[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.223' (ECDSA) to the list of known hosts. 2020/08/02 12:36:52 fuzzer started 2020/08/02 12:36:52 dialing manager at 10.128.0.26:42619 2020/08/02 12:36:53 syscalls: 3271 2020/08/02 12:36:53 code coverage: enabled 2020/08/02 12:36:53 comparison tracing: enabled 2020/08/02 12:36:53 extra coverage: enabled 2020/08/02 12:36:53 setuid sandbox: enabled 2020/08/02 12:36:53 namespace sandbox: enabled 2020/08/02 12:36:53 Android sandbox: /sys/fs/selinux/policy does not exist 2020/08/02 12:36:53 fault injection: enabled 2020/08/02 12:36:53 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/08/02 12:36:53 net packet injection: enabled 2020/08/02 12:36:53 net device setup: enabled 2020/08/02 12:36:53 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2020/08/02 12:36:53 devlink PCI setup: PCI device 0000:00:10.0 is not available 2020/08/02 12:36:53 USB emulation: enabled 2020/08/02 12:36:53 hci packet injection: enabled 12:39:14 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e26, 0x0, @ipv4={[], [], @remote}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_tables_targets\x00') sendfile(r0, r1, 0x0, 0x7ffff000) syzkaller login: [ 199.588613][ T6839] IPVS: ftp: loaded support on port[0] = 21 12:39:15 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "91301a71caac926164703ce0379c96d4494cf582b6b44fe644c53395f13e83a3"}}) [ 199.739941][ T6839] chnl_net:caif_netlink_parms(): no params data found [ 199.833653][ T6839] bridge0: port 1(bridge_slave_0) entered blocking state [ 199.842617][ T6839] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.851515][ T6839] device bridge_slave_0 entered promiscuous mode [ 199.862775][ T6839] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.870382][ T6839] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.880016][ T6839] device bridge_slave_1 entered promiscuous mode [ 199.909168][ T6839] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 199.922262][ T6839] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 199.983078][ T6839] team0: Port device team_slave_0 added [ 199.993558][ T6839] team0: Port device team_slave_1 added [ 199.998376][ T6977] IPVS: ftp: loaded support on port[0] = 21 [ 200.026524][ T6839] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 200.033523][ T6839] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 200.061638][ T6839] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active 12:39:15 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000000)={0x4, 0x0, "462fc0"}) [ 200.083304][ T6839] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 200.091802][ T6839] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 200.119995][ T6839] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 200.231326][ T6839] device hsr_slave_0 entered promiscuous mode [ 200.276023][ T6839] device hsr_slave_1 entered promiscuous mode 12:39:15 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000300)={0xc67, 0x0, 0x0, 0x0, 0x0, "90922c4405def660ec88ee995628254322c117"}) [ 200.392707][ T7025] IPVS: ftp: loaded support on port[0] = 21 [ 200.601077][ T6977] chnl_net:caif_netlink_parms(): no params data found [ 200.669125][ T7132] IPVS: ftp: loaded support on port[0] = 21 [ 200.910147][ T6977] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.926747][ T6977] bridge0: port 1(bridge_slave_0) entered disabled state [ 200.937123][ T6977] device bridge_slave_0 entered promiscuous mode 12:39:16 executing program 4: r0 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x0, 0x2) preadv2(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 200.970903][ T6839] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 201.031426][ T6977] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.056828][ T6977] bridge0: port 2(bridge_slave_1) entered disabled state [ 201.066080][ T6977] device bridge_slave_1 entered promiscuous mode [ 201.089533][ T6839] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 201.153213][ T6839] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 201.188346][ T7025] chnl_net:caif_netlink_parms(): no params data found [ 201.220861][ T6839] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 201.240420][ T7302] IPVS: ftp: loaded support on port[0] = 21 12:39:16 executing program 5: r0 = socket(0x10, 0x2, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00') sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000400)={0x24, r1, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_IFINDEX={0x8}]}, 0x24}}, 0x0) [ 201.331974][ T6977] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 201.376411][ T6977] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 201.519751][ T6977] team0: Port device team_slave_0 added [ 201.538453][ T6977] team0: Port device team_slave_1 added [ 201.575220][ T7132] chnl_net:caif_netlink_parms(): no params data found [ 201.605857][ T7372] IPVS: ftp: loaded support on port[0] = 21 [ 201.613020][ T6977] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 201.620857][ T6977] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 201.647400][ T6977] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 201.663906][ T6977] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 201.671054][ T6977] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 201.697715][ T6977] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 201.719630][ T7025] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.726855][ T7025] bridge0: port 1(bridge_slave_0) entered disabled state [ 201.735177][ T7025] device bridge_slave_0 entered promiscuous mode [ 201.772592][ T7025] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.779941][ T7025] bridge0: port 2(bridge_slave_1) entered disabled state [ 201.792598][ T7025] device bridge_slave_1 entered promiscuous mode [ 201.888764][ T6977] device hsr_slave_0 entered promiscuous mode [ 201.955018][ T6977] device hsr_slave_1 entered promiscuous mode [ 202.024679][ T6977] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 202.032471][ T6977] Cannot create hsr debugfs directory [ 202.041339][ T7025] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 202.080179][ T7025] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 202.177211][ T7025] team0: Port device team_slave_0 added [ 202.186408][ T7025] team0: Port device team_slave_1 added [ 202.211830][ T7132] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.219557][ T7132] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.229053][ T7132] device bridge_slave_0 entered promiscuous mode [ 202.240834][ T7132] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.249063][ T7132] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.257347][ T7132] device bridge_slave_1 entered promiscuous mode [ 202.291574][ T7025] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 202.299008][ T7025] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 202.325597][ T7025] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 202.341055][ T7025] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 202.348177][ T7025] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 202.374818][ T7025] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 202.436683][ T7302] chnl_net:caif_netlink_parms(): no params data found [ 202.510978][ T7132] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 202.524314][ T7132] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 202.618432][ T7025] device hsr_slave_0 entered promiscuous mode [ 202.675389][ T7025] device hsr_slave_1 entered promiscuous mode [ 202.714634][ T7025] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 202.722255][ T7025] Cannot create hsr debugfs directory [ 202.768683][ T7132] team0: Port device team_slave_0 added [ 202.797589][ T7302] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.805439][ T7302] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.813753][ T7302] device bridge_slave_0 entered promiscuous mode [ 202.823988][ T7132] team0: Port device team_slave_1 added [ 202.849857][ T7302] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.858868][ T7302] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.868065][ T7302] device bridge_slave_1 entered promiscuous mode [ 202.992480][ T7132] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 203.003404][ T7132] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 203.033702][ T7132] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 203.050716][ T7302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 203.062963][ T7302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 203.076633][ T7372] chnl_net:caif_netlink_parms(): no params data found [ 203.098751][ T7132] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 203.106279][ T7132] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 203.133708][ T7132] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 203.237873][ T7132] device hsr_slave_0 entered promiscuous mode [ 203.314895][ T7132] device hsr_slave_1 entered promiscuous mode [ 203.384618][ T7132] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 203.392208][ T7132] Cannot create hsr debugfs directory [ 203.407769][ T6839] 8021q: adding VLAN 0 to HW filter on device bond0 [ 203.430918][ T7302] team0: Port device team_slave_0 added [ 203.453057][ T6977] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 203.514059][ T7302] team0: Port device team_slave_1 added [ 203.540959][ T6977] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 203.600023][ T6977] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 203.663846][ T6977] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 203.721067][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 203.730202][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 203.769628][ T6839] 8021q: adding VLAN 0 to HW filter on device team0 [ 203.796740][ T7302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 203.803739][ T7302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 203.830648][ T7302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 203.844224][ T7302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 203.852275][ T7302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 203.878915][ T7302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 203.923820][ T7372] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.931268][ T7372] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.941134][ T7372] device bridge_slave_0 entered promiscuous mode [ 203.949437][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 203.960703][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 203.969723][ T2525] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.977069][ T2525] bridge0: port 1(bridge_slave_0) entered forwarding state [ 204.037161][ T7302] device hsr_slave_0 entered promiscuous mode [ 204.066170][ T7302] device hsr_slave_1 entered promiscuous mode [ 204.114534][ T7302] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 204.122105][ T7302] Cannot create hsr debugfs directory [ 204.129520][ T7372] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.137931][ T7372] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.147229][ T7372] device bridge_slave_1 entered promiscuous mode [ 204.154467][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 204.162586][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 204.175314][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 204.183764][ T2525] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.190910][ T2525] bridge0: port 2(bridge_slave_1) entered forwarding state [ 204.268127][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 204.299224][ T7372] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 204.321875][ T7025] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 204.387609][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 204.396382][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 204.406761][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 204.427067][ T7372] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 204.442937][ T7025] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 204.500130][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 204.508402][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 204.521169][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 204.554248][ T7025] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 204.615211][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 204.623826][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 204.646180][ T6839] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 204.657854][ T6839] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 204.670748][ T7372] team0: Port device team_slave_0 added [ 204.679608][ T7372] team0: Port device team_slave_1 added [ 204.690866][ T7025] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 204.754174][ T6977] 8021q: adding VLAN 0 to HW filter on device bond0 [ 204.763331][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 204.772488][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 204.833432][ T6977] 8021q: adding VLAN 0 to HW filter on device team0 [ 204.868279][ T7372] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 204.878758][ T7372] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 204.910570][ T7372] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 204.923379][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 204.936558][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 204.971909][ T7372] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 204.979918][ T7372] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 205.008631][ T7372] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 205.042110][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 205.052146][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 205.065724][ T2521] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.072917][ T2521] bridge0: port 1(bridge_slave_0) entered forwarding state [ 205.085176][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 205.092730][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 205.123050][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 205.179032][ T7372] device hsr_slave_0 entered promiscuous mode [ 205.247054][ T7372] device hsr_slave_1 entered promiscuous mode [ 205.304636][ T7372] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 205.313343][ T7372] Cannot create hsr debugfs directory [ 205.363902][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 205.373003][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 205.382164][ T2525] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.389341][ T2525] bridge0: port 2(bridge_slave_1) entered forwarding state [ 205.409936][ T6839] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 205.453103][ T7132] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 205.491453][ T7132] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 205.575675][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 205.586417][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 205.615513][ T7132] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 205.665099][ T7132] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 205.720835][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 205.729988][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 205.740377][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 205.749700][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 205.760748][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 205.808022][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 205.821357][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 205.831334][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 205.845347][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 205.853620][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 205.866031][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 205.878293][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 205.887455][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 205.901368][ T6839] device veth0_vlan entered promiscuous mode [ 205.933658][ T6977] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 205.945836][ T6977] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 205.961287][ T7302] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 206.017962][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 206.028676][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 206.052969][ T7302] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 206.118884][ T6839] device veth1_vlan entered promiscuous mode [ 206.128964][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 206.152664][ T7302] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 206.241755][ T7302] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 206.305502][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 206.313114][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 206.338072][ T7025] 8021q: adding VLAN 0 to HW filter on device bond0 [ 206.381424][ T6977] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 206.450511][ T6839] device veth0_macvtap entered promiscuous mode [ 206.467559][ T7025] 8021q: adding VLAN 0 to HW filter on device team0 [ 206.484733][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 206.493606][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 206.506139][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 206.513979][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 206.548742][ T6839] device veth1_macvtap entered promiscuous mode [ 206.566781][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 206.578352][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 206.587730][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 206.599734][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 206.608821][ T2516] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.615963][ T2516] bridge0: port 1(bridge_slave_0) entered forwarding state [ 206.629406][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 206.699039][ T6839] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 206.707598][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 206.718123][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 206.728254][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 206.737410][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 206.746898][ T2525] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.753967][ T2525] bridge0: port 2(bridge_slave_1) entered forwarding state [ 206.762561][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 206.771953][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 206.780943][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 206.795820][ T7372] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 206.867575][ T7372] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 206.907837][ T7372] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 206.987198][ T7132] 8021q: adding VLAN 0 to HW filter on device bond0 [ 206.997412][ T6839] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 207.010191][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 207.021284][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 207.031097][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 207.040280][ T7372] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 207.094860][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 207.103532][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 207.121690][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 207.130180][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 207.165225][ T6977] device veth0_vlan entered promiscuous mode [ 207.183192][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 207.195319][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 207.213265][ T7132] 8021q: adding VLAN 0 to HW filter on device team0 [ 207.231104][ T7302] 8021q: adding VLAN 0 to HW filter on device bond0 [ 207.241646][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 207.252395][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 207.260925][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 207.270272][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 207.279487][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 207.293402][ T6977] device veth1_vlan entered promiscuous mode [ 207.379940][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 207.388812][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 207.398437][ T2525] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.405716][ T2525] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.414068][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 207.423300][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 207.441291][ T7025] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 207.453775][ T7025] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 207.507334][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 207.516404][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 207.526551][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 207.597172][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 207.606448][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 207.616088][ T7299] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.623187][ T7299] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.631639][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 207.641338][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 207.650081][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 207.658967][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 207.677015][ T7302] 8021q: adding VLAN 0 to HW filter on device team0 [ 207.720367][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 207.729571][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 207.742493][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 207.750472][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 207.759364][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 207.768314][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 207.777737][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 207.806545][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 207.816371][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 207.825643][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 207.835581][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 207.846219][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.853323][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.863974][ T7025] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 207.875901][ T6977] device veth0_macvtap entered promiscuous mode [ 207.895712][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 207.906899][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 207.915317][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 207.923887][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 207.934507][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 207.943087][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 207.957117][ T6977] device veth1_macvtap entered promiscuous mode [ 207.968078][ T7132] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 208.005040][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 208.013532][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 208.025541][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 208.034274][ T7299] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.041457][ T7299] bridge0: port 2(bridge_slave_1) entered forwarding state [ 208.050174][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 208.088623][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 208.100611][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 208.108337][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 208.122278][ T6977] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 208.143594][ T6977] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 208.156414][ T6977] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 208.172003][ T7132] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 208.192986][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 208.205496][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 208.214179][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 208.225829][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 208.237977][ T6977] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 208.249000][ T6977] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 208.261294][ T6977] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 208.278608][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 208.287064][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 208.300583][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 208.310562][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 208.320052][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 208.334862][ T7372] 8021q: adding VLAN 0 to HW filter on device bond0 [ 208.398622][ T7302] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 208.410424][ T7302] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 208.426347][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 208.435964][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 208.444945][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 208.453320][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 208.462792][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 208.472279][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 208.485329][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 208.502181][ T7372] 8021q: adding VLAN 0 to HW filter on device team0 [ 208.548929][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 208.557121][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 208.636393][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 208.646308][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 208.657108][ T2525] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.664221][ T2525] bridge0: port 1(bridge_slave_0) entered forwarding state [ 208.677117][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 208.685547][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 208.693347][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 208.706682][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 208.735437][ T2525] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.742550][ T2525] bridge0: port 2(bridge_slave_1) entered forwarding state [ 208.765086][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 208.797779][ T7302] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 208.845933][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 208.860664][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 12:39:24 executing program 0: r0 = shmget$private(0x0, 0x600000, 0x0, &(0x7f0000a00000/0x600000)=nil) munmap(&(0x7f0000c00000/0x400000)=nil, 0x400000) shmat(r0, &(0x7f0000e80000/0x2000)=nil, 0x0) shmctl$IPC_RMID(r0, 0x0) shmctl$IPC_RMID(r0, 0x0) [ 208.891866][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 208.929280][ T2521] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 208.977379][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 209.002925][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 209.021013][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready 12:39:24 executing program 0: [ 209.049301][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 209.085148][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 209.098001][ T7025] device veth0_vlan entered promiscuous mode 12:39:24 executing program 0: [ 209.156974][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 209.165934][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready 12:39:24 executing program 0: [ 209.201393][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 209.212523][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 209.235538][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 209.244116][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 12:39:24 executing program 0: [ 209.299723][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 209.313541][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 209.383995][ T7025] device veth1_vlan entered promiscuous mode 12:39:24 executing program 0: [ 209.419692][ T7372] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 209.466591][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready 12:39:24 executing program 0: [ 209.507458][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 209.519243][ T7132] device veth0_vlan entered promiscuous mode [ 209.582987][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 209.592883][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 209.609300][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 209.620936][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 209.631363][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 209.640030][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 209.661717][ T7132] device veth1_vlan entered promiscuous mode [ 209.683406][ T7372] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 209.722973][ T7025] device veth0_macvtap entered promiscuous mode [ 209.777864][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 209.787527][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 209.798342][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 209.827864][ T7025] device veth1_macvtap entered promiscuous mode [ 209.862217][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 209.879530][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 209.897215][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready 12:39:25 executing program 1: [ 209.925406][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 209.949124][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 209.998109][ T7302] device veth0_vlan entered promiscuous mode [ 210.022251][ T7132] device veth0_macvtap entered promiscuous mode [ 210.038800][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 210.052382][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 210.091236][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 210.114968][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 210.135031][ T7025] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 210.156394][ T7025] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 210.191747][ T7025] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 210.203960][ T7025] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 210.218918][ T7025] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 210.230920][ T7132] device veth1_macvtap entered promiscuous mode [ 210.257426][ T7302] device veth1_vlan entered promiscuous mode [ 210.275573][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 210.283868][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 210.295705][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 210.306345][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 210.315663][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 210.346355][ T7025] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 210.359963][ T7025] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 210.370565][ T7025] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 210.386497][ T7025] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 210.400326][ T7025] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 210.411303][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 210.422552][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 210.432245][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 210.442189][ T7299] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 210.459438][ T7132] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 210.470057][ T7132] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 210.481219][ T7132] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 210.491829][ T7132] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 210.501806][ T7132] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 210.512344][ T7132] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 210.525921][ T7132] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 210.558307][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 210.567422][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 210.579767][ T7132] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 210.591011][ T7132] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 210.601715][ T7132] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 210.613375][ T7132] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 210.626761][ T7132] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 210.637294][ T7132] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 210.648677][ T7132] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 210.668984][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 210.679354][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 210.690244][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 210.700818][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 210.710264][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 210.718465][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 210.745513][ T7372] device veth0_vlan entered promiscuous mode [ 210.775667][ T17] Bluetooth: hci0: command 0x0409 tx timeout [ 210.889508][ T7372] device veth1_vlan entered promiscuous mode [ 211.049309][ T7302] device veth0_macvtap entered promiscuous mode [ 211.072681][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 211.081743][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 211.090815][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 211.100108][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 211.109725][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 211.125335][ T7302] device veth1_macvtap entered promiscuous mode [ 211.152456][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 211.161353][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 211.171440][ T2516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 211.184811][ T7302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 211.195657][ T7302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.205703][ T7302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 211.216239][ T7302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.226842][ T7302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 211.237445][ T7302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.247487][ T7302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 211.258681][ T7302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.271610][ T7302] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 211.282692][ T7372] device veth0_macvtap entered promiscuous mode [ 211.298267][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 211.307338][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 211.316352][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 211.328235][ T7302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 211.340348][ T7302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.351332][ T7302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 211.352594][ T0] NOHZ: local_softirq_pending 08 [ 211.362652][ T7302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.377678][ T7302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 211.388182][ T7302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.398965][ T7302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 211.411333][ T7302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.424209][ T7302] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 211.431894][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 211.441950][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 211.455133][ T7372] device veth1_macvtap entered promiscuous mode [ 211.489748][ T7372] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 211.500966][ T7372] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.511488][ T7372] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 211.522960][ T7372] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.534358][ T7372] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 211.545722][ T7372] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.556104][ T7372] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 211.566608][ T7372] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.577849][ T7372] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 211.588420][ T7372] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.599758][ T7372] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 211.647605][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 211.657154][ T3855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 211.671630][ T7372] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 211.683446][ T7372] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.693981][ T7372] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 211.704897][ T7372] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.715056][ T7372] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 211.725692][ T7372] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.739456][ T7372] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 211.750032][ T7372] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.760306][ T7372] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 211.771165][ T7372] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 211.782400][ T7372] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 211.793037][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 211.802436][ T2525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 211.816687][ T17] Bluetooth: hci1: command 0x0409 tx timeout [ 211.977106][ T0] NOHZ: local_softirq_pending 08 12:39:27 executing program 2: 12:39:27 executing program 3: [ 212.866220][ T5] Bluetooth: hci0: command 0x041b tx timeout 12:39:28 executing program 4: 12:39:28 executing program 5: 12:39:28 executing program 0: 12:39:28 executing program 1: 12:39:28 executing program 2: 12:39:28 executing program 3: 12:39:28 executing program 4: 12:39:28 executing program 3: 12:39:28 executing program 0: 12:39:28 executing program 2: 12:39:28 executing program 4: 12:39:28 executing program 1: 12:39:28 executing program 5: 12:39:28 executing program 3: 12:39:28 executing program 2: 12:39:28 executing program 5: 12:39:28 executing program 0: 12:39:28 executing program 4: 12:39:28 executing program 1: 12:39:28 executing program 3: 12:39:29 executing program 2: 12:39:29 executing program 1: 12:39:29 executing program 4: 12:39:29 executing program 0: 12:39:29 executing program 3: 12:39:29 executing program 5: 12:39:29 executing program 1: 12:39:29 executing program 5: 12:39:29 executing program 3: 12:39:29 executing program 0: 12:39:29 executing program 2: 12:39:29 executing program 4: [ 213.895927][ T5] Bluetooth: hci1: command 0x041b tx timeout 12:39:29 executing program 1: 12:39:29 executing program 3: 12:39:29 executing program 0: 12:39:29 executing program 5: 12:39:29 executing program 4: 12:39:29 executing program 2: 12:39:29 executing program 5: 12:39:29 executing program 0: 12:39:29 executing program 4: 12:39:29 executing program 3: [ 214.134791][ T3855] Bluetooth: hci2: command 0x0409 tx timeout [ 214.148911][ T3855] Bluetooth: hci3: command 0x0409 tx timeout 12:39:29 executing program 1: 12:39:29 executing program 2: 12:39:29 executing program 5: 12:39:29 executing program 0: shmget(0x0, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) 12:39:29 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2, 0x0) splice(0xffffffffffffffff, 0x0, r3, 0x0, 0x20000038, 0x0) write$FUSE_DIRENTPLUS(r4, &(0x7f0000004dc0)=ANY=[@ANYBLOB="900200000000000001"], 0x290) dup3(r2, r4, 0x0) 12:39:29 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET_DEF(r0, 0x4b66, &(0x7f0000000400)={0xf3, 0x0, 0x0, 0x0, 0x0, 0x0}) 12:39:29 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x58, &(0x7f0000000440)="c4c691019919da070000000000000022addee07bee6333b5cacd893169b618322ff6602022511253508b5a4496728c2a46e1bc340e293a000000000000000808ffdb2dc4a741357baa16dacdcf7d8f6990c3f9c51808235f"}}], 0x1c) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000140)=""/12, 0xc}], 0x3, 0x0, 0x0, 0x0) tkill(r2, 0x40) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 12:39:29 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)={[{@nobarrier='nobarrier'}]}) 12:39:29 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$setperm(0x5, r2, 0x202002) keyctl$chown(0x4, r2, 0xee00, 0x0) keyctl$chown(0x4, r2, 0x0, 0x0) 12:39:29 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2, 0x0) splice(r3, 0x0, r2, 0x0, 0x20000038, 0x0) write$FUSE_DIRENTPLUS(r3, &(0x7f0000004dc0)=ANY=[@ANYBLOB="900200000000000001"], 0x290) 12:39:29 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f00000003c0)=@raw={'raw\x00', 0x2, 0x3, 0x328, 0x0, 0x198, 0x0, 0x198, 0x198, 0x290, 0x290, 0x290, 0x290, 0x290, 0x3, 0x0, {[{{@ip={@multicast1, @multicast2, 0x0, 0x0, 'veth1_to_hsr\x00', 'veth0_to_bond\x00'}, 0x0, 0x130, 0x198, 0x0, {}, [@common=@unspec=@string={{0xc0, 'string\x00'}, {0x0, 0x0, 'kmp\x00', "ffffff7fc8401b46ee142a8d52160cbc0b726fe53e8538bbdadc9ddd538e5910669144ed8f5c28b865bd7239f20dcbc7c9a63f5f5cf9b0840bace7a91c206ab34ea211db749a7ebd146b29002d52bd7c314acfa1e784729b6eab7dcde83893eebf5420c4618cbea4171ed61cfbde838a517cdb269c929a1ab99ffcfc1dc61f80", 0x27}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}, {{@ip={@local, @multicast2, 0x0, 0x0, 'veth0_to_hsr\x00', 'macvlan0\x00'}, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@SET={0x60, 'SET\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x388) [ 214.523268][ T8253] hfsplus: unable to find HFS+ superblock 12:39:29 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000010c0)=[{{&(0x7f00000000c0)={0x2, 0x4e1e, @initdev}, 0x10, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000007000000940700e0"], 0x18}}], 0x1, 0x0) 12:39:29 executing program 2: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyS3\x00', 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = memfd_create(&(0x7f0000000140), 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000080)={0x0, 0x0, 0x1ffffc, 0x0, 0x0, "5117ee1d0000000000000400"}) [ 214.606913][ T8253] hfsplus: unable to find HFS+ superblock [ 214.645455][ T8267] xt_CT: You must specify a L4 protocol and not use inversions on it 12:39:29 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x202100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) futex(&(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000100)={0x0, 0x1c9c380}, 0x0, 0x0) [ 214.659287][ T8268] xt_CT: You must specify a L4 protocol and not use inversions on it 12:39:30 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)={[{@nobarrier='nobarrier'}]}) 12:39:30 executing program 3: r0 = socket(0x10, 0x2, 0x0) write(r0, &(0x7f0000000280)="1c0000001a009b8a140000003b9b301f00"/28, 0x32) recvmmsg(r0, &(0x7f0000007080)=[{{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f00000005c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) 12:39:30 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5412, &(0x7f00000000c0)={0xfff, 0x0, 0x0, 0x0, 0x0, "f9ffffff006130050061070000fc00"}) 12:39:30 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 214.865141][ T8283] hfsplus: unable to find HFS+ superblock [ 214.941248][ T3855] Bluetooth: hci0: command 0x040f tx timeout [ 215.016264][ T3855] Bluetooth: hci4: command 0x0409 tx timeout [ 215.254669][ T2516] Bluetooth: hci5: command 0x0409 tx timeout [ 215.974536][ T3855] Bluetooth: hci1: command 0x040f tx timeout [ 216.214937][ T3855] Bluetooth: hci2: command 0x041b tx timeout [ 216.294580][ T3855] Bluetooth: hci3: command 0x041b tx timeout [ 217.014490][ T3855] Bluetooth: hci0: command 0x0419 tx timeout [ 217.095607][ T2525] Bluetooth: hci4: command 0x041b tx timeout [ 217.334659][ T2525] Bluetooth: hci5: command 0x041b tx timeout 12:39:32 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x10) 12:39:32 executing program 2: open(0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r1 = fanotify_init(0x0, 0x0) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000340)=ANY=[], 0x44) write(r0, &(0x7f0000000180)="9a", 0x1) 12:39:32 executing program 4: request_key(&(0x7f0000000140)='id_legacy\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000001c0)='@\x00', 0xfffffffffffffff9) 12:39:32 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)={[{@nobarrier='nobarrier'}]}) 12:39:32 executing program 1: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@newqdisc={0x70, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa, 0x1, 'netem\x00'}, {0x40, 0x2, {{}, [@TCA_NETEM_CORR={0x10}, @TCA_NETEM_RATE={0x14, 0x6, {0x0, 0x0, 0x1000}}]}}}]}, 0x70}}, 0x0) 12:39:32 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) [ 217.490218][ T8310] hfsplus: unable to find HFS+ superblock 12:39:32 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x3, 0x6) sendmmsg(0xffffffffffffffff, &(0x7f0000008ac0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) ioctl$RNDCLEARPOOL(0xffffffffffffffff, 0x5206, &(0x7f00000002c0)) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000003440)='./file1\x00', 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000400)) setxattr$system_posix_acl(0x0, &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="0204634e9bfe090000000100000000000000040000000000000010ec6a7dedcd9b1d02e446d9be001600000000004e1c8ce49fb1150810bae5c53ee9094eefb2cd71f870b10efd3e358c35699d3c8df8dc1cfab597f0bf7decc13a901ed46dfc5f0cf17f1bf714139b641051457e6260f8e13ef650f5cc8585e26ae798b56d43b188f7b82280840641ec4b034a9f9db98fda950025c5b1d998"], 0x24, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) 12:39:32 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)={[{@nobarrier='nobarrier'}]}) 12:39:32 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) 12:39:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) setfsuid(0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) syz_genetlink_get_family_id$devlink(0x0) sendmsg$DEVLINK_CMD_PORT_SET(r0, 0x0, 0x40004) getdents64(0xffffffffffffffff, &(0x7f0000000100)=""/241, 0xffd1) 12:39:33 executing program 1: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) pipe(0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1}, 0x0) creat(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='rpc_pipefs\x00', 0x0, 0x0) [ 217.824138][ C1] hrtimer: interrupt took 39434 ns [ 217.828375][ T8331] hfsplus: unable to find HFS+ superblock 12:39:33 executing program 5: syz_mount_image$hfsplus(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)={[{@nobarrier='nobarrier'}]}) [ 217.962890][ T8336] overlayfs: conflicting lowerdir path [ 218.065234][ T3855] Bluetooth: hci1: command 0x0419 tx timeout 12:39:33 executing program 3: open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000140)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 12:39:33 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r2, 0x0, 0x0) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700) 12:39:33 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) setfsuid(0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = open(0x0, 0x0, 0x0) getdents64(r0, &(0x7f0000000100)=""/241, 0xffd1) 12:39:33 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x3, 0x6) sendmmsg(0xffffffffffffffff, &(0x7f0000008ac0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) ioctl$RNDCLEARPOOL(0xffffffffffffffff, 0x5206, &(0x7f00000002c0)) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000003440)='./file1\x00', 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000400)) setxattr$system_posix_acl(0x0, &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="0204634e9bfe090000000100000000000000040000000000000010ec6a7dedcd9b1d02e446d9be001600000000004e1c8ce49fb1150810bae5c53ee9094eefb2cd71f870b10efd3e358c35699d3c8df8dc1cfab597f0bf7decc13a901ed46dfc5f0cf17f1bf714139b641051457e6260f8e13ef650f5cc8585e26ae798b56d43b188f7b82280840641ec4b034a9f9db98fda950025c5b1d998"], 0x24, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) 12:39:33 executing program 5: syz_mount_image$hfsplus(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)={[{@nobarrier='nobarrier'}]}) 12:39:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) setfsuid(0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) syz_genetlink_get_family_id$devlink(0x0) sendmsg$DEVLINK_CMD_PORT_SET(r0, 0x0, 0x40004) getdents64(0xffffffffffffffff, &(0x7f0000000100)=""/241, 0xffd1) [ 218.294436][ T2525] Bluetooth: hci2: command 0x040f tx timeout [ 218.376228][ T7299] Bluetooth: hci3: command 0x040f tx timeout 12:39:33 executing program 5: syz_mount_image$hfsplus(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)={[{@nobarrier='nobarrier'}]}) 12:39:33 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='lo\x00', 0x10) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) 12:39:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) setfsuid(0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) syz_genetlink_get_family_id$devlink(0x0) sendmsg$DEVLINK_CMD_PORT_SET(r0, 0x0, 0x40004) getdents64(0xffffffffffffffff, &(0x7f0000000100)=""/241, 0xffd1) 12:39:34 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) setfsuid(0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = open(0x0, 0x0, 0x0) getdents64(r0, &(0x7f0000000100)=""/241, 0xffd1) 12:39:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1833, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000200)='-vboxnet0\x00]\xea\xb0\xe2N\xc6c\x05\x8d\xb5\xc0\n\xad\x0f#+\x17\xd6A\xf4\xdf\x1b\xf9~\x8e\"\r\xff\xbb\xb0\xc3\x86\x97\xaf\xf8\x7f*\xfc\xfd\xe7\xcc\xbc\xddI.\xc3\x9aQ\xc8\x8e8U\xdaX\x06\x92\x1d\xbd\x10\xf9\xe8q\x00\xddr>\xd7\x9f\xf8r\xeeE\xa83K\xf60 \x7f\xcd\xac\x86\x9eT*\xf7\a^L,\x98\xa2(2,\x8c*\xff\x8aA\xa1\x153\x15\b\xcb\xf7\xefw\xa6\xc7c@\xb5\x9b\xdc$`3]\xf9.\xcf\x00\xddu\x8b\x95\x9c#\xa4\x13\x1e\x04G}\xa8\xeb\xf7\xcf\xbfT\xbf7\x108\x8d\x16\xe7\x91=\x90\xe6J\x8c\xad\x81\xf3\xb8i\x1b\x96=0\xf0,\xea\x03-\x15j\bQA\x92#\xdcF\x03i\x90x\xd3\xffY\x15]\x00\xd4\xc0\xcf\xc0\xebu\xdb\xc3o\xc1\xadu\xa6\xd69Wi\x17\xa6\x0e\xd65\xa0\xe6\"\xc9\xa3V\xbe`\xceV\xc0\xef\xc4\xe8\xbd\x81\xe6\xca\x0etQ\x8b .t\x01\'1o\xe4\x03SY\xc8U\xfbW\x9cG\x8dM\xbcn\xc2\'Y\r\xbc/\xfe\xfeh\x84}\xaef\x87x\xf3Ob\x1b\x85\x8a*{\x1d', 0x0) ftruncate(r0, 0x1000000) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x101202, 0x0) sendfile(r1, r0, 0x0, 0xeefffdef) 12:39:34 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000100)='tmpfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={[{@mpol={'mpol', 0x3d, {'bind', '=static', @val={0x3a, [0x30]}}}, 0x30}], [], 0x9}) 12:39:34 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)={[{@nobarrier='nobarrier'}]}) 12:39:34 executing program 4: syz_mount_image$tmpfs(&(0x7f0000000100)='tmpfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={[{@mpol={'mpol', 0x3d, {'bind', '=static'}}, 0x30}], [], 0x9}) 12:39:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) setfsuid(0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) syz_genetlink_get_family_id$devlink(0x0) sendmsg$DEVLINK_CMD_PORT_SET(r0, 0x0, 0x40004) getdents64(0xffffffffffffffff, &(0x7f0000000100)=""/241, 0xffd1) [ 219.174303][ T7299] Bluetooth: hci4: command 0x040f tx timeout 12:39:34 executing program 0: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0x78, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x17}}]}, 0x78}}, 0x0) perf_event_open(&(0x7f0000000000)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x20000200054741, 0x80000003}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) 12:39:34 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)={[{@nobarrier='nobarrier'}]}) 12:39:34 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet6(0xa, 0x3, 0x2c) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) write$binfmt_misc(r1, &(0x7f0000000080)=ANY=[], 0x4) write$binfmt_misc(r1, &(0x7f0000000100)=ANY=[], 0x37cb1133) splice(r0, 0x0, r2, 0x0, 0x19404, 0x0) [ 219.414314][ T2525] Bluetooth: hci5: command 0x040f tx timeout 12:39:34 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ttyS3\x00', 0x2, 0x0) sendfile(r1, r0, 0x0, 0x7ffff000) [ 219.469992][ T8412] NFS: Device name not specified 12:39:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00') sendmsg$NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0x1c}}, 0x0) 12:39:34 executing program 0: syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000100)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='huge=always']) chdir(&(0x7f0000000380)='./bus\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffefffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0x175d900f) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, 0x0) open(0x0, 0x10103e, 0x0) 12:39:35 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)={[{@nobarrier='nobarrier'}]}) 12:39:35 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc8, 0xc8, 0x5, [@volatile, @const, @union={0x0, 0x8, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0xe5}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r2, 0x40) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 12:39:35 executing program 4: 12:39:35 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 12:39:35 executing program 4: 12:39:35 executing program 0: 12:39:35 executing program 4: 12:39:35 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 220.374484][ T3855] Bluetooth: hci2: command 0x0419 tx timeout 12:39:35 executing program 3: [ 220.455646][ T7299] Bluetooth: hci3: command 0x0419 tx timeout 12:39:35 executing program 2: 12:39:35 executing program 4: 12:39:35 executing program 0: 12:39:35 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 221.254368][ T7299] Bluetooth: hci4: command 0x0419 tx timeout [ 221.494287][ T5] Bluetooth: hci5: command 0x0419 tx timeout 12:39:38 executing program 3: 12:39:38 executing program 0: 12:39:38 executing program 4: 12:39:38 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)) 12:39:38 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc8, 0xc8, 0x5, [@volatile, @const, @union={0x0, 0x8, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0xe5}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r2, 0x40) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 12:39:38 executing program 2: 12:39:38 executing program 4: 12:39:38 executing program 2: 12:39:38 executing program 3: 12:39:38 executing program 0: [ 223.025333][ T8487] hfsplus: unable to find HFS+ superblock 12:39:38 executing program 4: 12:39:38 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)) 12:39:38 executing program 3: 12:39:38 executing program 2: 12:39:38 executing program 0: 12:39:38 executing program 0: [ 223.248452][ T8502] hfsplus: unable to find HFS+ superblock 12:39:41 executing program 3: 12:39:41 executing program 4: 12:39:41 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003600)) 12:39:41 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc8, 0xc8, 0x5, [@volatile, @const, @union={0x0, 0x8, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0xe5}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r2, 0x40) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 12:39:41 executing program 2: 12:39:41 executing program 0: 12:39:41 executing program 4: 12:39:41 executing program 3: 12:39:41 executing program 2: 12:39:41 executing program 0: [ 226.117603][ T8522] hfsplus: unable to find HFS+ superblock 12:39:41 executing program 3: 12:39:41 executing program 4: 12:39:41 executing program 2: 12:39:44 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc8, 0xc8, 0x5, [@volatile, @const, @union={0x0, 0x8, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0xe5}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r2, 0x40) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 12:39:44 executing program 0: 12:39:44 executing program 3: 12:39:44 executing program 5: 12:39:44 executing program 2: 12:39:44 executing program 4: 12:39:44 executing program 3: 12:39:44 executing program 0: 12:39:44 executing program 5: 12:39:44 executing program 4: 12:39:44 executing program 2: 12:39:44 executing program 2: syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_num_comp_pkts={{0x13, 0x1}}}, 0x4) 12:39:47 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc8, 0xc8, 0x5, [@volatile, @const, @union={0x0, 0x8, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0xe5}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r2, 0x40) ptrace$cont(0x7, r2, 0x0, 0x0) 12:39:47 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000001300)=[{0x20, 0x0, 0x0, 0xfffff034}, {0x6}]}, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, 0x0) 12:39:47 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x400448ca, 0x0) 12:39:47 executing program 0: syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x0, 0x0, 0xa}, @l2cap_cid_signaling={{0x6}, [@l2cap_info_req={{0xa, 0x80, 0x2}, {0x2}}]}}, 0xf) 12:39:47 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) syz_emit_vhci(&(0x7f0000000380)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x0, 0x0, 0x45}, @l2cap_cid_signaling={{0x41}, [@l2cap_conn_req={{0x2, 0x9, 0x4}, {0x2, 0x2}}, @l2cap_disconn_rsp={{0x7, 0x3, 0x4}, {0x0, 0x100}}, @l2cap_info_req={{0xa, 0xa4, 0x2}, {0x3}}, @l2cap_move_chan_rsp={{0xf, 0x7f, 0x4}, {0xffff, 0x1ff}}, @l2cap_conn_req={{0x2, 0x5, 0x4}, {0x68cd}}, @l2cap_conn_rsp={{0x3, 0x88, 0x8}, {0x3, 0x1, 0x0, 0x7f}}, @l2cap_move_chan_rsp={{0xf, 0x7, 0x4}, {0x100, 0x1}}, @l2cap_move_chan_req={{0xe, 0xff, 0x3}, {0xff7f, 0x3f}}]}}, 0x4a) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$sock_ifreq(r2, 0x89a3, &(0x7f0000000000)={'macvlan1\x00', @ifru_mtu=0x5}) getsockopt$bt_l2cap_L2CAP_CONNINFO(r2, 0x6, 0x2, &(0x7f0000000040), &(0x7f0000000080)=0x6) ioctl$sock_ifreq(r1, 0x0, &(0x7f0000000000)={'macvlan1\x00', @ifru_mtu=0x5}) accept4(r0, &(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f00000000c0)=0x80, 0x800) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x6) ioctl$sock_SIOCDELRT(r4, 0x400448c9, 0x0) r5 = accept4(r4, &(0x7f00000001c0)=@ipx, &(0x7f0000000240)=0x80, 0x800) connect$bt_l2cap(r5, &(0x7f0000000280)={0x1f, 0x1, @fixed={[], 0x12}, 0xcfb, 0x2}, 0xe) ioctl$sock_bt_bnep_BNEPCONNADD(r5, 0x400442c8, &(0x7f0000000300)=ANY=[@ANYRES32=r3, @ANYBLOB="000000000100fd809211b27cd6fb5211d2c85b5f2a29008f91fc67ff01000053c4acacfd5d5c46d9a62b4c67f871b19448bccce2ecb10cfad16afdfa3f241c2641242432ce4eeab96dd6485b81619644ed8c6ea3a0b737d819a211e58aabda4817a56826ec29de603db2a710d6140a9ab9cc1f9152f79e2274428b300403989a309d61f40bcd6984e6004c2e99014e59c14dbc73ad5fad9dea8e9b5a26bd57081e9221db72b2c3e81117db7a808a0a7b093121fc13d42f59d705949d1e3ba6a742cf92e97d18afc52e9e69d0ce060b932dfc"]) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r5, 0x800442d2, &(0x7f0000000100)={0x0, &(0x7f0000000100)}) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000000)='xfrm0\x00') 12:39:47 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x15, &(0x7f0000000000)={0xffffffffffffff69, 0x0}, 0x10) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000000)={0x2, 0x40db, "5ff95d", 0xf4, 0x40}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x15, &(0x7f0000000000)={0xffffffffffffff69, 0x0}, 0x10) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000040), &(0x7f0000000080)=0x30) 12:39:47 executing program 0: syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="043e"], 0x2) [ 232.326555][ T1531] Bluetooth: Wrong link type (-22) 12:39:47 executing program 0: syz_emit_vhci(&(0x7f00000001c0)=ANY=[@ANYBLOB="0402"], 0x2) [ 232.383333][ T8588] sock: sock_set_timeout: `syz-executor.2' (pid 8588) tries to set negative timeout 12:39:47 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x400448ca, 0x0) 12:39:47 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) syz_emit_vhci(&(0x7f0000000380)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x0, 0x0, 0x45}, @l2cap_cid_signaling={{0x41}, [@l2cap_conn_req={{0x2, 0x9, 0x4}, {0x2, 0x2}}, @l2cap_disconn_rsp={{0x7, 0x3, 0x4}, {0x0, 0x100}}, @l2cap_info_req={{0xa, 0xa4, 0x2}, {0x3}}, @l2cap_move_chan_rsp={{0xf, 0x7f, 0x4}, {0xffff, 0x1ff}}, @l2cap_conn_req={{0x2, 0x5, 0x4}, {0x68cd}}, @l2cap_conn_rsp={{0x3, 0x88, 0x8}, {0x3, 0x1, 0x0, 0x7f}}, @l2cap_move_chan_rsp={{0xf, 0x7, 0x4}, {0x100, 0x1}}, @l2cap_move_chan_req={{0xe, 0xff, 0x3}, {0xff7f, 0x3f}}]}}, 0x4a) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$sock_ifreq(r2, 0x89a3, &(0x7f0000000000)={'macvlan1\x00', @ifru_mtu=0x5}) getsockopt$bt_l2cap_L2CAP_CONNINFO(r2, 0x6, 0x2, &(0x7f0000000040), &(0x7f0000000080)=0x6) ioctl$sock_ifreq(r1, 0x0, &(0x7f0000000000)={'macvlan1\x00', @ifru_mtu=0x5}) accept4(r0, &(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f00000000c0)=0x80, 0x800) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x6) ioctl$sock_SIOCDELRT(r4, 0x400448c9, 0x0) r5 = accept4(r4, &(0x7f00000001c0)=@ipx, &(0x7f0000000240)=0x80, 0x800) connect$bt_l2cap(r5, &(0x7f0000000280)={0x1f, 0x1, @fixed={[], 0x12}, 0xcfb, 0x2}, 0xe) ioctl$sock_bt_bnep_BNEPCONNADD(r5, 0x400442c8, &(0x7f0000000300)=ANY=[@ANYRES32=r3, @ANYBLOB="000000000100fd809211b27cd6fb5211d2c85b5f2a29008f91fc67ff01000053c4acacfd5d5c46d9a62b4c67f871b19448bccce2ecb10cfad16afdfa3f241c2641242432ce4eeab96dd6485b81619644ed8c6ea3a0b737d819a211e58aabda4817a56826ec29de603db2a710d6140a9ab9cc1f9152f79e2274428b300403989a309d61f40bcd6984e6004c2e99014e59c14dbc73ad5fad9dea8e9b5a26bd57081e9221db72b2c3e81117db7a808a0a7b093121fc13d42f59d705949d1e3ba6a742cf92e97d18afc52e9e69d0ce060b932dfc"]) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r5, 0x800442d2, &(0x7f0000000100)={0x0, &(0x7f0000000100)}) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000000)='xfrm0\x00') [ 232.489811][ T8149] Bluetooth: Wrong link type (-22) 12:39:47 executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCBRADDBR(r1, 0x89a1, &(0x7f0000000000)='xfrm0\x00') ioctl$sock_netdev_private(r1, 0x89f4, &(0x7f0000000100)="dda2988d22399b1a78e9c897fc3bd45396cb7c77ae210f90466fc514540d01db14f89d077dc77dbcecd4391e7691ef719ca2517addc2190ea1697a266a3aed139c83a11e957e6b79ffbaa74c85c92365") r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCBRADDBR(r2, 0x89a1, &(0x7f0000000000)='xfrm0\x00') ioctl$sock_bt_hci(r2, 0x400448de, &(0x7f0000000000)="e4c65af28e60efc626b016e3e6113ee28c083d5d3e6db989ac93de484cec6c04d734cc197454fd0ad1") ioctl$sock_bt_hci(r2, 0x800448d2, &(0x7f0000000180)="5d1cffb990b5cdd823a2f58b135132c71db03086bbdc6bb5e5aea70d34b10b130e213f1d6a967d95f6237dc96a5851bbb099da898240a78fbf0ef7d7d424aa4fee006de97f11b11e447a33e06bc7271292c0de6ba2ddff0fa0467dd780208f2200383438fc394611268d50401a7057a74fc56a68cb5bd2c9fce4cd0a93696620062d1bd96f4c2365ffe656063367ae97128ac90c8b9c21b9cfc2c50ae574ce389bd6ba770baf94b7fa5d59157ea7d43e0cb73676572df539af8883417ce4ac6436039d31e31b9396bb84a696699d64fa7dd376a02d85dfc3d5ea07536f8613ab412ec05696c40dabdea466fdbfc0e5a09c42e052f18f4df360445d2bfdcade6fda5f8927016a77fe4b2478d3b769988e372e146d42c2fc0c93969cad6b399f41ffc3c4fa587625d5b5fa391fe175dd2d9f373803521ccfd35f600a2ce2b80fa26b5cb692370c44df963d93e0657780d83320463641181243cbdfc6ef35bf782d648ea96667cb5e5f38619058d1b09e483ee71e0ab1f9873a38e09445ab96b8a37690696baf0f9cae576ed7ba3de44c8b1b27caea1ff799723955d52174c48b71f5c62180f7f4b6a3469f2972acb9cc7a576d6edb784b7acc47e482337936286055edfcd42b7b4541a54a210198a2550bb9a72c6d972b545dbab7c2b10716e25c3fb93f045163fdef2c6322481cd2916e329a992f834e74972879fdfb4a7d354a7ed0f6c05035d3bd3b59379197f881716a22400c4cf69555eac489bfbb7b7b13907fc2ec8dc8fc3f94081beab3afccd10f51e3f20afdad8e0baeba99013b11a1c5e817fe4a0c19f3493b846b092399d5def25d38583346f04d314ede7b912cdef533d9d6eb0ff135e6c06bda41688696de95156542d280440ee06ec40adcc4ad6a7d0489a02f8e7d5eb6a9ff9dfd51683c5119ebac579e5bbc4f45acdee7343a8b89114afbd015dded6c3541e89bd71e31d432c35ef70456eac377a9923bdbccb38ba66b15be5ca05998249ca3d1dd7726bf56c730fe4542267254b46bffc25b39d5809cbabb90544311bef619b5adf4e709c6caa1721ccdb2f26e08bdeb0a2d45ec11a4de17056ef4818f7ca21ebb4201b5464dee466f8245bf9bb475445db87507542328e08d50d9905bf35c2076f8e70720f0726d8cd12a9b5c8a71c65a0e00d0a879b617a98c3272ac7959e6dcade4a63a098d98007938a7668135e7937334681a5fa2d0319115c50506481420630c09a01c99e81b85cb826ed613e0a9865aa28f6ddb67a7353f47ff4f3ae70a63e4a28156a57002eede69e28cb7ad9fbdc4f2e351f8f0363499502fab245fc0685bd2bf52630e14e1bdb45c6a0061c93bacdb3a998fbd573db77a1b485931841ab4d19657649cf99581eeddcf325b745308902b06d6ccac9cb1fe2c9299b88ade8303bf9f94532ec9a9193232bba527a3bb088abdbf5716626ddb641bc18a66619ab4c88af058e44d5276b509b2ca7f1130fe8972c9348814cc66c13456ca50175fa275ec4e7d3d48079c4262093f7cb5b1260b71536f5db8354ce4795c02358da89aff2bc82baed105306df6f78f305a7eda668b3e60553cd36f38fd79b759fe967475665537261c559f84c181c328b0e3cff62ee59628af8ee76c2186e0b2b8d83d94996b89f6b2e4fae1008b4b89cf4bfca0cc63bf634c2962d4ebaf51827daf222a3c843ee08466e82eab3c503db59b35a9ab615544faa1288f9dd386f7a7d1c1407c6c0f01651d263f26251ddeef98b95b3787f31a584b2bed7bcc84c4b0a5217bd75d752868ebf6aa0b7acdf21667944ebb70aa311c36de5a1bce92c35877eecce8b5c4ae0026e484f7579d5719ed401fde494df93ee5761258da8f41a5d186c5ba700e76ae86211a2d33182689ece03e2fa8dfd18159c5935c18b73464bf78f0ade4703d0faba455a26467307a7aba3fdd43ce99a25395ad0f15b3d1320fc52855d1ade29bfb6f23ad42d76fce05eb989d46e288ffadb193e1e1f7bb0fb803c0689b7267524bea71dee7e0efb28980b74bb11415292491733ae767f96e7586052e6463399bf390e409d342c4b7e6ca81cd0db6cff6496cee77c05db44abf3c5242947dda107c10fea37e7c0d5149602f1ce4134541ac1d75790e2f81c391191000a78ae1f9c12eb8a5286b4189a2897374c794a9c2b81ba2ce6a3b354ee827e7b2c9848befd093495b7c97ce7034b1885ba50c01667b422dde28dbb70cea8498837b42e27b2cc34645b44ee34a35fd8c9c871cab27acb2b4b4e5bef7a98cab7fd283d6a97b9b8cf84e01405aef6c4936b005fad2aaea0fbf162dcac9ca2e43452f36281bec19089e5fd994c402319937f18959c1af01bda3797792eece707bd7e71a842b8f9cf0149d205ead6d35c37413d8f82b9d9f3064cee11d6e974c89ac7f765fe61b5a92886aca18c17749dc11448eba9f0c0b2c8d5ec12c405b2c5b30d70533d32595ce2e6f3ae80e9819b66a38d8bc2c68f7e93184833035e58fdefa9ba5dac62a3b8e1e01c498fecdbf32e573c00bd60a5c951a67f6abe9f1accdc5f8b3a81810aae7c6de1fa7f1d18492d348070e7f2d1760311ce2743e9f32752ef46ba7711f8cbb6852fc07ca4fc546bc2077959b2da61a3f13c979ff896cb1d4ea11b085971e57be2f81d7d55e3edb67f07cb5f3e059f6a7c6e1c598d1de3831eb74b3fbf98e6e0716b484e3b70b4e218e7c306601632c6179ef1b3a9688f753a8ff000848d11cead7929e1bdaaeafab7fc7ec0685552f4c2d5454c26ce5267158831507d641f4d3c9351197e9528b66f04e10023ab107a19d1e9c4bd03c7131e3f271559b7c2ed9d03530fa4647c4f877ba8d3380d629af0f67f6f7c69bd91e06aa400f785369c8196572e3be654629abafbb04ebbbafc90568bd067454c5604ad7f9a7ca9a409fedaabb62d0bb2d9ad3af829f627c985e863cd4f2b10dd6d467c5e21efc3d1603af98efc6880061911208b1e91e3c023476817dca5c69d54763aa588f5c5c5ec0687f0b02a112df269c7ebb723db2c025286bb726be86268d307508a4c373a351245eaf36cd836693d7f77619773bbc4c2ff16b90ce3ba4d29cd15fac93c4a97215c7d36570931593dac4ab27b4fb86d0cf968947a8862e822f567067a1114d7e4e6daf442fb51bd6765356c0f2e5000b0093fedcc62c97bb9d1869fc1c424f667a32e39e7c6a7462bb3db320565820a8516223ff6bc21fab13fbe51dcf71ebc6d06e14632c8a10edf7fed5deaea8b837a936d40a304712c6a00b96d75e7d431a931e29355050660aef047606b2f6289f6019eb178e2beb05a00682a83530aa08996e4a6c0b67770ead23f24b15e56e9b86e0ced45566fafd37edcfdb25ac5b03f90e804b8a8f4e49076f8162ebf176c6b71368fcae6fd8d8d94597cb1c25789f45d05c88aa50596e953ff435bc24a4bf33989d4f6842b15bfe7e6995a632a40e4837bcbb5615f7c449326c8d52ae04bc3b8fc65cd2216800a58a4942460bb9b552a76be88683ed1fffe44950c197b9145f1406802267e7064b2a4f4f4f60ed17bf8477b5e8154e2538cd7e6b5f48a4c855966c792773bd1c62bb45fcf27342f73bef7dfeae1a6d9f7200026a73ffbd181a2531804953fb69710d06ab1fa27b816cbbcebd5cbcae0214b10ed088651ee1382f6afa71c2824afc60591282e1d0f8d49014325e532463bf2e39037f5ee0ba6f8f651008e5867eb9ed326b9e7eae8801f9c48c3a9c90a5adf3f2ba97d475606bb715f4a050ef982000164bfd2c916371727539b8dc09ab875ce4f948b584ffdb19c20d958125c034775df072d2275358225e254fcad4c464b06888d2a8671a8fc60219242c5c5b6fa1c1c8e9b16e6c3b4791686fb147057e60fd87f40731e12009cd2a6eac111e9407890dc364e8dd720f4ad30489fbbffec143c78b0bad1d092b1546f18ce7eaf79779123008baba9029fcdc0d3d0798e00de3f9f77844118dc4372585dd9c9cf5e367a37cc07d0c85c9696035642a71bdc7cdf89120ad7c156b9795eaf4774b1b7ead2a13d8cc99131ccee664e6253d87b081af6aa28a215af8907ff57dff385fa44b09746a24b02983f3929a19d27d7c8ecce11457b658bed504f4d44c6331b143ca5037dbef097f95ec6644065ade9c9707c94225cbf27d5d890464a3e1aab209041a29f3bd1d6d2586ce740d90d2e427c272d6e16dad3427f7b48c49c70bb2338b8d342dab61290f128ca8737563caf004adba5f78257fa44440d74789204a152c19ad6da676b27d92787ac71ba65d893c453168241c76105eb215b6e5fa3e6756eaf92f19f654c5e66c5be851301d6324ccc034c5f6495785cefe763dac232a502905b02e96b9f9adbea972fc9b813f34293b35d5dd218b4a8cc71d6b759c0d171c597e376d008d217faa381aaf199ae90d73b7a021308095f65a220287f8ccac7323ad9ac511d8f73e9a631c7238610ebe0932823fd65a033ce69582438b833aeb8390d823138c9361b0824f78e2bf1452b656bc2839e9905e28c650573ef6a989ab121ea0829290e7578907a0d8ec0d847809ae2cadd3368fb3fa8b49c0179361f185696ea7f8b331501def74ffa4ed2262aa8e17183f04b3dd970c9564e13c01da4cc3e998f5ddfc1de1f3107d2f0f74ce316c8290758a28f99f88501dba7aae1858bc7d3ed435ad7de97a49aaa6ef2992614aa9bd56de0a98b844c1d2df2b0d7e2fa0003edbc0f580467bbc0c20b2443036924fa086231b6bba9190a20a4cf88d241348ec6b5e4f16c2dc6a37e0d4a228079b409816d3120c9123114793ac1a162e72314b2c5da33361bbe395dbc6a4ec67bf288948fe7c1b36ff1155a0058b7f873f080840ba39a11007400b597ccb0c310ced8eab217d5528ce6af690e9272a82f0d04408d0f5444d04d807c0a5142c353479981311856456c1664524f581ee9cbad7b0a066d0a8857808d78cf8a7b8a7dd2744acec887eb34ea1b8c9f525fd51b40dac05a549ba3876a92c6cab7e27a63e404621f9429ffe8ca61a814a38688c4fd9a81743ff3589716d78e02d50908606f0a43588c2f744f52d7d353324563ec274b9d0e3867e0d1c0eb1d68de66df6551fa4821b983d0967c6d2393a5fb2d7ad45cd33ff9ee38661ee19df507e60b2408a584a1e7405fcbd1ad28dcaced241fef0067e822ffb5ec240746b606d4edb24bb89d0fa5b19710ede0de604cc541bfe78213607a7ef17d2815189c940c05464609353cd82570d86a44d2276d64a439e0d7ab02acbb570d8e804e09d5ddfcba42050dafe2b1746d5fca4b333c9c1c6fa45529051ace881c9fac754e2ffb471db9131b3dc4c662bc8048c11787c3790caf0b4d70e9d0bce2b3160cc1cab7cba7aedf73d64ce100b8fb59fd6f556914646c1d2d70951cba79f64922706c24216b9fcaddea6f6fac1d332840b411fd6f9f4aee85867d9dfe7b9f4d26b5895cfe456dbb3bd83c11e8aa380f0eed8673230dfed14827e387a301ae4f6e1ae08911e5a3eba585bf83d6bd77fa9938e68d71c307e5e8df89c5d804667c0c2b75d2f1cebbb46e5891ae83f1f9420a079de9ceedc62964ac67ba1952d1bfec02b3503e76b9fff4552726280a8758c9d825764d49c50ccf1a2e3453377bd8421c59edde68436234ec2375dd9811f7bb1fab48b51fdef4cad7d318dd32a6bd76b57203081ef848e500c6de3e8931e9bccdf6286f379e4d1eced7e5d6e6bd35d08dd84ae437e599cd65463c6da3822c14af3472d6c8abff6c732a81c") r3 = socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$FICLONE(r0, 0x40049409, r3) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r5, 0x89f1, &(0x7f0000000000)) bind$bt_sco(r5, &(0x7f00000000c0), 0x8) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x15, &(0x7f0000000000)={0xffffffffffffff69, 0x0}, 0x10) 12:39:47 executing program 4: syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="043e550bb4"], 0x15) [ 232.638012][ T1531] Bluetooth: Wrong link type (-22) [ 232.759088][ T8149] ================================================================== [ 232.767444][ T8149] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x380c/0x3eb0 [ 232.775261][ T8149] Read of size 1 at addr ffff88808de36e0c by task kworker/u5:3/8149 [ 232.783245][ T8149] [ 232.785587][ T8149] CPU: 0 PID: 8149 Comm: kworker/u5:3 Not tainted 5.8.0-rc7-syzkaller #0 [ 232.793997][ T8149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 232.804073][ T8149] Workqueue: hci4 hci_rx_work [ 232.808747][ T8149] Call Trace: [ 232.812045][ T8149] dump_stack+0x18f/0x20d [ 232.816396][ T8149] ? hci_le_meta_evt+0x380c/0x3eb0 [ 232.829343][ T8149] ? hci_le_meta_evt+0x380c/0x3eb0 [ 232.834480][ T8149] print_address_description.constprop.0.cold+0xae/0x436 [ 232.841525][ T8149] ? lockdep_hardirqs_off+0x66/0xa0 [ 232.846771][ T8149] ? vprintk_func+0x97/0x1a6 [ 232.851385][ T8149] ? hci_le_meta_evt+0x380c/0x3eb0 [ 232.856510][ T8149] kasan_report.cold+0x1f/0x37 [ 232.861290][ T8149] ? hci_le_meta_evt+0x380c/0x3eb0 [ 232.866420][ T8149] hci_le_meta_evt+0x380c/0x3eb0 [ 232.871378][ T8149] ? mark_lock+0xbc/0x1710 [ 232.875814][ T8149] ? hci_key_refresh_complete_evt.isra.0+0x10b0/0x10b0 [ 232.882683][ T8149] ? mark_lock+0xbc/0x1710 [ 232.887152][ T8149] ? __lock_acquire+0x16e3/0x56e0 [ 232.892206][ T8149] ? __lock_acquire+0x16e3/0x56e0 [ 232.897251][ T8149] hci_event_packet+0x245a/0x86f5 [ 232.902300][ T8149] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 232.908301][ T8149] ? __lock_acquire+0x16e3/0x56e0 [ 232.914301][ T8149] ? hci_cmd_complete_evt+0xc6e0/0xc6e0 [ 232.919864][ T8149] ? lock_acquire+0x1f1/0xad0 [ 232.924558][ T8149] ? skb_dequeue+0x1c/0x180 [ 232.929075][ T8149] ? find_held_lock+0x2d/0x110 [ 232.933849][ T8149] ? mark_lock+0xbc/0x1710 [ 232.938284][ T8149] ? mark_held_locks+0x9f/0xe0 [ 232.943069][ T8149] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 232.948895][ T8149] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 232.954894][ T8149] ? trace_hardirqs_on+0x5f/0x220 [ 232.959953][ T8149] ? lockdep_hardirqs_on+0x6a/0xe0 [ 232.965081][ T8149] hci_rx_work+0x22e/0xb10 [ 232.969526][ T8149] process_one_work+0x94c/0x1670 [ 232.977306][ T8149] ? lock_release+0x8d0/0x8d0 [ 232.981998][ T8149] ? pwq_dec_nr_in_flight+0x2d0/0x2d0 [ 232.987388][ T8149] ? rwlock_bug.part.0+0x90/0x90 [ 232.992350][ T8149] ? lockdep_hardirqs_off+0x66/0xa0 [ 232.997585][ T8149] worker_thread+0x64c/0x1120 [ 233.002283][ T8149] ? __kthread_parkme+0x13f/0x1e0 [ 233.007327][ T8149] ? process_one_work+0x1670/0x1670 [ 233.012549][ T8149] kthread+0x3b5/0x4a0 [ 233.016741][ T8149] ? __kthread_bind_mask+0xc0/0xc0 [ 233.021869][ T8149] ? __kthread_bind_mask+0xc0/0xc0 [ 233.027010][ T8149] ret_from_fork+0x1f/0x30 [ 233.031441][ T8149] [ 233.033781][ T8149] Allocated by task 8618: [ 233.039542][ T8149] save_stack+0x1b/0x40 [ 233.043720][ T8149] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 233.049369][ T8149] __alloc_skb+0xae/0x550 [ 233.053729][ T8149] vhci_write+0xbd/0x450 [ 233.057987][ T8149] new_sync_write+0x422/0x650 [ 233.062684][ T8149] vfs_write+0x59d/0x6b0 [ 233.066943][ T8149] ksys_write+0x12d/0x250 [ 233.071945][ T8149] do_syscall_64+0x60/0xe0 [ 233.076376][ T8149] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 233.082276][ T8149] [ 233.084617][ T8149] Freed by task 7302: [ 233.088622][ T8149] save_stack+0x1b/0x40 [ 233.092787][ T8149] __kasan_slab_free+0xf5/0x140 [ 233.097649][ T8149] kfree+0x103/0x2c0 [ 233.101645][ T8149] skb_release_data+0x6d9/0x910 [ 233.106503][ T8149] consume_skb+0xc2/0x160 [ 233.110840][ T8149] netlink_broadcast_filtered+0x35c/0xdc0 [ 233.116614][ T8149] nlmsg_notify+0x90/0x250 [ 233.121068][ T8149] __neigh_notify+0xdc/0x160 [ 233.125667][ T8149] neigh_cleanup_and_release+0x94/0x3a0 [ 233.131220][ T8149] neigh_remove_one+0x3b1/0x440 [ 233.136085][ T8149] ___neigh_create+0x165e/0x2500 [ 233.141037][ T8149] ip6_finish_output2+0xe3c/0x17b0 [ 233.146154][ T8149] __ip6_finish_output+0x447/0xab0 [ 233.151281][ T8149] ip6_finish_output+0x34/0x1f0 [ 233.156144][ T8149] ip6_output+0x1db/0x520 [ 233.160487][ T8149] ndisc_send_skb+0xa69/0x1720 [ 233.166043][ T8149] ndisc_send_rs+0x12e/0x700 [ 233.170647][ T8149] addrconf_rs_timer+0x2ec/0x7c0 [ 233.175599][ T8149] call_timer_fn+0x1ac/0x760 [ 233.180195][ T8149] __run_timers.part.0+0x54c/0xa20 [ 233.185328][ T8149] run_timer_softirq+0xae/0x1a0 [ 233.190196][ T8149] __do_softirq+0x34c/0xa60 [ 233.194695][ T8149] [ 233.197029][ T8149] The buggy address belongs to the object at ffff88808de36c00 [ 233.197029][ T8149] which belongs to the cache kmalloc-512 of size 512 [ 233.211094][ T8149] The buggy address is located 12 bytes to the right of [ 233.211094][ T8149] 512-byte region [ffff88808de36c00, ffff88808de36e00) [ 233.224806][ T8149] The buggy address belongs to the page: [ 233.230455][ T8149] page:ffffea0002378d80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 [ 233.239598][ T8149] flags: 0xfffe0000000200(slab) [ 233.244469][ T8149] raw: 00fffe0000000200 ffffea000298ea88 ffffea00024ea988 ffff8880aa000a80 [ 233.253070][ T8149] raw: 0000000000000000 ffff88808de36000 0000000100000004 0000000000000000 [ 233.261660][ T8149] page dumped because: kasan: bad access detected [ 233.268074][ T8149] [ 233.270405][ T8149] Memory state around the buggy address: [ 233.276043][ T8149] ffff88808de36d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 233.284159][ T8149] ffff88808de36d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 233.292280][ T8149] >ffff88808de36e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 233.300366][ T8149] ^ [ 233.304746][ T8149] ffff88808de36e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 233.312840][ T8149] ffff88808de36f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 233.320952][ T8149] ================================================================== [ 233.329382][ T8149] Disabling lock debugging due to kernel taint [ 233.348675][ T8149] Kernel panic - not syncing: panic_on_warn set ... [ 233.355292][ T8149] CPU: 0 PID: 8149 Comm: kworker/u5:3 Tainted: G B 5.8.0-rc7-syzkaller #0 [ 233.358536][ T8592] sock: sock_set_timeout: `syz-executor.2' (pid 8592) tries to set negative timeout [ 233.365107][ T8149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 233.365127][ T8149] Workqueue: hci4 hci_rx_work [ 233.365134][ T8149] Call Trace: [ 233.365156][ T8149] dump_stack+0x18f/0x20d [ 233.365173][ T8149] ? hci_le_meta_evt+0x37f0/0x3eb0 [ 233.365186][ T8149] panic+0x2e3/0x75c [ 233.365198][ T8149] ? __warn_printk+0xf3/0xf3 [ 233.365214][ T8149] ? preempt_schedule_common+0x59/0xc0 [ 233.365236][ T8149] ? hci_le_meta_evt+0x380c/0x3eb0 [ 233.422214][ T8149] ? preempt_schedule_thunk+0x16/0x18 [ 233.427591][ T8149] ? trace_hardirqs_on+0x55/0x220 [ 233.432627][ T8149] ? hci_le_meta_evt+0x380c/0x3eb0 [ 233.437746][ T8149] ? hci_le_meta_evt+0x380c/0x3eb0 [ 233.442861][ T8149] end_report+0x4d/0x53 [ 233.447023][ T8149] kasan_report.cold+0xd/0x37 [ 233.451709][ T8149] ? hci_le_meta_evt+0x380c/0x3eb0 [ 233.456829][ T8149] hci_le_meta_evt+0x380c/0x3eb0 [ 233.461787][ T8149] ? mark_lock+0xbc/0x1710 [ 233.466219][ T8149] ? hci_key_refresh_complete_evt.isra.0+0x10b0/0x10b0 [ 233.473109][ T8149] ? mark_lock+0xbc/0x1710 [ 233.477534][ T8149] ? __lock_acquire+0x16e3/0x56e0 [ 233.482590][ T8149] ? __lock_acquire+0x16e3/0x56e0 [ 233.487633][ T8149] hci_event_packet+0x245a/0x86f5 [ 233.492680][ T8149] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 233.499000][ T8149] ? __lock_acquire+0x16e3/0x56e0 [ 233.504066][ T8149] ? hci_cmd_complete_evt+0xc6e0/0xc6e0 [ 233.509633][ T8149] ? lock_acquire+0x1f1/0xad0 [ 233.514317][ T8149] ? skb_dequeue+0x1c/0x180 [ 233.518865][ T8149] ? find_held_lock+0x2d/0x110 [ 233.523638][ T8149] ? mark_lock+0xbc/0x1710 [ 233.528070][ T8149] ? mark_held_locks+0x9f/0xe0 [ 233.532847][ T8149] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 233.538668][ T8149] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 233.544656][ T8149] ? trace_hardirqs_on+0x5f/0x220 [ 233.549715][ T8149] ? lockdep_hardirqs_on+0x6a/0xe0 [ 233.554889][ T8149] hci_rx_work+0x22e/0xb10 [ 233.559321][ T8149] process_one_work+0x94c/0x1670 [ 233.564265][ T8149] ? lock_release+0x8d0/0x8d0 [ 233.568952][ T8149] ? pwq_dec_nr_in_flight+0x2d0/0x2d0 [ 233.574343][ T8149] ? rwlock_bug.part.0+0x90/0x90 [ 233.579292][ T8149] ? lockdep_hardirqs_off+0x66/0xa0 [ 233.584527][ T8149] worker_thread+0x64c/0x1120 [ 233.589222][ T8149] ? __kthread_parkme+0x13f/0x1e0 [ 233.594262][ T8149] ? process_one_work+0x1670/0x1670 [ 233.599481][ T8149] kthread+0x3b5/0x4a0 [ 233.603583][ T8149] ? __kthread_bind_mask+0xc0/0xc0 [ 233.608700][ T8149] ? __kthread_bind_mask+0xc0/0xc0 [ 233.613823][ T8149] ret_from_fork+0x1f/0x30 [ 233.619427][ T8149] Kernel Offset: disabled [ 233.623744][ T8149] Rebooting in 86400 seconds..