last executing test programs: 4.182419904s ago: executing program 0 (id=1): r0 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x0) sched_setscheduler(0x0, 0x2, 0x0) userfaultfd(0x1) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec85"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) syz_emit_vhci(&(0x7f0000000100)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x4}, @HCI_OP_LE_ADD_TO_ACCEPT_LIST={{}, 0xfc}}}, 0x7) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./bus\x00', 0x0, 0x0) r6 = fanotify_init(0x200, 0x0) fanotify_mark(r6, 0x1, 0x4800003e, r5, 0x0) chdir(&(0x7f0000000140)='./bus\x00') r7 = creat(&(0x7f0000000300)='./bus\x00', 0x0) close(r7) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000540)={0x1, 0x400006, 0x0, 0x9, '\x00', '\x00', '\x00', 0x0, 0x81, 0x3, 0xba, "b6855a32474f04ed0000ddcffbffffff"}) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r7, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000080)={0x20, 0x140e, 0x1, 0x70bd2b, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x3}, @RDMA_NLDEV_ATTR_RES_PDN={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000880}, 0x80) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100008010bd408205140099bb0000000109022400011b00001009040000022a3e74000905015e01031d101109050b36"], 0x0) 3.912206188s ago: executing program 3 (id=4): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1000000, 0xffffffffffffffc7, 0x0, &(0x7f0000000180)="93", 0x0}, 0x50) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$PNPIPE_HANDLE(r5, 0x113, 0x3, &(0x7f0000000000)=0x7fffffff, 0x4) 2.839392515s ago: executing program 3 (id=6): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)}], 0x1}, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b1a, &(0x7f0000000000)={'wlan1\x00'}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000280)=[@mss, @sack_perm, @timestamp, @mss={0x2, 0x1}, @window, @window={0x3, 0x0, 0xfffc}, @timestamp, @timestamp], 0x8) getsockopt$inet_tcp_int(r1, 0x6, 0xc, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0xc7) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x712, 0x0, 0xfffffffffffffd25) 2.632811573s ago: executing program 2 (id=3): listen(0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000000000000000000000000001811000060bec120c813a34aec59febbf490be7e60cc68129c1b44e74d4af7387e1a3e51899da65902f8d4fc47d8de0834fdd2d4b7644cfe6a356dfb6ae824bf7c6482a731eb5cfd45e7420412fe947850651a98359f243dbc5a80de9b22d6bcf8c1f94ef6e205789a76820920ee6111997f1ed83d0c991431c5a39d549181068d5e6e57", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000070000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f0000000440), 0x10) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt(r5, 0xff, 0x1, 0x0, 0x0) 1.662663858s ago: executing program 3 (id=7): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, &(0x7f0000000040)='wg0\x00', 0x4) socket$inet_smc(0x2b, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) bind$l2tp(0xffffffffffffffff, &(0x7f00000000c0), 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setscheduler(0x0, 0x6, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0) socket$l2tp(0x2, 0x2, 0x73) r4 = socket$l2tp(0x2, 0x2, 0x73) chdir(&(0x7f0000000480)='./cgroup\x00') r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000000)="3f0000000100f4", 0x7) r6 = openat(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x0, 0x0) open_by_handle_at(r6, &(0x7f0000000040)=ANY=[@ANYRES8=r4], 0xdd9c83) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r7, 0x0, 0x0) 1.357686796s ago: executing program 2 (id=8): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) fcntl$lock(r0, 0x25, &(0x7f00000010c0)={0x0, 0x2, 0x1, 0x1fe}) preadv(r0, &(0x7f0000000000)=[{&(0x7f0000001100)=""/4104, 0x1008}], 0x1, 0x33, 0x0) read$char_usb(r0, &(0x7f00000004c0)=""/64, 0x40) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x9, 0x4, &(0x7f0000000000)=ANY=[], 0x0, 0x8, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000440)={0x0, &(0x7f0000000100)}) lgetxattr(0x0, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="318300000000000000fb180000000c0001800800030003000000"], 0x20}}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x7, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x40049}, 0x8000) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)={0x11c, 0x2, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_DATA={0x54, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x7}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x200}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x2}, @IPSET_ATTR_CADT_FLAGS={0x8}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x7ff}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x5b}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x12}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xa7}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x7}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x3}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}]}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x48, 0x7, 0x0, 0x1, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x8}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x6}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0x200}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x53f}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x7ff}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e20}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x59}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x5}]}, 0x11c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) close(0x3) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0xd, 0x3}, {0x10000002, 0x0, 0xf, 0x6}], 0x10, 0x4000000, @void, @value}, 0x94) r5 = socket$kcm(0x2, 0x1, 0x84) close(0xffffffffffffffff) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r5, 0x84, 0x64, &(0x7f0000000000)=r6, 0x10) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000140)=[{&(0x7f00000005c0)="df", 0x1}], 0x1}, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x10100) recvmsg$kcm(r4, &(0x7f0000000900)={0x0, 0xfffffffffffffeea, 0x0}, 0x40018020) syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x22c01) setreuid(0x0, 0xee00) mknod(&(0x7f0000000240)='./file3\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000001380)) 437.08449ms ago: executing program 1 (id=2): prctl$PR_GET_TSC(0x43, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=@gettaction={0xf4, 0x32, 0x200, 0x70bd29, 0x25dfdbff, {}, [@action_gd=@TCA_ACT_TAB={0x38, 0x1, [{0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x58, 0x1, [{0x10, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x10, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x200}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xb8}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_gd=@TCA_ACT_TAB={0x4}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xc82}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x2}]}, 0xf4}, 0x1, 0x0, 0x0, 0x804}, 0x4080) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000500)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x854}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000027c0)={0x11, 0x4, &(0x7f0000000a40)=ANY=[@ANYBLOB="1801000000050000000000000000ea0485000000d000000095"], &(0x7f0000000a00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10) socketpair(0xf, 0x3, 0x2, &(0x7f00000001c0)) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) r4 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r4, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x282, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 0s ago: executing program 2 (id=9): openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0x100000001, 0x2202) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_open_dev$dri(0x0, 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) recvmmsg(r3, &(0x7f0000007dc0), 0x0, 0x1, &(0x7f0000007fc0)={0x0, 0x989680}) ioctl$DRM_IOCTL_MODE_CURSOR2(r4, 0xc02464bb, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x749}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) madvise(&(0x7f00008d7000/0x1000)=nil, 0x1000, 0x4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.251' (ED25519) to the list of known hosts. [ 76.771046][ T5806] cgroup: Unknown subsys name 'net' [ 76.867152][ T5806] cgroup: Unknown subsys name 'cpuset' [ 76.876594][ T5806] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 78.545966][ T5806] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 82.461592][ T5819] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.469944][ T5819] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.478273][ T5819] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.486635][ T5819] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.519901][ T5819] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.555025][ T5130] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 82.564131][ T5130] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 82.572173][ T5130] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 82.580603][ T5130] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 82.588474][ T5130] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 82.622285][ T5826] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 82.633048][ T5819] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 82.648056][ T5826] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 82.672655][ T5826] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 82.689736][ T5826] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 82.707339][ T55] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 82.717882][ T55] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 82.730965][ T55] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 82.740658][ T5130] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 82.748474][ T5130] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 82.772279][ T5130] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 82.783293][ T5130] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 82.801758][ T5130] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 82.842547][ T5130] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 82.851084][ T5130] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 83.196458][ T5816] chnl_net:caif_netlink_parms(): no params data found [ 83.426249][ T5820] chnl_net:caif_netlink_parms(): no params data found [ 83.467242][ T5828] chnl_net:caif_netlink_parms(): no params data found [ 83.484674][ T5816] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.492904][ T5816] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.501198][ T5816] bridge_slave_0: entered allmulticast mode [ 83.508513][ T5816] bridge_slave_0: entered promiscuous mode [ 83.517726][ T5816] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.525208][ T5816] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.532557][ T5816] bridge_slave_1: entered allmulticast mode [ 83.540146][ T5816] bridge_slave_1: entered promiscuous mode [ 83.648238][ T5816] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.691988][ T5816] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.715439][ T5824] chnl_net:caif_netlink_parms(): no params data found [ 83.814654][ T5816] team0: Port device team_slave_0 added [ 83.876213][ T5816] team0: Port device team_slave_1 added [ 83.901859][ T5820] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.909089][ T5820] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.916400][ T5820] bridge_slave_0: entered allmulticast mode [ 83.923797][ T5820] bridge_slave_0: entered promiscuous mode [ 84.018235][ T5820] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.026013][ T5820] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.033752][ T5820] bridge_slave_1: entered allmulticast mode [ 84.041466][ T5820] bridge_slave_1: entered promiscuous mode [ 84.055236][ T5816] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.062276][ T5816] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.088846][ T5816] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.101031][ T5828] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.108224][ T5828] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.115919][ T5828] bridge_slave_0: entered allmulticast mode [ 84.123394][ T5828] bridge_slave_0: entered promiscuous mode [ 84.156299][ T5831] chnl_net:caif_netlink_parms(): no params data found [ 84.167940][ T5816] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.175133][ T5816] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.201788][ T5816] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.213107][ T5828] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.220490][ T5828] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.227761][ T5828] bridge_slave_1: entered allmulticast mode [ 84.235146][ T5828] bridge_slave_1: entered promiscuous mode [ 84.242056][ T5824] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.249200][ T5824] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.256646][ T5824] bridge_slave_0: entered allmulticast mode [ 84.263915][ T5824] bridge_slave_0: entered promiscuous mode [ 84.316137][ T5824] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.324425][ T5824] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.333854][ T5824] bridge_slave_1: entered allmulticast mode [ 84.341747][ T5824] bridge_slave_1: entered promiscuous mode [ 84.353197][ T5820] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.431357][ T5820] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.464879][ T5828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.477513][ T5828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.492024][ T5824] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.504616][ T5824] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.586287][ T5820] team0: Port device team_slave_0 added [ 84.597025][ T5820] team0: Port device team_slave_1 added [ 84.603651][ T55] Bluetooth: hci0: command tx timeout [ 84.648141][ T5816] hsr_slave_0: entered promiscuous mode [ 84.654832][ T5816] hsr_slave_1: entered promiscuous mode [ 84.690913][ T5828] team0: Port device team_slave_0 added [ 84.693755][ T55] Bluetooth: hci1: command tx timeout [ 84.701984][ T5824] team0: Port device team_slave_0 added [ 84.706432][ T5824] team0: Port device team_slave_1 added [ 84.757752][ T5828] team0: Port device team_slave_1 added [ 84.763512][ T55] Bluetooth: hci2: command tx timeout [ 84.806211][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.813656][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.839620][ T55] Bluetooth: hci3: command tx timeout [ 84.845781][ T5820] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.859874][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.867096][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.874993][ T5831] bridge_slave_0: entered allmulticast mode [ 84.882952][ T5831] bridge_slave_0: entered promiscuous mode [ 84.903414][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.913257][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.939330][ T55] Bluetooth: hci4: command tx timeout [ 84.945256][ T5828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.957004][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.964481][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.990612][ T5824] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.002759][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.009866][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.036736][ T5820] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.055132][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.062479][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.071147][ T5831] bridge_slave_1: entered allmulticast mode [ 85.078385][ T5831] bridge_slave_1: entered promiscuous mode [ 85.093441][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.100592][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.126706][ T5828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.138281][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.145538][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.171849][ T5824] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.295338][ T5820] hsr_slave_0: entered promiscuous mode [ 85.303245][ T5820] hsr_slave_1: entered promiscuous mode [ 85.309581][ T5820] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.317338][ T5820] Cannot create hsr debugfs directory [ 85.353179][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.367509][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.417413][ T5824] hsr_slave_0: entered promiscuous mode [ 85.426252][ T5824] hsr_slave_1: entered promiscuous mode [ 85.433172][ T5824] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.441063][ T5824] Cannot create hsr debugfs directory [ 85.537419][ T5828] hsr_slave_0: entered promiscuous mode [ 85.544624][ T5828] hsr_slave_1: entered promiscuous mode [ 85.551854][ T5828] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.559649][ T5828] Cannot create hsr debugfs directory [ 85.567850][ T5831] team0: Port device team_slave_0 added [ 85.633017][ T5831] team0: Port device team_slave_1 added [ 85.756015][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.763207][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.789510][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.836496][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.843758][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.870303][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.054544][ T5831] hsr_slave_0: entered promiscuous mode [ 86.061273][ T5831] hsr_slave_1: entered promiscuous mode [ 86.067453][ T5831] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.075184][ T5831] Cannot create hsr debugfs directory [ 86.115135][ T5816] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.152140][ T5816] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.195317][ T5816] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.239117][ T5816] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.323552][ T5824] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 86.335030][ T5824] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 86.368651][ T5824] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 86.405992][ T5824] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 86.517885][ T5820] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 86.554642][ T5820] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 86.573552][ T5820] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 86.585331][ T5820] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 86.652363][ T5828] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 86.682810][ T55] Bluetooth: hci0: command tx timeout [ 86.695386][ T5828] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 86.707211][ T5828] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 86.725656][ T5816] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.736362][ T5828] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 86.760248][ T55] Bluetooth: hci1: command tx timeout [ 86.839779][ T55] Bluetooth: hci2: command tx timeout [ 86.898875][ T5816] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.919696][ T55] Bluetooth: hci3: command tx timeout [ 86.937239][ T5831] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 86.968389][ T5831] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 86.999622][ T55] Bluetooth: hci4: command tx timeout [ 87.018159][ T5824] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.030057][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.037395][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.055285][ T5831] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 87.097282][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.104529][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.123622][ T5831] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 87.182421][ T5824] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.215104][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.222484][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.257543][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.264725][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.378342][ T5820] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.418172][ T5828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.472880][ T5828] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.515464][ T5820] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.531653][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.538861][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.565894][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.573096][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.587157][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.594355][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.615987][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.623159][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.708745][ T5816] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.768227][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.863103][ T5831] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.935220][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.942466][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.988005][ T5824] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.020411][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.028032][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.078476][ T5816] veth0_vlan: entered promiscuous mode [ 88.136817][ T5816] veth1_vlan: entered promiscuous mode [ 88.184150][ T5824] veth0_vlan: entered promiscuous mode [ 88.213767][ T5820] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.258682][ T5831] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 88.275872][ T5816] veth0_macvtap: entered promiscuous mode [ 88.293328][ T5816] veth1_macvtap: entered promiscuous mode [ 88.314735][ T5824] veth1_vlan: entered promiscuous mode [ 88.395815][ T5816] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.434783][ T5816] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.474674][ T5816] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.485880][ T5816] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.495568][ T5816] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.505631][ T5816] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.532956][ T5824] veth0_macvtap: entered promiscuous mode [ 88.571920][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.587025][ T5820] veth0_vlan: entered promiscuous mode [ 88.594785][ T5824] veth1_macvtap: entered promiscuous mode [ 88.628029][ T5828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.675492][ T5820] veth1_vlan: entered promiscuous mode [ 88.722257][ T5824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.749081][ T5824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.759909][ T55] Bluetooth: hci0: command tx timeout [ 88.762063][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.826629][ T5824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.837393][ T5824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.840095][ T55] Bluetooth: hci1: command tx timeout [ 88.853480][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.868057][ T5824] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.877124][ T5824] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.886189][ T5824] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.897029][ T5824] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.919983][ T55] Bluetooth: hci2: command tx timeout [ 88.940083][ T3449] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.948026][ T3449] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.003929][ T55] Bluetooth: hci3: command tx timeout [ 89.012727][ T5828] veth0_vlan: entered promiscuous mode [ 89.053400][ T1001] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.056278][ T5820] veth0_macvtap: entered promiscuous mode [ 89.062970][ T1001] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.078556][ T5820] veth1_macvtap: entered promiscuous mode [ 89.080367][ T55] Bluetooth: hci4: command tx timeout [ 89.116176][ T5820] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.132330][ T5820] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.142348][ T5820] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.153876][ T5820] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.166485][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.202805][ T5820] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.224317][ T5820] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.235757][ T5820] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.249277][ T5820] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.261812][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.272236][ T5828] veth1_vlan: entered promiscuous mode [ 89.318399][ T5820] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.331633][ T5820] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.340457][ T5820] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.349167][ T5820] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.386561][ T5816] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 89.402873][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.422818][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.510060][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.517939][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.598745][ T5831] veth0_vlan: entered promiscuous mode [ 89.662761][ T5828] veth0_macvtap: entered promiscuous mode [ 89.682096][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.693045][ T5831] veth1_vlan: entered promiscuous mode [ 89.704042][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.730696][ T5828] veth1_macvtap: entered promiscuous mode [ 89.842737][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.875128][ T5828] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.887369][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.899468][ T5828] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.921116][ T5828] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.943363][ T5828] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.955466][ T5828] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.968825][ T5828] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.985181][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.062663][ T5828] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.101915][ T5828] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.132839][ T5828] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.150488][ T5828] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.167162][ T5828] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.211263][ T5828] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.450380][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.707485][ T5828] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.720202][ T5828] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.729079][ T5828] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.778428][ T5828] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.853856][ T5831] veth0_macvtap: entered promiscuous mode [ 90.922220][ T55] Bluetooth: hci1: command tx timeout [ 90.926201][ T5831] veth1_macvtap: entered promiscuous mode [ 90.999731][ T55] Bluetooth: hci2: command tx timeout [ 91.004548][ T5914] warning: `syz.3.6' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 91.080270][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 91.080310][ T55] Bluetooth: hci3: command tx timeout [ 91.220295][ T55] Bluetooth: hci4: command tx timeout [ 91.282965][ T9] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 769 [ 91.388669][ T9] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 91.401788][ T9] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 91.416461][ T9] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.99 [ 91.430936][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.491995][ T5912] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 91.569356][ T9] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 91.611350][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 91.623638][ T153] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.655886][ T9] usb 1-1: invalid MIDI in EP 0 [ 91.677933][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.687911][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 91.688563][ T153] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.698385][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.698418][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 91.698433][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.698444][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 91.698476][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.700552][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.898474][ T49] cfg80211: failed to load regulatory.db [ 91.927850][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 91.955654][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.998604][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.025519][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.049147][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.087490][ T9] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 92.106241][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.145760][ T5831] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.162907][ T5831] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.192712][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.209473][ T5831] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.218412][ T5831] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.238630][ T5831] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.289825][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 92.303576][ T5831] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.319858][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.328462][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.337094][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.752031][ T1001] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.807519][ T1001] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.837749][ T5922] Bluetooth: MGMT ver 1.23 [ 92.840113][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 92.920586][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 92.949878][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.959613][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 92.968135][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 92.994437][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.044572][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.155318][ T153] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.184686][ T153] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.283789][ T153] wlan1: Trigger new scan to find an IBSS to join [ 94.320154][ T153] ------------[ cut here ]------------ [ 94.329539][ T153] UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 [ 94.340023][ T153] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') [ 94.525264][ T153] CPU: 1 UID: 0 PID: 153 Comm: kworker/u8:5 Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0 PREEMPT(full) [ 94.525293][ T153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 94.525305][ T153] Workqueue: events_unbound cfg80211_wiphy_work [ 94.525351][ T153] Call Trace: [ 94.525359][ T153] [ 94.525370][ T153] dump_stack_lvl+0x189/0x250 [ 94.525409][ T153] ? __pfx_dump_stack_lvl+0x10/0x10 [ 94.525435][ T153] ? __pfx__printk+0x10/0x10 [ 94.525477][ T153] ubsan_epilogue+0xa/0x40 [ 94.525495][ T153] __ubsan_handle_out_of_bounds+0xe9/0xf0 [ 94.525525][ T153] ieee80211_request_ibss_scan+0x600/0x8b0 [ 94.525571][ T153] ieee80211_ibss_work+0xde7/0x1060 [ 94.525610][ T153] ? __pfx_ieee80211_ibss_work+0x10/0x10 [ 94.525651][ T153] ? ieee80211_iface_work+0xf39/0xfe0 [ 94.525673][ T153] ? rcu_is_watching+0x15/0xb0 [ 94.525705][ T153] cfg80211_wiphy_work+0x2dc/0x460 [ 94.525729][ T153] ? process_scheduled_works+0x9ec/0x17a0 [ 94.525759][ T153] process_scheduled_works+0xadb/0x17a0 [ 94.525816][ T153] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.525862][ T153] worker_thread+0x8a0/0xda0 [ 94.525893][ T153] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 94.525931][ T153] ? __kthread_parkme+0x7b/0x200 [ 94.525971][ T153] kthread+0x70e/0x8a0 [ 94.525994][ T153] ? __pfx_worker_thread+0x10/0x10 [ 94.526021][ T153] ? __pfx_kthread+0x10/0x10 [ 94.526042][ T153] ? __pfx_kthread+0x10/0x10 [ 94.526061][ T153] ? _raw_spin_unlock_irq+0x23/0x50 [ 94.526088][ T153] ? lockdep_hardirqs_on+0x9c/0x150 [ 94.526117][ T153] ? __pfx_kthread+0x10/0x10 [ 94.526136][ T153] ret_from_fork+0x4b/0x80 [ 94.526153][ T153] ? __pfx_kthread+0x10/0x10 [ 94.526172][ T153] ret_from_fork_asm+0x1a/0x30 [ 94.526216][ T153] [ 94.526241][ T153] ---[ end trace ]--- [ 94.842515][ T55] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 94.853245][ T55] Bluetooth: hci0: Injecting HCI hardware error event [ 94.861373][ T55] Bluetooth: hci0: hardware error 0x00 [ 94.894750][ T153] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 94.902104][ T153] CPU: 1 UID: 0 PID: 153 Comm: kworker/u8:5 Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0 PREEMPT(full) [ 94.914225][ T153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 94.924291][ T153] Workqueue: events_unbound cfg80211_wiphy_work [ 94.930566][ T153] Call Trace: [ 94.933864][ T153] [ 94.936807][ T153] dump_stack_lvl+0x99/0x250 [ 94.941412][ T153] ? __asan_memcpy+0x40/0x70 [ 94.946014][ T153] ? __pfx_dump_stack_lvl+0x10/0x10 [ 94.951237][ T153] ? __pfx__printk+0x10/0x10 [ 94.955874][ T153] panic+0x2db/0x790 [ 94.959786][ T153] ? __pfx_panic+0x10/0x10 [ 94.964208][ T153] ? _printk+0xcf/0x120 [ 94.968377][ T153] ? __pfx__printk+0x10/0x10 [ 94.972984][ T153] check_panic_on_warn+0x89/0xb0 [ 94.977929][ T153] __ubsan_handle_out_of_bounds+0xe9/0xf0 [ 94.983668][ T153] ieee80211_request_ibss_scan+0x600/0x8b0 [ 94.989536][ T153] ieee80211_ibss_work+0xde7/0x1060 [ 94.994809][ T153] ? __pfx_ieee80211_ibss_work+0x10/0x10 [ 95.000495][ T153] ? ieee80211_iface_work+0xf39/0xfe0 [ 95.005887][ T153] ? rcu_is_watching+0x15/0xb0 [ 95.010685][ T153] cfg80211_wiphy_work+0x2dc/0x460 [ 95.015809][ T153] ? process_scheduled_works+0x9ec/0x17a0 [ 95.021546][ T153] process_scheduled_works+0xadb/0x17a0 [ 95.027122][ T153] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.033125][ T153] worker_thread+0x8a0/0xda0 [ 95.037727][ T153] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 95.044082][ T153] ? __kthread_parkme+0x7b/0x200 [ 95.049045][ T153] kthread+0x70e/0x8a0 [ 95.053120][ T153] ? __pfx_worker_thread+0x10/0x10 [ 95.058247][ T153] ? __pfx_kthread+0x10/0x10 [ 95.062849][ T153] ? __pfx_kthread+0x10/0x10 [ 95.067442][ T153] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.072665][ T153] ? lockdep_hardirqs_on+0x9c/0x150 [ 95.077900][ T153] ? __pfx_kthread+0x10/0x10 [ 95.082500][ T153] ret_from_fork+0x4b/0x80 [ 95.086943][ T153] ? __pfx_kthread+0x10/0x10 [ 95.091553][ T153] ret_from_fork_asm+0x1a/0x30 [ 95.096375][ T153] [ 95.099671][ T153] Kernel Offset: disabled [ 95.104049][ T153] Rebooting in 86400 seconds..