ T4195] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.965947][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 80.032961][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.050377][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.056537][ T469] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.070709][ T469] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.124836][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 80.140496][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 80.164992][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.213608][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.250453][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 80.290583][ T1239] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.320377][ T1239] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.335402][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.356439][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.431472][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.503305][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 80.543280][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.561842][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 80.588669][ T4314] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4'. [ 81.534343][ T4298] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 81.766824][ T4321] syz.4.9 uses obsolete (PF_INET,SOCK_PACKET) [ 81.981366][ T4331] netlink: 'syz.2.3': attribute type 10 has an invalid length. [ 82.114630][ T4331] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.140065][ T4331] team0: Port device bond0 added [ 82.246326][ T4331] syz.2.3 (4331) used greatest stack depth: 20224 bytes left [ 82.414985][ T4343] netlink: set zone limit has 8 unknown bytes [ 83.237136][ T4351] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 84.908895][ T4370] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 85.045416][ T4371] Process accounting resumed [ 87.010134][ T1107] cfg80211: failed to load regulatory.db [ 87.547377][ T1107] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 87.817482][ T1107] usb 2-1: Using ep0 maxpacket: 16 [ 88.457961][ T1107] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 88.493755][ T1107] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 88.513073][ T1107] usb 2-1: Product: syz [ 88.523434][ T1107] usb 2-1: Manufacturer: syz [ 88.537595][ T1107] usb 2-1: SerialNumber: syz [ 88.570313][ T1107] usb 2-1: config 0 descriptor?? [ 88.930618][ T4385] vivid-001: disconnect [ 88.935611][ T4392] netdevsim netdevsim0: Direct firmware load for ./file0 failed with error -2 [ 88.959871][ T4392] netdevsim netdevsim0: Falling back to sysfs fallback for: ./file0 [ 89.181809][ T4409] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 89.229622][ T4409] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 89.346869][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #140!!! [ 90.159773][ T4408] fuse: Unknown parameter '' [ 90.195762][ T7] usb 2-1: USB disconnect, device number 2 [ 90.206018][ T4385] vivid-001: reconnect [ 90.846047][ T4423] netlink: 32 bytes leftover after parsing attributes in process `syz.0.37'. [ 91.397295][ T4443] siw: device registration error -23 [ 91.804105][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #140!!! [ 91.814950][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #40!!! [ 92.008872][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #140!!! [ 92.111294][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #140!!! [ 92.217589][ T26] audit: type=1326 audit(1757201339.384:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4446 comm="syz.4.34" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05fa6dabe9 code=0x7ffc0000 [ 92.267335][ T26] audit: type=1326 audit(1757201339.394:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4446 comm="syz.4.34" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05fa6dabe9 code=0x7ffc0000 [ 92.298952][ T26] audit: type=1326 audit(1757201339.434:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4446 comm="syz.4.34" exe="/root/syz-executor" sig=0 arch=c000003e syscall=276 compat=0 ip=0x7f05fa6dabe9 code=0x7ffc0000 [ 92.395823][ T26] audit: type=1326 audit(1757201339.434:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4446 comm="syz.4.34" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05fa6dabe9 code=0x7ffc0000 [ 92.473064][ T26] audit: type=1326 audit(1757201339.434:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4446 comm="syz.4.34" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05fa6dabe9 code=0x7ffc0000 [ 92.559702][ T4451] Trying to write to read-only block-device nullb0 [ 92.598442][ T4451] Trying to write to read-only block-device nullb0 [ 92.607997][ T4455] process 'syz.4.47' launched './file0' with NULL argv: empty string added [ 94.654869][ T4480] netlink: 104 bytes leftover after parsing attributes in process `syz.2.53'. [ 94.888896][ T4482] netlink: 12 bytes leftover after parsing attributes in process `syz.1.54'. [ 94.967592][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 94.977517][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 94.987313][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #108!!! [ 94.997215][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 95.007221][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 95.177665][ T4495] siw: device registration error -23 [ 101.897091][ T4537] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 101.904498][ T4537] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 102.086946][ T4537] vhci_hcd vhci_hcd.0: Device attached [ 102.095424][ T4537] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 102.138266][ T4537] vhci_hcd vhci_hcd.0: pdev(1) rhport(2) sockfd(8) [ 102.144951][ T4537] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 103.095501][ T4308] vhci_hcd: vhci_device speed not set [ 103.177612][ T4308] usb 35-1: new full-speed USB device number 2 using vhci_hcd [ 103.244532][ T4556] vhci_hcd vhci_hcd.0: pdev(1) rhport(4) sockfd(14) [ 103.251373][ T4556] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 103.270043][ T4537] vhci_hcd vhci_hcd.0: Device attached [ 103.357589][ T4556] vhci_hcd vhci_hcd.0: Device attached [ 103.367259][ T4550] vhci_hcd vhci_hcd.0: pdev(1) rhport(3) sockfd(11) [ 103.374806][ T4550] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 103.672646][ T4550] vhci_hcd vhci_hcd.0: Device attached [ 105.238792][ T4558] vhci_hcd: connection closed [ 105.241780][ T4444] vhci_hcd: stop threads [ 105.252157][ T4557] vhci_hcd: connection closed [ 105.253434][ T4548] vhci_hcd: connection closed [ 105.253832][ T4541] vhci_hcd: connection reset by peer [ 105.334963][ T4444] vhci_hcd: release socket [ 105.374668][ T4444] vhci_hcd: disconnect device [ 105.419990][ T4444] vhci_hcd: stop threads [ 105.477380][ T4444] vhci_hcd: release socket [ 105.496221][ T4444] vhci_hcd: disconnect device [ 105.502040][ T4254] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 105.517330][ T4270] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 105.547728][ T4444] vhci_hcd: stop threads [ 105.552664][ T4444] vhci_hcd: release socket [ 105.577510][ T4444] vhci_hcd: disconnect device [ 105.583210][ T4444] vhci_hcd: stop threads [ 105.588031][ T4444] vhci_hcd: release socket [ 105.597964][ T4444] vhci_hcd: disconnect device [ 105.927545][ T4270] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.955894][ T4593] netlink: 188 bytes leftover after parsing attributes in process `syz.2.82'. [ 105.969238][ T4270] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 106.038320][ T4254] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 106.076806][ T4254] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 106.101651][ T4254] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.163502][ T4254] usb 5-1: config 0 descriptor?? [ 106.224165][ T4270] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 106.233931][ T4270] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.244286][ T4270] usb 4-1: Product: syz [ 106.249006][ T4270] usb 4-1: Manufacturer: syz [ 106.253773][ T4270] usb 4-1: SerialNumber: syz [ 106.320194][ T4270] cdc_ncm 4-1:1.0: skipping garbage [ 106.333120][ T4270] cdc_ncm 4-1:1.0: NCM or ECM functional descriptors missing [ 106.341968][ T4270] cdc_ncm 4-1:1.0: bind() failure [ 106.361386][ T4270] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 106.370029][ T4270] cdc_ncm 4-1:1.1: bind() failure [ 106.537548][ T4254] usbhid 5-1:0.0: can't add hid device: -71 [ 106.544463][ T4254] usbhid: probe of 5-1:0.0 failed with error -71 [ 106.806685][ T4254] usb 5-1: USB disconnect, device number 2 [ 108.032486][ T4254] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 108.347555][ T4254] usb 5-1: Using ep0 maxpacket: 32 [ 108.907928][ T4308] vhci_hcd: vhci_device speed not set [ 108.987674][ T4254] usb 5-1: device descriptor read/all, error -71 [ 110.010199][ T4654] netlink: set zone limit has 8 unknown bytes [ 110.855085][ T4254] usb 4-1: USB disconnect, device number 2 [ 111.788116][ T4667] dlm: plock device version mismatch: kernel (1.2.0), user (2387897437.763186031.1847236481) [ 113.310090][ T4664] sched: RT throttling activated [ 114.510525][ T4681] Zero length message leads to an empty skb [ 114.656409][ T4682] autofs4:pid:4682:autofs_fill_super: called with bogus options [ 115.539259][ T4203] Bluetooth: hci0: Unknown advertising packet type: 0xffff [ 115.539332][ T4203] Bluetooth: hci0: Unknown advertising packet type: 0xc000 [ 115.548725][ T4203] Bluetooth: hci0: Unknown advertising packet type: 0x100 [ 115.556874][ T4203] ================================================================== [ 115.572789][ T4203] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x1282/0x3b80 [ 115.580970][ T4203] Read of size 2 at addr ffff888075808400 by task kworker/u5:8/4203 [ 115.589387][ T4203] [ 115.591810][ T4203] CPU: 1 PID: 4203 Comm: kworker/u5:8 Not tainted syzkaller #0 [ 115.599447][ T4203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 115.610030][ T4203] Workqueue: hci0 hci_rx_work [ 115.614756][ T4203] Call Trace: [ 115.618037][ T4203] [ 115.620973][ T4203] dump_stack_lvl+0x168/0x230 [ 115.625670][ T4203] ? show_regs_print_info+0x20/0x20 [ 115.631026][ T4203] ? load_image+0x3b0/0x3b0 [ 115.635540][ T4203] ? _raw_spin_lock_irqsave+0xb0/0xf0 [ 115.640926][ T4203] print_address_description+0x60/0x2d0 [ 115.646908][ T4203] ? hci_le_meta_evt+0x1282/0x3b80 [ 115.652047][ T4203] kasan_report+0xdf/0x130 [ 115.656586][ T4203] ? hci_le_meta_evt+0x1282/0x3b80 [ 115.661713][ T4203] hci_le_meta_evt+0x1282/0x3b80 [ 115.666891][ T4203] ? hci_event_packet+0x2c0/0x12f0 [ 115.672054][ T4203] ? hci_remote_host_features_evt+0x280/0x280 [ 115.678230][ T4203] ? __mutex_unlock_slowpath+0x19e/0x6a0 [ 115.683959][ T4203] ? mark_lock+0x94/0x320 [ 115.688302][ T4203] ? mutex_unlock+0x10/0x10 [ 115.692893][ T4203] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 115.698880][ T4203] ? lock_chain_count+0x20/0x20 [ 115.703823][ T4203] ? __rwlock_init+0x140/0x140 [ 115.708594][ T4203] hci_event_packet+0xe05/0x12f0 [ 115.713536][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 115.718921][ T4203] ? rcu_lock_release+0x20/0x20 [ 115.724292][ T4203] ? hci_send_to_monitor+0x9c/0x4a0 [ 115.729842][ T4203] hci_rx_work+0x255/0xa10 [ 115.734398][ T4203] process_one_work+0x863/0x1000 [ 115.739573][ T4203] ? worker_detach_from_pool+0x240/0x240 [ 115.746653][ T4203] ? lockdep_hardirqs_off+0x70/0x100 [ 115.753163][ T4203] ? _raw_spin_lock_irq+0xab/0xe0 [ 115.758916][ T4203] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 115.765258][ T4203] ? wq_worker_running+0x97/0x170 [ 115.770309][ T4203] worker_thread+0xaa8/0x12a0 [ 115.776126][ T4203] ? _raw_spin_unlock_irqrestore+0x82/0x100 [ 115.782042][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 115.787493][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 115.792838][ T4203] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 115.798770][ T4203] kthread+0x436/0x520 [ 115.803077][ T4203] ? rcu_lock_release+0x20/0x20 [ 115.808295][ T4203] ? kthread_blkcg+0xd0/0xd0 [ 115.813069][ T4203] ret_from_fork+0x1f/0x30 [ 115.817672][ T4203] [ 115.821054][ T4203] [ 115.823680][ T4203] Allocated by task 4691: [ 115.828472][ T4203] __kasan_kmalloc+0xb5/0xf0 [ 115.833226][ T4203] __alloc_skb+0x22c/0x750 [ 115.838156][ T4203] vhci_write+0xbc/0x450 [ 115.842690][ T4203] vfs_write+0x712/0xd00 [ 115.847318][ T4203] ksys_write+0x14d/0x250 [ 115.852730][ T4203] do_syscall_64+0x4c/0xa0 [ 115.858000][ T4203] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 115.865078][ T4203] [ 115.867418][ T4203] The buggy address belongs to the object at ffff888075808000 [ 115.867418][ T4203] which belongs to the cache kmalloc-1k of size 1024 [ 115.882601][ T4203] The buggy address is located 0 bytes to the right of [ 115.882601][ T4203] 1024-byte region [ffff888075808000, ffff888075808400) [ 115.898459][ T4203] The buggy address belongs to the page: [ 115.905953][ T4203] page:ffffea0001d60200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x75808 [ 115.917145][ T4203] head:ffffea0001d60200 order:3 compound_mapcount:0 compound_pincount:0 [ 115.927310][ T4203] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 115.936033][ T4203] raw: 00fff00000010200 0000000000000000 0000000100000001 ffff888016841dc0 [ 115.945182][ T4203] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 115.954486][ T4203] page dumped because: kasan: bad access detected [ 115.961384][ T4203] page_owner tracks the page as allocated [ 115.967753][ T4203] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4191, ts 74864938586, free_ts 74803932181 [ 115.988050][ T4203] get_page_from_freelist+0x1b77/0x1c60 [ 115.995929][ T4203] __alloc_pages+0x1e1/0x470 [ 116.002225][ T4203] new_slab+0xc0/0x4b0 [ 116.008308][ T4203] ___slab_alloc+0x81e/0xdf0 [ 116.013358][ T4203] __kmalloc_node_track_caller+0x1fc/0x3a0 [ 116.019711][ T4203] __alloc_skb+0x22c/0x750 [ 116.024356][ T4203] inet6_rt_notify+0xdd/0x290 [ 116.029338][ T4203] fib6_add+0x1d3b/0x3d30 [ 116.033669][ T4203] ip6_route_add+0x86/0x130 [ 116.038375][ T4203] addrconf_permanent_addr+0x652/0x980 [ 116.044987][ T4203] addrconf_notify+0x827/0xf00 [ 116.050492][ T4203] raw_notifier_call_chain+0xcb/0x160 [ 116.058197][ T4203] __dev_notify_flags+0x178/0x2d0 [ 116.066423][ T4203] dev_change_flags+0xe3/0x1a0 [ 116.071650][ T4203] do_setlink+0xc01/0x3980 [ 116.076571][ T4203] rtnl_newlink+0x1419/0x17d0 [ 116.081986][ T4203] page last free stack trace: [ 116.087447][ T4203] free_unref_page_prepare+0x637/0x6c0 [ 116.093860][ T4203] free_unref_page+0x94/0x280 [ 116.099051][ T4203] __unfreeze_partials+0x1a5/0x200 [ 116.104926][ T4203] put_cpu_partial+0x12d/0x190 [ 116.110066][ T4203] qlist_free_all+0x35/0x90 [ 116.114706][ T4203] kasan_quarantine_reduce+0x150/0x160 [ 116.120789][ T4203] __kasan_slab_alloc+0x2f/0xd0 [ 116.126060][ T4203] slab_post_alloc_hook+0x4c/0x380 [ 116.131362][ T4203] kmem_cache_alloc_trace+0x103/0x2a0 [ 116.137418][ T4203] netdevice_event+0x324/0x900 [ 116.142302][ T4203] raw_notifier_call_chain+0xcb/0x160 [ 116.148217][ T4203] __dev_notify_flags+0x178/0x2d0 [ 116.153505][ T4203] dev_change_flags+0xe3/0x1a0 [ 116.158646][ T4203] do_setlink+0xc01/0x3980 [ 116.163410][ T4203] rtnl_newlink+0x1419/0x17d0 [ 116.168200][ T4203] rtnetlink_rcv_msg+0x9b9/0xe60 [ 116.173375][ T4203] [ 116.175831][ T4203] Memory state around the buggy address: [ 116.181475][ T4203] ffff888075808300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 116.189781][ T4203] ffff888075808380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 116.198585][ T4203] >ffff888075808400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 116.206868][ T4203] ^ [ 116.211170][ T4203] ffff888075808480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 116.219731][ T4203] ffff888075808500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 116.230503][ T4203] ================================================================== [ 116.240615][ T4203] Disabling lock debugging due to kernel taint [ 116.253476][ T4203] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 116.261382][ T4203] CPU: 1 PID: 4203 Comm: kworker/u5:8 Tainted: G B syzkaller #0 [ 116.271383][ T4203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 116.282927][ T4203] Workqueue: hci0 hci_rx_work [ 116.289881][ T4203] Call Trace: [ 116.293677][ T4203] [ 116.297039][ T4203] dump_stack_lvl+0x168/0x230 [ 116.302312][ T4203] ? show_regs_print_info+0x20/0x20 [ 116.307695][ T4203] ? load_image+0x3b0/0x3b0 [ 116.312956][ T4203] panic+0x2c9/0x7f0 [ 116.316992][ T4203] ? bpf_jit_dump+0xd0/0xd0 [ 116.321893][ T4203] ? _raw_spin_unlock_irqrestore+0xf6/0x100 [ 116.328036][ T4203] ? _raw_spin_unlock+0x40/0x40 [ 116.332917][ T4203] ? hci_le_meta_evt+0x1282/0x3b80 [ 116.338153][ T4203] check_panic_on_warn+0x80/0xa0 [ 116.343667][ T4203] ? hci_le_meta_evt+0x1282/0x3b80 [ 116.349081][ T4203] end_report+0x6d/0xf0 [ 116.353968][ T4203] kasan_report+0x102/0x130 [ 116.359224][ T4203] ? hci_le_meta_evt+0x1282/0x3b80 [ 116.364895][ T4203] hci_le_meta_evt+0x1282/0x3b80 [ 116.371169][ T4203] ? hci_event_packet+0x2c0/0x12f0 [ 116.376754][ T4203] ? hci_remote_host_features_evt+0x280/0x280 [ 116.383494][ T4203] ? __mutex_unlock_slowpath+0x19e/0x6a0 [ 116.389834][ T4203] ? mark_lock+0x94/0x320 [ 116.394879][ T4203] ? mutex_unlock+0x10/0x10 [ 116.399678][ T4203] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 116.406804][ T4203] ? lock_chain_count+0x20/0x20 [ 116.412286][ T4203] ? __rwlock_init+0x140/0x140 [ 116.417243][ T4203] hci_event_packet+0xe05/0x12f0 [ 116.422804][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 116.428348][ T4203] ? rcu_lock_release+0x20/0x20 [ 116.433403][ T4203] ? hci_send_to_monitor+0x9c/0x4a0 [ 116.439660][ T4203] hci_rx_work+0x255/0xa10 [ 116.445639][ T4203] process_one_work+0x863/0x1000 [ 116.450932][ T4203] ? worker_detach_from_pool+0x240/0x240 [ 116.456747][ T4203] ? lockdep_hardirqs_off+0x70/0x100 [ 116.462438][ T4203] ? _raw_spin_lock_irq+0xab/0xe0 [ 116.469187][ T4203] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 116.475472][ T4203] ? wq_worker_running+0x97/0x170 [ 116.481167][ T4203] worker_thread+0xaa8/0x12a0 [ 116.486711][ T4203] ? _raw_spin_unlock_irqrestore+0x82/0x100 [ 116.493254][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 116.498579][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 116.504732][ T4203] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 116.510658][ T4203] kthread+0x436/0x520 [ 116.515296][ T4203] ? rcu_lock_release+0x20/0x20 [ 116.521270][ T4203] ? kthread_blkcg+0xd0/0xd0 [ 116.526740][ T4203] ret_from_fork+0x1f/0x30 [ 116.531383][ T4203] [ 116.534779][ T4203] Kernel Offset: disabled [ 116.539218][ T4203] Rebooting in 86400 seconds..