Warning: Permanently added '10.128.1.120' (ED25519) to the list of known hosts. 1970/01/01 00:00:36 fuzzer started 1970/01/01 00:00:36 dialing manager at 10.128.0.163:30010 [ 36.843357][ T3972] cgroup: Unknown subsys name 'net' [ 36.908107][ T3974] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 37.126351][ T3972] cgroup: Unknown subsys name 'rlimit' 1970/01/01 00:00:37 starting 5 executor processes [ 37.895229][ T3989] chnl_net:caif_netlink_parms(): no params data found [ 37.921855][ T3988] chnl_net:caif_netlink_parms(): no params data found [ 37.949321][ T3989] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.951191][ T3989] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.953411][ T3989] device bridge_slave_0 entered promiscuous mode [ 37.959774][ T3989] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.961490][ T3989] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.963760][ T3989] device bridge_slave_1 entered promiscuous mode [ 37.982874][ T3989] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.991073][ T3989] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.003810][ T3988] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.005493][ T3988] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.007740][ T3988] device bridge_slave_0 entered promiscuous mode [ 38.015891][ T3988] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.017536][ T3988] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.019788][ T3988] device bridge_slave_1 entered promiscuous mode [ 38.029359][ T3989] team0: Port device team_slave_0 added [ 38.036859][ T3989] team0: Port device team_slave_1 added [ 38.039643][ T3988] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.044337][ T3988] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.069426][ T3989] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.071272][ T3989] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.077095][ T3989] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.082566][ T3988] team0: Port device team_slave_0 added [ 38.084485][ T3989] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.086047][ T3989] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.091963][ T3989] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.095837][ T3988] team0: Port device team_slave_1 added [ 38.112136][ T3988] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.113695][ T3988] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.119534][ T3988] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.129418][ T3988] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.131592][ T3988] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.137474][ T3988] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.202764][ T3989] device hsr_slave_0 entered promiscuous mode [ 38.240929][ T3989] device hsr_slave_1 entered promiscuous mode [ 38.342622][ T3988] device hsr_slave_0 entered promiscuous mode [ 38.410845][ T3988] device hsr_slave_1 entered promiscuous mode [ 38.440689][ T3988] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 38.442551][ T3988] Cannot create hsr debugfs directory [ 38.547360][ T3989] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.622674][ T3989] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.662482][ T3989] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.716380][ T3989] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.772529][ T3988] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 38.842458][ T3988] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 38.882771][ T3988] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 38.943156][ T3989] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.944911][ T3989] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.947093][ T3989] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.948777][ T3989] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.953128][ T4005] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.955655][ T4005] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.967377][ T3988] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 39.068321][ T3989] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.082369][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.085201][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.092727][ T3989] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.099493][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 39.102312][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.104465][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.106151][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.116697][ T3988] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.118807][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 39.121873][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.124095][ T4006] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.125744][ T4006] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.129996][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 39.138091][ T4007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 39.146542][ T4007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 39.149311][ T4007] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 39.152490][ T4007] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 39.160668][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.162848][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.165011][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 39.167440][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 39.173503][ T3988] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.179022][ T3989] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 39.184139][ T3989] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 39.188570][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 39.191688][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.194438][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 39.196755][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.199007][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 39.202193][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.205399][ T25] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.207066][ T25] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.219995][ T4007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 39.222376][ T4007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 39.224781][ T4007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 39.227234][ T4007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.229460][ T4007] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.231171][ T4007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.234018][ T4007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 39.236563][ T4007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 39.248791][ T3988] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 39.254326][ T3988] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 39.259133][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 39.261777][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 39.264120][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 39.267484][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 39.269882][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 39.277126][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.279574][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 39.282593][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.293412][ T3985] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 39.295574][ T3985] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 39.299048][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 39.300886][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 39.310406][ T3989] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.325789][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.328149][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.340700][ T3985] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.343363][ T3985] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.345868][ T3985] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.348121][ T3985] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.353189][ T3989] device veth0_vlan entered promiscuous mode [ 39.359386][ T3989] device veth1_vlan entered promiscuous mode [ 39.376580][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 39.378725][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 39.383583][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 39.385370][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 39.388885][ T3988] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.395140][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.397427][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.401262][ T3989] device veth0_macvtap entered promiscuous mode [ 39.406631][ T3989] device veth1_macvtap entered promiscuous mode [ 39.422224][ T3989] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.424112][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 39.426384][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.428668][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.431496][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.433720][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.435930][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.445308][ T3989] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.447637][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.450034][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.457426][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.459717][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.463836][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.465893][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.468460][ T3988] device veth0_vlan entered promiscuous mode [ 39.471802][ T3989] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.473882][ T3989] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.475845][ T3989] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.477805][ T3989] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.491142][ T3988] device veth1_vlan entered promiscuous mode [ 39.536478][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 39.538765][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 39.541015][ T365] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.542970][ T365] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.547161][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 39.549304][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.552690][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.558142][ T3988] device veth0_macvtap entered promiscuous mode [ 39.569936][ T3988] device veth1_macvtap entered promiscuous mode [ 39.576283][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.578202][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.583469][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 39.585685][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.587923][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 39.591347][ T3988] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 39.593798][ T3988] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 39.596982][ T3988] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.600458][ T3988] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 39.603471][ T3988] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 39.606613][ T3988] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.608560][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.612198][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.614626][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.616906][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.622903][ T3988] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.624851][ T3988] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.626870][ T3988] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.628966][ T3988] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 executing program 0: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000380), 0x1, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, 0x0, 0x0) [ 39.714194][ T136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.716194][ T136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.718717][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 39.739237][ T365] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.741758][ T365] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.744694][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready executing program 1: r0 = socket$unix(0x1, 0x200000000001, 0x0) ioctl$sock_SIOCADDDLCI(r0, 0x5411, 0x0) [ 39.780977][ T4005] Bluetooth: hci0: command 0x0409 tx timeout [ 39.782602][ T4005] Bluetooth: hci1: command 0x0409 tx timeout executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000100)=0xcf5) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) ppoll(&(0x7f0000000140)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000003c0)=0x13) [ 40.074505][ T4031] chnl_net:caif_netlink_parms(): no params data found [ 40.133834][ T4031] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.135575][ T4031] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.137999][ T4031] device bridge_slave_0 entered promiscuous mode [ 40.158481][ T4031] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.160006][ T4031] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.162919][ T4031] device bridge_slave_1 entered promiscuous mode [ 40.216949][ T4031] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.221636][ T4031] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.238101][ T4034] chnl_net:caif_netlink_parms(): no params data found [ 40.246206][ T4031] team0: Port device team_slave_0 added [ 40.253077][ T4031] team0: Port device team_slave_1 added [ 40.255014][ T4027] chnl_net:caif_netlink_parms(): no params data found [ 40.294729][ T4031] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.296322][ T4031] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.302450][ T4031] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.311082][ T4031] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.312849][ T4031] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.318860][ T4031] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.345853][ T4034] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.347517][ T4034] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.349822][ T4034] device bridge_slave_0 entered promiscuous mode [ 40.372612][ T4034] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.374475][ T4034] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.377778][ T4034] device bridge_slave_1 entered promiscuous mode [ 40.452545][ T4031] device hsr_slave_0 entered promiscuous mode [ 40.501079][ T4031] device hsr_slave_1 entered promiscuous mode [ 40.540720][ T4031] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 40.542603][ T4031] Cannot create hsr debugfs directory [ 40.544044][ T4027] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.545757][ T4027] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.548146][ T4027] device bridge_slave_0 entered promiscuous mode [ 40.554828][ T4034] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.565397][ T4027] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.567073][ T4027] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.569290][ T4027] device bridge_slave_1 entered promiscuous mode [ 40.575460][ T4034] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.615859][ T4027] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.629501][ T4027] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.638757][ T4034] team0: Port device team_slave_0 added [ 40.643853][ T4034] team0: Port device team_slave_1 added [ 40.671209][ T4034] batman_adv: batadv0: Adding interface: batadv_slave_0 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000002340)='comm\x00') ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0x5450, 0x0) executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) dup3(r0, r1, 0x0) flock(r1, 0x1) [ 40.673009][ T4034] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.680318][ T4034] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.714112][ T4027] team0: Port device team_slave_0 added [ 40.716577][ T4034] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.718206][ T4034] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fcntl$setownex(r1, 0xf, &(0x7f0000000440)) [ 40.744308][ T4034] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.754664][ T4027] team0: Port device team_slave_1 added executing program 0: pipe2(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r1, r0, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, 0x0, 0x0) [ 40.804490][ T4027] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.806080][ T4027] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.818017][ T4027] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active executing program 0: r0 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x5451, 0x0) [ 40.844912][ T4027] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.846521][ T4027] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000140)='./file0\x00') readlinkat(r1, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=""/174, 0xae) [ 40.876518][ T4027] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.952972][ T4034] device hsr_slave_0 entered promiscuous mode [ 40.991171][ T4034] device hsr_slave_1 entered promiscuous mode [ 41.030817][ T4034] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 41.032704][ T4034] Cannot create hsr debugfs directory [ 41.093285][ T4027] device hsr_slave_0 entered promiscuous mode [ 41.130964][ T4027] device hsr_slave_1 entered promiscuous mode [ 41.190671][ T4027] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 41.192566][ T4027] Cannot create hsr debugfs directory [ 41.242313][ T4031] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 41.292822][ T4031] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 41.361552][ T4031] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 41.412578][ T4031] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 41.573797][ T4034] netdevsim netdevsim3 netdevsim0: renamed from eth0 executing program 1: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r0, 0x5452, &(0x7f0000000080)) [ 41.615608][ T4034] netdevsim netdevsim3 netdevsim1: renamed from eth1 executing program 1: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_unix(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x2010c0, 0x0) r0 = syz_mount_image$fuse(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x44010, &(0x7f0000000600)=ANY=[], 0x1, 0x0, 0x0) write$binfmt_script(r0, 0x0, 0x0) [ 41.653400][ T4034] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 41.666417][ T4070] ======================================================= [ 41.666417][ T4070] WARNING: The mand mount option has been deprecated and [ 41.666417][ T4070] and is ignored by this kernel. Remove the mand [ 41.666417][ T4070] option from the mount to silence this warning. [ 41.666417][ T4070] ======================================================= executing program 1: pipe2$9p(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x5421, &(0x7f0000000040)) [ 41.702024][ T4034] netdevsim netdevsim3 netdevsim3: renamed from eth3 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000028c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup3(r1, r0, 0x0) recvmmsg$unix(r2, &(0x7f0000001dc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}}], 0x1, 0x0, 0x0) sched_setaffinity(r3, 0x8, &(0x7f00000001c0)=0x1) executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmmsg$unix(r0, &(0x7f0000000200)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000040c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}], 0x1, 0x0, 0x0) write$eventfd(r1, 0x0, 0x0) [ 41.762782][ T4027] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 41.803644][ T4027] netdevsim netdevsim4 netdevsim1: renamed from eth1 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000002140)={0xffffffffffffffff}) recvmmsg$unix(r0, 0x0, 0x0, 0x2040, 0x0) [ 41.834958][ T4027] netdevsim netdevsim4 netdevsim2: renamed from eth2 executing program 1: r0 = openat$tcp_mem(0xffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5451, 0x0) [ 41.861124][ T1529] Bluetooth: hci0: command 0x041b tx timeout [ 41.861429][ T4006] Bluetooth: hci1: command 0x041b tx timeout [ 41.874588][ T4027] netdevsim netdevsim4 netdevsim3: renamed from eth3 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = signalfd4(0xffffffffffffffff, &(0x7f00000005c0), 0x8, 0x0) dup3(r0, r1, 0x0) readv(r1, 0x0, 0x0) executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_FIOGETOWN(r0, 0x5411, 0x0) [ 41.923872][ T4031] 8021q: adding VLAN 0 to HW filter on device bond0 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname(r0, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, &(0x7f0000000080)=0x6b) write$P9_RLERROR(r1, 0x0, 0x0) [ 41.950846][ T4006] Bluetooth: hci3: command 0x0409 tx timeout [ 41.954004][ T4006] Bluetooth: hci2: command 0x0409 tx timeout [ 41.979561][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 41.982209][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready executing program 1: r0 = memfd_create(&(0x7f0000000640)='\x00\xac=W[[\x87\x12\x04\xd5\xbc\x80K\x06\xcd]4(\xa2\xee2>\xa1\x9c\x86x\x1c\x9f\x97\x87\xd9c\xecR\xd6\xe8\xf3Y\x121p^\xc1\x0f\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00M\xc2N%\x93t[\xf3\xee\xa4\xb4\xfbf\x8dz7\\\x8e\xac\x18\x00\xfd\x89\xe1d\xfa\xcfb\xf3\xdc\xd4CY\x9a\xef\xa3\\\xa7\xa9^\xafL:[\x8e\x83U\xff\xfd\xb0\xfa\xdaL\xa99\x9b\xcfA\xe4n\xa0^\n\x1c\x84\x04\xc5a\xdf\xe5\xd4Hyn\xba:/\xa5\xf4\xaa\xfa\xcd\xc7T\x83\xf5N^\xf2n\xd0=\xb9\t\xdd-F\xacb\xac \xd3\xccj\x13\xa2\x9fLu\'\xed\x91\x867\xaa\xf5\xa0]\xb6\xaa\xea\xfd\xde\xa6\xec\b\x16\x86l:;\xf9\xdb\xcf\x88\"\xca\xe0E\xdb\xec\xf9\xb3\xed\a\x00\x00\x00\x00\x00\x00\x00\xd6.\xf7\x92\xc42\xdf\xefE\xce}\x1b\xda\xdd?\n6\xe1\xb1\xd8Y\x960\xd1\x00\x00\x00\x00\x00\x00MW\x8f\xc6\x82\xe4\x15\xf7\xe9\xd8\xc5b\x0e\x91\xc5\xc76$\x18\xa4\xbe\xe8V\x8d-\xe3\x8fC\xd5\xf5\xd6L\xe3\xce\xa1\x8dz\xce\xa7\xa5\xc8\xcbhM\x1b\xf8\x98\xc4\xfbD6\x88\xfd\xe5i\x8a\xd8\xcfm\x81Z\x19\xf0\xef\xc15\xe8\xcb\xf5\t\t\x00\x17\xfa\x1fqb\xe7\"\xcb4\xb8\xe5/\xd52\x17\x12\x1d\xd8\x87\xb9|\x8d\x83\xea\xcc\x94\xebZ\xae\xaf\x19\xa4\xb2\xc6\xe1\x926B\xb6\x89Z\xa9\xb5/\xbb\x9d&\xeeO\xb3\xb3\xd4\b`\xa9f\x84\xad\t\x1a\xc2\xd5\x88\xbfo\x80V\x93\x9fX\xd7\xff\x03\xb7J\xed\x183\xe3\x7f\xfaq,\xca\x06\xb0\xc9\x92\x93\xa5I\x89\xb7\x85\x90\xb7\x1b0\xce\xd7!\x8fD\x96\xe1 ^>\x9f\x04\x89<\xb7S\x7f\x1a\x88\xab$\xd3y\xc2\xe1\x99\xbch\xd3\x83\xcd\x7f\xc5n\xb1\xc1X \xe2\xbb\x1f\x01\x90\xb1O\x8d\x7f\xa8\xd4\xdbO\xef\x99\xf3\xd3M\x0f\t\x7f\n,\x84\x1f\xfa\xe2\xc8\x99\x97Oq\xae\x9b\x86h\xfa3\xb9\xfd\xbb\xd4^\xc0t\xa7]Y\xe9\x7f[\x11\xb1\xf3m\x17F\x9d\x18\xe2\xe1\x01\xb6f=-?\xbcI\xf2\xd9\xc4>-\xc0E\x9a\x82\xcc7S\xd4\xb6\'\xd2DY\xa5\x83,\xd1\xbc\xc7\xf6\xe0\x1f o\x06\xc2t\x14\xc2\xe0\x92\xc1\x8a\x85>@\xc9\xb0% \xc7\x13l\x8bJ\xe5\xec\x1dE\xf5\xc5\xe2\xe3\x10G7r#\xbc\x95&\x14\x1e\x97\xce\x83>Q@\xfb\xeb=\x1e\xb3\xd5H\x02\x86\xc6\xf3\xe1i\\\x1d\xf4\xc1\xacJC+\xc8}\x1b{\x86\x17\x00\n\"\xec\xa5x\xe6\xb1i\xeb\xb3\xb7I\x90\x9eai\xde\x01\xdc\xfeA\x05Sn\xe6\xe8^\xdf\x8c`\x17\xca\xbd\\QG\xb15\x82*=\xbd\xe9\xaf\x12<\xd7\xe1$\xa4\xdaU\xfb^\xd8!\xacxy\xd5X\xef\x03\xa7\x10\xa1C#S~\x0f\x17\t>X\\mv0\x9eZ\x89\xf4\xae\a\xc8\x16\xd2t\x16\xf3X%Q\xbd\xe9\x86V\xf2\x99^0\xe8xI(\xde-\x04s\x15\x06#2\xef\xef@\xa3t0d^^\xad\xf6\xad\xe0\x16\xf6\xa8\x99!\x0e\x9d+;D&\xebN\x94\x12\x04\x95o\xd6\x9fl\xcb\x16gc\xf5(\xaa_\xec\x9aiE\f\xd4\xc6\xf2\xae\x85n\x995\xcd\xa7\xbb\xf0pz\xaf\tC\x1cq\xaa\x92,Li\r\x95Z\x89\"\xaf]\x95\xb9b_\xe4\xba\xd4\x93\xab\xe1\xb9\xd8E[\xbb\xc9.M+\xbe\x81N\xd2\xae\xf4\x18\xd0\xe7\x98\x90,\xce\ft\xc4\xc7\x02\xaa\xc7\xeb1;\x86b\x8f\x12{k#c\x1d@\xc31\x00\xd2}f\x8cX\xce\xed\xa4\xe4\xca`<_}\'\xce\x81\xb3O\xae\xa1\xbfwcN,\xf2#\x16\xc4\xad\a&\xb1U\x83w\xd0K\xaa\xdf\x84\xe5\xe4\xdb\xa3G(\x7fv\x93\xb8m\x96\xd89Kb\xa9\x852\xb9\xcaG\x8b\x11\x16\x16\xeeI\x14\xcb\xe4\x9a\x1e\xb6^\xa3\xaa^\xdc\xcfo\xfb\xd6<\xa2\xc6\xbdj\xc4\xb1B\xf3S}\xfeI\xe2e\xec}o\xcfB\xa6\x877\'\x80\x82\t\xec\xc1&\xb0\xa9\x82&\xb8XQ8M@\xaa\x1f\vj\x9aW\xec\x92\x19\xdb^\x9d\x94\x87-&\x00/z\xa2\xd7\x01\\\t\xae~\xed\no\x1a\x9cKG^+\xc9\xe0v\xc0\x96\xc4\xcc\xb7\xdd\xdf\xf9\x01\x91\xe5\to[\x97\xbe\x110\x93\x14\xf8\x8a\x8d\xeb\t\xe7?/C\xaa\xd9\xc4\xc9\xbe\x12\xed\xb3*f\xd1J\x14\x80Iy4\xa9\xf88C\xe3\x0f\xb7Z\x83&\xecX\xca\xe6Oy\xd2)\xef\x9dH\xa3[\xc0\x94\x9b\x04\x9f\xf3\xf5\n\xf9zw\xd3\xa9\x13%\xc4\xc9\xfa\xd7\xbf\xfa\x1fP\x91_\x8f\xeb)\x7f;\xa5\xef\xc08\xf1\xe0\x87G\xdf\\\xb8\xba,\x8a\x1dU\xb6\x8d\xacl\x8bZ\xd7\xb7h\'2`\x05|\v\xbe\x04&\a8y\xe8\xab\xebFI\xd2$\xf7\x11\x9d\x81\xdb\x1c|\"F\xf6\xcf\x8e\xf8 w\xe9\xdam\x86\xb7\xa76\xf2%W\xd3\x8c\xa8\xd1\x15', 0x0) write(r0, &(0x7f0000000140)='/', 0x1) sendfile(r0, r0, &(0x7f0000001000), 0x101) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x100000c, 0x11, r0, 0x0) mount$9p_tcp(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x1041484, 0x0) [ 42.007871][ T4031] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.022485][ T4005] Bluetooth: hci4: command 0x0409 tx timeout [ 42.047544][ T4034] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.052982][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.055343][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.057430][ T1529] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.059084][ T1529] bridge0: port 1(bridge_slave_0) entered forwarding state executing program 1: r0 = socket$unix(0x1, 0x2, 0x0) recvmmsg$unix(r0, &(0x7f0000004bc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004640)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}], 0x1, 0x0, 0x0) ioctl$TIOCPKT(r1, 0x5452, &(0x7f0000000080)) [ 42.093824][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 42.095971][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.098236][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.100347][ T25] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.102105][ T25] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.106906][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 42.109540][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 42.132435][ T4027] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.135705][ T4034] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.138570][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 42.142459][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.145130][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.147469][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.149915][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 42.153055][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.156053][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 42.172239][ T4027] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.179071][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.181690][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.183909][ T4005] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.185486][ T4005] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.187489][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.189817][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.193250][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.195703][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.198105][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.200749][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.203448][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.206055][ T4005] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.208510][ T4005] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.210231][ T4005] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.219726][ T4031] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 42.240202][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 42.243496][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 42.245642][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.247907][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.250081][ T4006] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.251755][ T4006] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.254234][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 42.256746][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.259015][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.261331][ T4006] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.262972][ T4006] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.265204][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 42.267740][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 42.270136][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 42.299264][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 42.302005][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.304363][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 42.306717][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.309079][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 42.313071][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.315718][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 42.318465][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.322978][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.325559][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.328038][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.331553][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.338085][ T4027] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 42.345762][ T4027] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 42.349052][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 42.351920][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 42.354560][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.357160][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.359753][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.363294][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.367146][ T4034] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 42.439702][ T4008] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 42.441847][ T4008] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 42.463192][ T4031] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.476725][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 42.479294][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 42.503479][ T4034] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.506592][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 42.508462][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 42.520648][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 42.522865][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 42.525337][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 42.527738][ T4006] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 42.536101][ T4031] device veth0_vlan entered promiscuous mode [ 42.550110][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 42.554429][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 42.564781][ T4008] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 42.567140][ T4008] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 42.578226][ T4027] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.581650][ T4031] device veth1_vlan entered promiscuous mode [ 42.593718][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 42.595934][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 42.598112][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 42.613050][ T4034] device veth0_vlan entered promiscuous mode [ 42.623069][ T4034] device veth1_vlan entered promiscuous mode [ 42.626614][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 42.628783][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 42.632145][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 42.634251][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready executing program 0: r0 = timerfd_create(0x0, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8902, &(0x7f0000000080)) [ 42.649984][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 42.652658][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 42.654831][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 42.674826][ T4031] device veth0_macvtap entered promiscuous mode [ 42.691874][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 42.694259][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 42.697302][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 42.702341][ T4031] device veth1_macvtap entered promiscuous mode [ 42.708593][ T4034] device veth0_macvtap entered promiscuous mode executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000880), 0x8, 0x0) ioctl$INOTIFY_IOC_SETNEXTWD(r0, 0x5451, 0x0) [ 42.723745][ T4034] device veth1_macvtap entered promiscuous mode [ 42.739838][ T4031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 42.750848][ T4031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 42.753109][ T4031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 42.755623][ T4031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 42.763430][ T4031] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.767669][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 42.769794][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 42.772608][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 42.778178][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 42.780496][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 42.788188][ T4034] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 42.791458][ T4034] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 42.793729][ T4034] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 42.797399][ T4034] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 42.799652][ T4034] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 42.803331][ T4034] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 42.806914][ T4034] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.810317][ T4031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 executing program 0: r0 = msgget$private(0x0, 0x0) msgrcv(r0, 0x0, 0x0, 0x0, 0x0) msgctl$IPC_RMID(r0, 0x0) syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0) mlockall(0x1) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='stat\x00') statx(r1, &(0x7f0000000080)='.\x00', 0x0, 0x0, 0x0) [ 42.814353][ T4031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 42.816558][ T4031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 42.818908][ T4031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 42.827266][ T4031] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.831564][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 42.834161][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 42.837816][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 42.840110][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 42.846815][ T4034] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 42.849710][ T4034] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 42.852683][ T4034] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 42.854987][ T4034] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 42.857165][ T4034] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 42.859522][ T4034] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 42.865216][ T4034] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.869439][ T4031] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.874078][ T4031] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.876133][ T4031] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.878047][ T4031] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.883610][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 42.886023][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 42.891768][ T4034] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.893697][ T4034] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.895679][ T4034] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.897561][ T4034] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 executing program 1: r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TCXONC(r0, 0x5450, 0x0) [ 42.984617][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.986422][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.989168][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 43.040802][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSERGETLSR(r0, 0x5451, 0x0) [ 43.043166][ T4090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.053338][ T1359] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.055306][ T1359] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.057990][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 43.079312][ T1359] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.084376][ T1359] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.092733][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready executing program 2: r0 = syz_open_procfs$userns(0x0, &(0x7f0000000040)) ioctl$TIOCL_GETKMSGREDIRECT(r0, 0x5451, 0x0) [ 43.111774][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 43.114198][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.116647][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 43.118840][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 43.132086][ T365] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.134038][ T365] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.137201][ T4027] device veth0_vlan entered promiscuous mode [ 43.157251][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready executing program 2: r0 = mq_open(&(0x7f0000000140)='!}+^{\x00', 0x40, 0x0, 0x0) ioctl$TIOCSCTTY(r0, 0x5450, 0x0) [ 43.196301][ T4027] device veth1_vlan entered promiscuous mode executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getpeername(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, &(0x7f0000000000)=0x80) ioctl$F2FS_IOC_RESIZE_FS(r1, 0x5452, &(0x7f0000000080)) executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x2140, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x5452, &(0x7f0000000000)={'ip6tnl0\x00', {0x2, 0x0, @loopback}}) [ 43.246277][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 43.248703][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready executing program 2: pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) dup3(r1, r0, 0x0) getsockname$netlink(r0, 0x0, &(0x7f0000000540)) [ 43.263643][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 43.266044][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.281861][ T4027] device veth0_macvtap entered promiscuous mode executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x5421, &(0x7f0000000040)) executing program 1: r0 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KDGETLED(r0, 0x5451, 0x0) [ 43.298455][ T4027] device veth1_macvtap entered promiscuous mode [ 43.337532][ T4027] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 43.347502][ T4027] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.355668][ T4027] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 executing program 2: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$cgroup_type(r0, &(0x7f0000000000), 0x2, 0x0) executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000047c0)={0xffffffffffffffff}) write$P9_RREAD(r0, 0x0, 0x0) [ 43.364213][ T4027] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.370288][ T4027] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$TIOCMGET(r1, 0x5451, 0x0) [ 43.402952][ T4027] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.408765][ T4027] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 43.413721][ T4027] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.429462][ T4027] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 43.441579][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 43.444013][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 43.446278][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.454029][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready executing program 3: r0 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$sock_SIOCDELDLCI(r0, 0x5451, 0x0) [ 43.465893][ T4027] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 43.475663][ T4027] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.484658][ T4027] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 43.493085][ T4027] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x2040, 0x0) read$char_usb(r0, 0x0, 0x0) [ 43.500317][ T4027] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 43.508275][ T4027] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.516363][ T4027] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 43.525852][ T4027] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$eventfd(r1, 0x0, 0x0) [ 43.537366][ T4027] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 43.553181][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 43.555674][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.569191][ T4027] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.577381][ T4027] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 executing program 2: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) ioctl$KDSIGACCEPT(r0, 0x5421, 0x2081004b) [ 43.584159][ T4027] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.593471][ T4027] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/uts\x00') ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r0, 0x5451, 0x0) executing program 2: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$BTRFS_IOC_DEV_REPLACE(r0, 0x5450, 0x0) executing program 3: r0 = openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) read$eventfd(r0, 0x0, 0x0) [ 43.734026][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.735964][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.738731][ T1529] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready executing program 2: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000002440), 0x8, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 43.780024][ T148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.789315][ T148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.793968][ T4091] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)=0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x40) executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$binfmt_script(r0, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x4004662b, &(0x7f0000000240)={0x1, 0x0, 0x103e, 0x0, 0x0, 0x0, 0x0, 0x0}) fsync(r0) executing program 2: r0 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000002a00)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) write$P9_RXATTRWALK(r0, 0x0, 0x0) executing program 3: pipe2(&(0x7f0000001580)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x541b, 0x0) [ 43.941881][ T4005] Bluetooth: hci1: command 0x040f tx timeout [ 43.943376][ T4005] Bluetooth: hci0: command 0x040f tx timeout executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSTI(r0, 0x5450, 0x0) [ 44.031297][ T4006] Bluetooth: hci2: command 0x041b tx timeout [ 44.033532][ T4006] Bluetooth: hci3: command 0x041b tx timeout executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmsg(r0, &(0x7f00000004c0)={&(0x7f0000000200)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, 0x0}, 0x0) ioctl$sock_SIOCGSKNS(r1, 0x5450, 0x0) executing program 2: r0 = socket(0x1, 0x80003, 0x0) recvmsg$inet_nvme(r0, &(0x7f0000000380)={&(0x7f0000000180)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, 0x80, 0x0}, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE(r1, 0x5450, 0x0) executing program 3: r0 = eventfd2(0x0, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/devices/virtual', 0x0, 0x0) dup3(r0, r1, 0x0) write$P9_RATTACH(r1, &(0x7f0000000000)={0x14}, 0x14) [ 44.101080][ T4006] Bluetooth: hci4: command 0x041b tx timeout executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5451, 0x0) executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0x541b, &(0x7f0000000040)={0xffffffffffffffff}) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg$unix(r2, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}], 0x1, 0x0, 0x0) getpeername$netlink(r3, 0x0, &(0x7f00000000c0)) executing program 0: timer_create(0x0, &(0x7f0000000080)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r1 = dup(r0) write$FUSE_WRITE(r1, &(0x7f0000000100)={0xfffffeec}, 0xffffffd1) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50}, 0x50) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000140)=0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) timer_settime(r2, 0x1, &(0x7f0000000200)={{0x0, 0x3938700}, {r3, r4+60000000}}, 0x0) close(r1) timerfd_create(0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x3938700}, {0x0, 0x9}}, 0x0) executing program 1: r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/class/dmi', 0x0, 0x0) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r0, 0x5450, 0x0) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.self_freezing\x00', 0x275a, 0x0) r1 = ioctl$NS_GET_PARENT(r0, 0x5450, 0x0) ioctl$FIGETBSZ(r1, 0x8901, &(0x7f0000000080)) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000200)='pids.events\x00', 0x26e1, 0x0) r2 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) dup3(r2, r1, 0x0) getdents64(r1, &(0x7f0000000240)=""/237, 0xed) executing program 0: shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil) r0 = semget$private(0x0, 0x3, 0x388) shmctl$IPC_SET(r0, 0x1, &(0x7f0000000240)={{0x0}}) executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname(r0, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, &(0x7f0000000080)=0x6b) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x5421, &(0x7f0000000040)) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$binfmt_script(r0, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x4004662b, &(0x7f0000000240)={0x1, 0x0, 0x103e, 0x0, 0x0, 0x0, 0x0, 0x0}) fsync(r0) executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') ioctl$BTRFS_IOC_SCRUB(r0, 0x5451, 0x0) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='freezer.state\x00', 0x275a, 0x0) ioctl$VT_RELDISP(r0, 0x5450) executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg$unix(r0, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}], 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) openat$cgroup_subtree(r1, &(0x7f0000000000), 0x2, 0x0) executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='oom_score_adj\x00') fcntl$F_GET_RW_HINT(r0, 0xf, &(0x7f00000000c0)) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200c0, 0x0) ioctl$TIOCL_GETKMSGREDIRECT(r0, 0x5451, 0x0) executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/custom1\x00', 0x2, 0x0) write$eventfd(r0, 0x0, 0x0) executing program 1: r0 = socket$unix(0x1, 0x2, 0x0) write$P9_RSTATFS(r0, 0x0, 0x0) executing program 1: pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)=0x0) getpgid(r1) executing program 1: r0 = socket(0x1, 0x1, 0x0) ioctl$TIOCGRS485(r0, 0x5451, 0x0) executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername(r0, &(0x7f00000015c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f0000001640)=0x80) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r1, 0x8901, &(0x7f00000001c0)) executing program 1: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x5452, &(0x7f0000000080)={'syzkaller1\x00', {0x2, 0x0, @initdev}}) executing program 2: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$TCSETSW2(r0, 0x5452, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "5d9126f5f5208640ca4248ff0100"}) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$binfmt_script(r0, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x4004662b, &(0x7f0000000240)={0x1, 0x0, 0x103e, 0x0, 0x0, 0x0, 0x0, 0x0}) fsync(r0) executing program 4: r0 = eventfd2(0x0, 0x0) r1 = memfd_create(&(0x7f0000000240)='\xd2$#\x00', 0x3) dup3(r1, r0, 0x0) fcntl$addseals(r0, 0x409, 0x0) executing program 2: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = dup3(r1, r0, 0x0) sendmmsg(r2, 0x0, 0x0, 0x0) executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$GIO_FONT(r0, 0x8904, &(0x7f0000000080)=""/109) executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup3(r0, r1, 0x0) write$P9_RSTATFS(r2, 0x0, 0x0) executing program 3: socketpair(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_INIT(r0, 0x0, 0x0) read(r1, 0x0, 0x0) executing program 4: r0 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000002f80)) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r1, 0x5450, 0x0) executing program 4: pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0xb82e336200000000) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8904, &(0x7f0000000200)) executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) read$char_usb(r0, 0x0, 0x0) executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$AUTOFS_IOC_FAIL(r0, 0x5451, 0x0) executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000040), 0x8, 0x0) ioctl$TIOCSPGRP(r0, 0x5451, 0x0) executing program 4: r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x5450, 0x0) executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x5450, 0x0) executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='cpuacct.usage_user\x00', 0x275a, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x5451, 0x0) executing program 4: fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) write$tcp_congestion(r0, 0x0, 0x0) executing program 2: pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) fcntl$setpipe(r0, 0xf, 0x0) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$binfmt_script(r0, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x4004662b, &(0x7f0000000240)={0x1, 0x0, 0x103e, 0x0, 0x0, 0x0, 0x0, 0x0}) fsync(r0) executing program 0: timer_create(0x1, 0x0, &(0x7f0000000180)) [ 45.547159][ T4267] Zero length message leads to an empty skb executing program 4: r0 = socket$unix(0x1, 0x5, 0x0) setsockopt$sock_linger(r0, 0xffff, 0x80, &(0x7f0000000140), 0x0) executing program 2: pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0xb82e336200000000) ioctl$TIOCGDEV(r0, 0x5450, 0x0) executing program 0: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$TIOCGWINSZ(r0, 0x5450, 0x0) executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) setsockopt(r1, 0x1, 0x20, &(0x7f0000000340)="b5057018", 0x4) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) getpeername(r0, &(0x7f0000000200)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, &(0x7f0000008540)=0x80) close(r1) socket$unix(0x1, 0x1, 0x0) getsockname(r1, 0x0, &(0x7f0000000000)) executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xd) r0 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) write$P9_RREAD(r0, &(0x7f0000000040)={0xb}, 0xb) executing program 0: r0 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r1, r0, 0x0) getsockopt$sock_int(r0, 0x1, 0x4, &(0x7f0000000000), &(0x7f0000000080)=0x4) executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) setsockopt$sock_timeval(r0, 0x1, 0x43, &(0x7f0000000040), 0x0) executing program 4: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$VT_RELDISP(r0, 0x5450) executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000580)='./binderfs/binder-control\x00', 0x802, 0x0) write$P9_RATTACH(r0, 0x0, 0x0) executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETS2(r0, 0x8901, &(0x7f0000000600)={0xfffffffc, 0x0, 0x0, 0x0, 0x0, "5158374a6938200572f9680de7b02efd773230"}) executing program 4: pipe2(&(0x7f0000001140)={0xffffffffffffffff}, 0x0) ioctl$RNDADDENTROPY(r0, 0x8902, &(0x7f00000000c0)={0x2}) executing program 0: r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000001040), 0x1, 0x0) ioctl$NS_GET_USERNS(r0, 0x5450, 0x0) executing program 2: socketpair$unix(0x1, 0x200000005, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000003b40)=[{{&(0x7f0000002d80)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000040)) executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.pending_reads\x00', 0x22241, 0x0) write$P9_RWALK(r0, 0x0, 0x0) [ 46.030724][ T13] Bluetooth: hci0: command 0x0419 tx timeout [ 46.032458][ T13] Bluetooth: hci1: command 0x0419 tx timeout executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200) openat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x8) executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername(r0, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, &(0x7f0000000340)=0x80) ioctl$AUTOFS_IOC_EXPIRE(r1, 0x5451, 0x0) executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) ioctl$TIOCSLCKTRMIOS(r0, 0x541b, 0x0) executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f00000003c0), 0x8, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x5452, &(0x7f0000000040)=@generic) [ 46.101420][ T13] Bluetooth: hci3: command 0x040f tx timeout [ 46.103057][ T13] Bluetooth: hci2: command 0x040f tx timeout executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) read(r0, 0x0, 0x0) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f00000000c0)=0x80) write$eventfd(r1, 0x0, 0x0) executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname(r1, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, &(0x7f0000000000)=0x80) dup3(r0, r2, 0x0) setsockopt$sock_int(r2, 0x1, 0x0, 0x0, 0x0) [ 46.199726][ T13] Bluetooth: hci4: command 0x040f tx timeout executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) ioctl$TIOCGICOUNT(r0, 0x5450, 0x0) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) recvmsg(r0, &(0x7f0000000140)={&(0x7f0000000180)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, 0x0}, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r1, 0x5451, 0x0) executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pread64(r0, &(0x7f0000000080)=""/54, 0x36, 0x0) executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000080)) executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VT_OPENQRY(r0, 0x5451, 0x0) executing program 4: r0 = socket$unix(0x1, 0x2, 0x0) recvmsg$inet_nvme(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x2) executing program 3: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.pending_reads\x00', 0x107941, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x5421, &(0x7f0000000080)) executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002980)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000002ec0)={'wlan0\x00'}) executing program 3: mkdirat$cgroup(0xffffffffffffff9c, &(0x7f0000000000)='syz0\x00', 0x1ff) r0 = openat$cgroup(0xffffffffffffff9c, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) close(r0) memfd_create(&(0x7f0000000100)='\xd4\xb4y\x05F%v\xd5\xb2\xe0P(p\xe2\xbd%\x02\xe1\x89|\xe0un\x00\x00\xad\xeb\x7ft\x92\xda\xce\x0f\x89=\xa9\xd8q\'\x00\x00\x00\x00J6h\x11\xf2\xd8f\xbe/\xcdn\xe6\x01\xa7\xfb\x16\xaa\x84\x05A\xa1B\xe1B\x12\xd6\xb7w\xd9\xc4`\x15\xf3\x90\x8e\xe5x\xfe\x93>\x1c\xb1\xde\xf7\xebY;b\xd0[\xed2\x1b\xd0\x80u', 0x0) readv(r0, 0x0, 0x0) executing program 3: r0 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f00000021c0), 0x2, 0x0) write$P9_RREAD(r0, 0x0, 0x0) executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) openat$cgroup_pressure(r0, &(0x7f0000000000)='io.pressure\x00', 0x2, 0x0) executing program 3: prctl$PR_SET_PDEATHSIG(0x1, 0x40000100004f) executing program 3: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000001100), 0x0, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x5451, 0x0) executing program 3: r0 = msgget(0x2, 0x0) semctl$SETVAL(r0, 0x3, 0x3, &(0x7f0000000000)) executing program 3: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x228c0, 0x0) ioctl$VT_DISALLOCATE(r0, 0x5450) executing program 3: r0 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000040)) ioctl$AUTOFS_IOC_CATATONIC(r0, 0x5450, 0x0) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_DEFRAG_RANGE(r0, 0x5451, 0x0) executing program 3: r0 = syz_open_procfs$userns(0x0, &(0x7f0000000040)) ioctl$int_out(r0, 0x5421, &(0x7f0000000380)) executing program 3: openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0xec840, 0x0) mount$9p_unix(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2101000, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x70, 0x0) executing program 2: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) connect$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r2 = accept4(r1, 0x0, 0x0, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(r2, 0x5451, 0x0) [ 46.909463][ T4355] EXT4-fs (nvme0n1p2): re-mounted. Opts: (null). Quota mode: none. executing program 3: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x5452, &(0x7f0000000040)={0x0, 'veth0\x00'}) executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_queued_recursive\x00', 0x275a, 0x0) r1 = mq_open(&(0x7f0000000000)='cgroupncontrollers\x00', 0x40, 0x0, 0x0) dup3(r0, r1, 0x0) write$nbd(r1, 0x0, 0x0) executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5411, 0x0) executing program 1: openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/class/dmi', 0x80c00, 0x5c) executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000028c0), 0x0, 0x0) r1 = timerfd_create(0x0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TIOCL_GETKMSGREDIRECT(r2, 0x5451, 0x0) executing program 0: pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE(r0, 0x5450, 0x0) executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, 0x0) executing program 4: r0 = memfd_create(&(0x7f00000008c0)='\x00\xac=\x9d\xd2\xdb\x12\'\xf8\n\xedcJ\x8e\x84\xd4N\x00\x9b\x1f\t\xbd\x11\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\x00\x02\xb4\xfdHA\xce\x9a\xde\xe4\xb6\xbcK#^\x00}2\xc6:|R\x04\xc2\xb8I\xa3\xb9[\xbd\xebw\xdeI\x0f7i$\xf1\xd4\x9b\xc7\xb2\xbeD`\x8f\xc3\x96@ge\xec\xa7y\x1cd\xbc#4\x17\xf5\xb3\xc9\xb2\x94\xa8_f!\xdf\x90}\xba\xa3\x01\xe2\"S\a\x04ry\x00#4\x87m\xf7\xff\xff\xff\xff\xb9\xcbU\xbe\x06]\xa9\xb6R~\xc9l}\xb7I\xfeH\xb3\x15\x8c\x06d\xf8c\xc0{\v\xd2\x9d\x8e\\\xae>\xf6quc9\xe0\xbf\xdd\xdc\x99\xf4\\\xd0\x96:\xfb\x8c\x12o\xcc-\x13\x14>v\xae\x80Zp\x95c]\x98\x8c\x01\x8fo\xafjN\xcb\x98\xdf\xd3[V\xbd[\xb6\x10v\xee\xdc\xc8G\xd0\xdc9\xccO\xf74\x84o\x99\xe9\x14\x00\x00dU\x00\x00\x00\b\xfb\xb5Z\xb0-\xc8\xdb\x88f\xf4W\xeb\x06\xc2\xd1\xb6\xd1%\xca\x8f\x013|\x8e\xb8\xd4Tz\x1eo\x18\xb6#@P&[\xad\xda\nmU\x823\\&P\xdc\xbcS\x80\xc1dJ!LH\xaa\a\x82\xf3\xde\x96\x85\xc5\xdd\xa8\x92\xc7\xcb\x91\xf2[Y\x06\x8a\x9fN\x10\xb9\xf4\xecq\xce\xd2\x17\x88\xae\xcc7r\xd7\xeaz\xcevR\xcau\r\xf1\t\xc2$k\xdf\x8f\xe2\xbe\xfe\x14AN\xf8\xc6\xa8`Fs[6k\x00\x00+\xa5\xdcxUY30xffffffffffffffff}) r2 = dup3(r1, r0, 0x0) shutdown(r0, 0x0) recvmsg$unix(r2, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x2) executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.pending_reads\x00', 0x8040, 0x0) dup3(r0, r1, 0x0) recvmmsg$unix(r1, 0x0, 0x0, 0x0, 0x0) executing program 4: r0 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x5452, &(0x7f00000000c0)=@add_del={0x2, 0x0}) executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) sendto$unix(r0, 0x0, 0x0, 0x20000800, 0x0, 0x0) executing program 0: mkdirat$cgroup(0xffffffffffffff9c, &(0x7f0000000000)='syz0\x00', 0x1ff) r0 = openat$cgroup(0xffffffffffffff9c, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) close(r0) memfd_create(&(0x7f00000003c0)='\xd4\xb4y\x05F%v\xd5\xb2\xe0P(p\xe2\xbd%\x02\xe1\x89|\xe0un\x00\x00\xad\xeb\x7ft\x92\xda\xce\x0f\x89=\xa9\xd8q\'\x00\x00\x00\x00J6h\x11\xf2\xd8f\xbe/\xcdn\xe6\x01\xa7\xfb\x16\xaa\x84\x05A\xa1B\xe1B\x12\xd6\xb7w\xd9\xc4`\x15\xf3\x90\x8e\xe5x\xfe\x93>\x1c\xb1\xde\xf7\xebY;b\xd0[\xed2\x1b\xd0\x80u\xd0\xe7\xd6\xb2q\x8a\xf2\xb9\x86\xf4BU\x19J\x87\x87Ys\x9ecG_\xbe\xf3rx\xbf \xca9i\x8d \xc79\x99\xc2:G\x90G\xec\xd7\x03\x86\xe0\x9c\x1c\xd4h\xbc\xf9&)\xc7\xd0\x9b#1w\fu\xbb\xf3wjG\xcb\x19\x02\x1f\x88#\xe8\xb76\xeaN\x9e\x7f\xd4\x8d\xa3\x05E|\x17\xb7K\xdf\xc7|\x89~\xce\x96b8\xa8\xd8\x92\xf2\x9c\xb4\xc6Le\xc8\x1e\xc1\x81\x94+U\x8fK3\x1f\x9c\xb5\xc2\x8b+\x14a\xa5h\xfa5\xf7V^-\x8b\x15\r\x18\x95m\x8a\xd2\xb6\xd2\xdb', 0x0) write$P9_RUNLINKAT(r0, 0x0, 0x0) executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000003c0)='./binderfs/custom1\x00', 0x2be405ab17020b46, 0x0) write$P9_RWRITE(r0, 0x0, 0x0) executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f00000002c0), 0x8, 0x0) ioctl$int_out(r0, 0x5450, 0x0) executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$FIONREAD(r1, 0x541b, 0x0) executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') close(r1) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r2, 0x0) connect$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) accept(r1, 0x0, 0x0) executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='cmdline\x00') ioctl$sock_proto_private(r0, 0x5452, &(0x7f0000000280)) executing program 3: socketpair$nbd(0x1, 0x1, 0x0, 0x0) r0 = mq_open(&(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x40, 0x0, 0x0) ioctl$BTRFS_IOC_QUOTA_CTL(r0, 0x5450, 0x0) executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x275a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) faccessat2(r0, &(0x7f0000000140)='\x00', 0x0, 0x1000) executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r1, r0, 0x0) write$binfmt_misc(r0, 0x0, 0x0) executing program 3: r0 = epoll_create1(0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r1, 0x5450, 0x0) executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) dup3(r0, r1, 0x0) write$FUSE_STATFS(r1, 0x0, 0x0) executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fcntl$setpipe(r0, 0x4, 0x0) executing program 4: r0 = timerfd_create(0x0, 0x0) r1 = dup(r0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r1, 0x8901, &(0x7f0000000040)) executing program 1: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r0, 0x8903, &(0x7f0000000140)={0x0, 0xfffffffffffffdbc}) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000003c0)='./binderfs/custom1\x00', 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0x5452, &(0x7f0000000040)) executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PIO_FONT(r0, 0x5450, 0x0) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) recvmsg(r0, &(0x7f0000000000)={&(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, 0x0}, 0x0) ioctl$FICLONE(r1, 0x5451, 0xffffffffffffffff) executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = fcntl$dupfd(r1, 0x0, r1) write$FUSE_INTERRUPT(r2, 0x0, 0xfffffdd7) executing program 1: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x5451, 0x0) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, 0x0, 0x0) [ 48.181308][ T7] Bluetooth: hci2: command 0x0419 tx timeout [ 48.183674][ T7] Bluetooth: hci3: command 0x0419 tx timeout executing program 4: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = openat$cgroup_pressure(r1, &(0x7f0000000040)='io.pressure\x00', 0xe0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = dup3(r2, r3, 0x0) ioctl$BINDER_FREEZE(r4, 0x5450, 0x0) executing program 2: r0 = socket$unix(0x1, 0x1, 0x0) sendmmsg$sock(r0, 0x0, 0x0, 0x80) executing program 1: syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0), 0x0, 0x0) [ 48.261691][ T7] Bluetooth: hci4: command 0x0419 tx timeout executing program 3: r0 = memfd_create(&(0x7f0000000400)='\xc0\x87:*\x18\xc1k\xa7\x87[\xa0o84I\xaaK\xa5\xd3\v\x86\xca<\x7f\xfd6\x8d}\xd8\xf2G\xb8\xeae)\x90\x86\xe3\x96\b\xe0\xfa\xb1\xd8N\xb2W\xcb\x8d}3lm8\xa57\xc9\x00HO\x00\x00\x00\x00R\xfc\xcb%u3\xec\xde%\x9d\xe4\x1d\rD\x82S\x17?\xd6\xb1\x9aF\xe2\xba[\xc7QR\x9f\x81\x8b\xdc\xc7\xdc\xdem\xbe\x7f2\x11\x17\xd8\xda@4\x9f\xc5*T\x1e^\xf7o\xff\xff\xff\xffwI\x02\xf3\xe3\x8d.\xd1=\xcf\xbf\x81\xb5\x8d%K\x1d\xe7_\xde\x87\xdd\xc1\xf0\x91\x1a!\xa5\xd3\v\xc9\x95d\xe3*\xa9\xfa\x99\xae\xb8\x89>\xc9\xf2/\x13{\x1a\x7f\x00\x00\x00\x00+$\xedX\xb7KV\x90\xc3D-\xf3\x8c\x9a\x15\x9c\xf5\xb4O\x17@d\x81+\xf6\xe6+\xed\r\xd2\xb3\xaa\x9b\x7fC\'\xa2\xf6\x12\xa1\x15Punfo\x7f\x92G\x0e.\xce\xd8h\xb9p2\xccC\xbaH\xc4\xdc\xe2\xa1%)\x85\xc7O]\'9\x92\xad\xfbJ\x02\x1d\x91-\xc99\t&\xbd\xe9\x06`T\xc8\x92\xaf\xad\x06\xdd\xaf\x84\xf4\"\x13\xcf\xe5\x93D\xad~F\xe5\x19\xaa\xaa\xb2\xb1\x03m\x82+\x06\x1bF^\xd3n\xc4F\xc1\xc08\x94\xe6\xe5\x1f\xa7\xf6\xcaA\x90T\xf1\x1b\xe6\xb9\xe7\xff\xc5H\x04\x93\xca\xad\x17UlY\x9a}\r4\xac\x93\xac\v2\xc6\xf9\xbe\xfeI\x8b\xd4/`\xab\x1e\xcf\x7f\b\x94\xfe2.{\xc1\xbe\x9bth~\xcb\xb9E\x10W\xed\xed51[z\xb6>\xd3\xe7Y*\xdb\xa7h\nt\xddP\n\xc5\xeb\xb1ux\x94@\x00\x00g\x02D9\x83\xa7\x97\xf4\xb25wL\x97\xfb\xb9\xccj\xb3\x96\xc1@\xee`{\x87\xa8]\x96\x9cjF^b\xa6\x91\xa0\xeaU\x92\x01\x1f,\xfa\x10\"+\x01\x00\x91\xe9\x1cz\xd1f\x901\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o\"\x85Np\xba\x0e<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\xb8V\xe4\xa1C\x90\x17\xcc{\x9d\xf1\xbe\xb0\xca\x03\x96\x85h}\x8f\x1c)X\xc83rA\x90r\xb6\xba!;\x95\xaf\xe0\xcb\xec\xcd$\x02f\x8c4\x1aH\x8fC\xbfr\xd39\x92\x1fShu\x9e\b\xd4m\xa8\x16\xa6\xd5\xae\xcb\x03oFQ\"\xf7F\xb7\vp\xb6\xe5\x92\xe2O}.\x95A\x9bH\x8d\xa1\x80\x1b\x14u\xfdK\xce\xaf\x94i\xf1s\xf7\xb8Jq\xcb3=M\x84\x7f\x181/\x9bQ|4\xaf\xcf\r\xcfz Z\x19\xad_\x13\x99\xf7\xfdOD\xd3\x9d\x9d\xb8d5g\xf1\x84\xbd\xe5\xa2\xb3\xda\x82\x10n1\xed\xba\xe3\x96\x85\"\xb6\xa6n\xe7\xfd\xd4\a\x97\x85\x810/\xc4o\x11\xc8\x1b\xc0\f\xeec\xa4\x7f|P\x00\x00\x00\x000p\xaf\xfdk\xac\xcc\xac`\xc9\a<\xadIt\x9b\xeb\x8a\xfe\x9b\aO\xa5?h\xe1B\xa8C\x8e;/\xa8\x94\x1bs\xf0\xa9\xc9\xd2\x00h\xcb\xfb\xb6Y\xbfp\xd8\x90\x96\xec\x83N\x8bNnx\xb6\x16Y\xf8sU\xae\xa0\b\x8cLq\n\x1f\x99t\xb6\xffozu\xa0B(\xe9?\xcdA\xba\xa8\x13Qc\xda\x16?\xe8z\x8f\x862!\xbf\xa4\xb8\x9bC\xe9Od\xe8\xd32m\x06RX\x7f\xf7\xc2\n\x94\xe5P:l\xd9\xd5\xbd\rH6-\x8a\x12m\xff\xe9\xa0\r\tk\xda\xa4q(\xae\\\xb6\x14I\xf7\xe0z\xf1\r\xf9\x8c\xd0\xdc\xc7>\xff\xb1\xe2\xe2\xfb\xd6\xdf\x91\x8c\x92\xa2\x82\xf4\x12n}\x18\xbc#A\xbeC3\t\xbf\xfe=i\xa78\xa5C=\x12\xd7P\v\x02\xefH\xbf\xfcC\xd7@\xc6\xd9o\x15\'#*\xb7\f\xb6\'\xff\\\xba\x98\xb1ShLzFR\xf0M\xf1\x96\x01\xacT\xbb\r\xa5q\x00R\x91\xf2\xf3\x80/\x8d\xce\n\x8f\x828\xe2\xae\x95\x93\xeb\x8c\xd1\xa6i\x8c\xe5\x8d\x92+\x13\xdb\xa3u\x1f\xdf\x91\xe6\xc2\xb1', 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r1, 0x8901, 0x20000000) executing program 1: timer_create(0x0, &(0x7f0000000080)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) pipe2$9p(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r0, &(0x7f0000000000)={0x7}, 0x69ff9a93bfc25838) r1 = dup(r0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) write$FUSE_BMAP(r1, 0x0, 0x0) dup3(r3, r1, 0x0) executing program 2: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) connect$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r2 = accept$unix(r1, 0x0, 0x0) fstat(r2, &(0x7f000000b640)) executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x400000d) openat$cgroup_type(r0, &(0x7f0000000040), 0x2, 0x0) executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$BTRFS_IOC_SET_FEATURES(r0, 0x5451, 0x0) executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup3(r0, r1, 0x0) write$P9_RVERSION(r2, 0x0, 0x0) executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) ioctl$VT_DISALLOCATE(r0, 0x5450) executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getpeername(r0, &(0x7f0000000600)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, &(0x7f0000000140)=0x80) ioctl$BTRFS_IOC_WAIT_SYNC(r1, 0x5450, 0x0) executing program 1: r0 = socket$unix(0x1, 0x3, 0x0) getsockname(r0, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, &(0x7f0000000080)=0x80) write$P9_RLOCK(r1, 0x0, 0x0) executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$NS_GET_NSTYPE(r0, 0x5450, 0x719000) executing program 1: r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TIOCCBRK(r1, 0x5450) executing program 4: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x5421, &(0x7f0000000080)=@get={0x1, 0x0}) executing program 3: openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0xc) r0 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)='io.max\x00', 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x5450, 0x0) executing program 2: openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r0, 0x5451, 0x0) executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x0) r1 = dup(r0) flistxattr(r1, 0x0, 0x0) executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmmsg$unix(r0, &(0x7f0000003580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002ec0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}], 0x1, 0x0, 0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r1, 0x5452, &(0x7f0000000080)) executing program 3: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) connect$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r2 = accept$unix(r1, 0x0, 0x0) fstat(r2, &(0x7f000000b640)) executing program 2: openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) r0 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$FUSE_WRITE(r0, 0x0, 0x0) executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$VT_ACTIVATE(r1, 0x5451, 0x0) executing program 0: openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20842, 0x0) fremovexattr(0xffffffffffffffff, &(0x7f0000000040)=@known='user.syz\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) fsetxattr$security_ima(r0, &(0x7f0000000040), 0x0, 0x0, 0x0) executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) mknodat$loop(r0, &(0x7f00000000c0)='./file0\x00', 0x1000, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000000), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) executing program 2: openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) setxattr$trusted_overlay_nlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, 0x0, 0x0) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000180), 0xfffffffffffffdb9) executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x5421, &(0x7f00000000c0)) executing program 3: r0 = inotify_init1(0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x5421, 0x0) executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x0, 0x0) syncfs(r0) executing program 4: r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x5450, 0x0) executing program 0: r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) ioctl$TIOCGDEV(r0, 0x5450, 0x0) executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) setsockopt(r0, 0x1, 0x15, &(0x7f00000000c0)="6aaaf72cb0cb444ce2ad3237693b0235", 0x10) executing program 2: pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0x541b, &(0x7f0000000080)={0xffffffffffffffff}) write$tcp_mem(r1, 0x0, 0x0) executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup3(r1, r0, 0x0) sendmsg$unix(r2, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x4000) executing program 0: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) connect$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r2 = accept$unix(r1, 0x0, 0x0) fstat(r2, &(0x7f000000b640)) executing program 3: add_key$fscrypt_provisioning(&(0x7f0000000200), 0x0, &(0x7f0000000280)={0x0, 0x0, @a}, 0x48, 0xfffffffffffffffc) executing program 2: r0 = socket$unix(0x1, 0x1, 0x0) sendmsg$netlink(r0, &(0x7f0000001300)={0x0, 0x0, 0x0}, 0x0) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r0, 0x5450, 0x0) executing program 3: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.log\x00', 0x42, 0x0) write$binfmt_script(r0, 0x0, 0x0) executing program 2: lsetxattr$trusted_overlay_nlink(&(0x7f0000000780)='.\x00', &(0x7f00000007c0), 0x0, 0x0, 0x3) executing program 0: r0 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000140)) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x5450, 0x0) executing program 4: r0 = memfd_create(&(0x7f0000000640)='\xc0\x87:*\x18\xc1k\xa7\x87[\xa0o8\xaaK\xa5\xd3\v\x86\xca<\x7f\xfd6\x8d}\xd8\xf2G\xb8\xeae)\x90\x86\xe3\x96\b\xe0\xfa\xb1\xd8N\xb2W\xcb\x8d}3lm8\xa57\xc9\x00HOA\xc8\x80kR\xfc\xcb%u3\xec\xde%\x00]\xd8\xebD\x82S\x17?\xd6As\xc2\xb1\x9aF\xe2\xba[\xc7%\x88 \xeeQR\x9f\x81\x8b\xdc\xdem\xbe\x7f2\x11)W\x9c\x82\x91\x17\xd8\xda@4\x9f\xc5*T\x1e^\xf7o\xff\xff\xff\xffwI\x02\xf3\xe3\x8d.\xd1=\xcf\xbf\x81\xb5\x8d%K\x1d\xe7_\xde\x87\xdd\xc1\xf0\x8c*\x91R\xd3\v\xc9\x95d\xe3*\xa9\xfa\x99\x9d\xb8\x89>\xc9\xf2/\x13{\x1a\x7f\x00\x00\x00\x00+$\xedX\xb7KV\x90\xc3D\x82`\xea\x16\xc6\xce\x83\xab\x05\x19-\xf3\x8c\x9a\x15\x9c\xf5\xb4O\x17@d`+\xf6\xe6+\xed\r\xd2\xb3\xaa\x9b\x7fC\'\xa2\xf6\x12\xa1\x82Xa2fo\x7f\x92G\x0e.\xce\x01\x00\xb9p2\xccC\xbaH\xc4\xdc\xe2\xa1%)\x85\xc7O]\'9\x92\xad\xfbJ\x02\x1d\x91-\xc99\t&\xbdq\x06`T\xc8\x92\xaf\xad\x06\xdd\xaf\x84\xf4\"\x13\xcf\xe5\x03D\xad~F\xe5\x19\xaa\xaa\xb2\xb1\x03m\x82+\x06\x1bF^\xd3n\xc4F\xc1\xc08\x94\xe6\xe5\x1f\xa7\xf6\xcaA\x90T\xf1\x1b\xe6\xb9\xe7\xff\xc5H\x04\x8d\xca\xad\x17UlY\x9a}\r4\xac\x93\xac\v2\xc6\xf9\xbe\xfeI\x8b\xd4/`\xab\x1e\xcf\x7f\b\x94 2.{\xc1\xbe\x9bth~\xcb\xb9E\x10W\xed\xed51[\xc5\xeb\xb1ux\x94\x92\x03\v\xf4@\x86\x1d\xc8&^Q\xcf&\xf2\x9f\xf4\x83\xac]S\xce\xa55\x98\xa5\x97\xb3\xa6\r:L\x10\xb3;\x18G\r\xd8\xee4\xa3\xacI\xfc\xf6a\xde\rL\xcb\xbbE\xfe&&xL\xc49\x02\xe8A\x91\xfd\x15\xaeY:^E^>a\xd8\xdcJu\x16B!\x0et\xf0c\xc3W\x9c\xb8\xc2c\xbc\x99\xcb\x91xA2^\xe3\xfeq\xac2X\xd1\x1cG\x1b\xe0\x8d\x1a\x11\xddX\x16H\xae\x00#\x92\nW9C\v\xbf\xe7Q\xe7\x06\x81v\x15Y\x1bY\x0f+b\xb5\xa63\xc4\x1bx\xfd< \a\x01\x00\x00\x00^f\x11]&\"\xd5\x84/\xab\xac\xeaB\xa2V3\xdd.\x8c\xe0\xb8\xf8\x8c\xf4\r\t\xb1\xa9)$\xf5\x1d\x87\x1aJ\x1b\xf3\xefj\xac\xf3\a\xdc\x9a\x05\x14\xa6\xc1\xe9\xe1\xab\xb7\xe0\x95\xa0U\xa1\x1e\xb5\xc5gw\x9cpk4\'en\xc28\xd2\x00\x00\x00\x00&\x82\xe9:;\xa9(xf\x9b\xd3a\x15\xb4W\"Y\x8f5Q\x13R\x84\x83H\xb2n\xbc\\\x11\xd4\xb4}O*\xab6\xf5Ym\xe3\xdf\x17\xcc\xb0o9\xff\xe7G\x0e\x1d\xfcH\xe9J\xeefu\x04\xfb\x9b\xc1\xfa\xff\x03\x00\x00\\\xb8\xbdNX\x1e\x97\x911m\xa3\x15\x8e_\xda\x8f\x06\x8fA^\xc2\x05\xf4\x8b\x02[\xa4jR\x96%&\xdf\xf9c\x8a4\x00\xa4tA\n\xfb\x7f\xf1S\xfd<\v\x18\xeb\xfb\xd6\xcb:\xbb\xb0\xe6,\x89\vcU\x00\x1e\xa0\x8b\xae\xe3M\xa6l\x15\x9c\x96\xf6\xbeXU\x17,\x94\x97\f\xfb', 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x200000c, 0x11, r0, 0x0) fallocate(r0, 0x0, 0x0, 0x8008007) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x8901, &(0x7f0000000980)={0x0, 0x0, {0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}}) executing program 2: r0 = memfd_create(&(0x7f0000000040)='<\x05\xd0!!~C\xde\x03\xdd\x13/\xcaG&\xcd\x92+\xb5=1\x81*\xc4\xf9\x01\xb0U\xe8\xe12\xc6U\x17\xbf\xd7\x8b5X\"\xdb,\xcd\xb4\xd8wc\xbf3\xcf\xeb\xcbLM\xd3a\xd5\x81\bK\b\x1f@n\xcfhi\xb0,\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) ioctl$EXT4_IOC_GETFSUUID(r0, 0x5451, 0x0) executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x5450, 0x0) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0xec840, 0x0) mount$9p_unix(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2101000, 0x0) mount(0x0, &(0x7f0000006c40)='./file0\x00', &(0x7f0000006c80)='mqueue\x00', 0x844202, &(0x7f0000006cc0)='\x00') executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='maps\x00') ioctl$KDFONTOP_GET(r0, 0x5450, 0x0) executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000980), 0x0, 0x0) ioctl$VT_GETMODE(r0, 0x40045431, 0x0) executing program 0: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_EXPIRE(r0, 0x5451, 0x0) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$TCSBRK(r1, 0x5451, 0x0) executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='gid_map\x00') ioctl$BTRFS_IOC_BALANCE_V2(r0, 0x5450, 0x0) executing program 2: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$EXT4_IOC_GETSTATE(r0, 0x5452, &(0x7f0000000440)) executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000200)=@known='trusted.overlay.redirect\x00', 0x0, 0x0) executing program 0: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) connect$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r2 = accept$unix(r1, 0x0, 0x0) fstat(r2, &(0x7f000000b640)) executing program 2: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0x5411, 0x0) executing program 3: openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) r0 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) ioctl$FIONCLEX(r0, 0x5450) executing program 0: r0 = msgget$private(0x0, 0x0) semctl$SEM_INFO(r0, 0x0, 0x13, &(0x7f0000000040)=""/23) executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname(r0, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, &(0x7f0000000080)=0x6b) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x5450) executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000480)='./file1\x00', 0x42, 0x17f) executing program 0: openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f00000000c0), 0x2, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x5450, 0x0) executing program 3: mknodat$null(0xffffffffffffffff, &(0x7f0000000100)='\x00', 0x0, 0x103) executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) recvmmsg$unix(r0, &(0x7f00000007c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}], 0x1, 0x0, 0x0) fcntl$getflags(r1, 0x0) executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = socket$unix(0x1, 0x2, 0x0) recvmsg$unix(r0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) openat$cgroup_devices(r1, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) executing program 2: openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$P9_RXATTRWALK(r0, 0x0, 0x0) executing program 2: r0 = openat$tcp_mem(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) ioctl$KDGKBTYPE(r0, 0x8901, &(0x7f0000000140)) executing program 2: r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$BTRFS_IOC_FS_INFO(r0, 0x5450, 0x0) executing program 2: syz_mount_image$fuse(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_unix(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1001, 0x0) chdir(&(0x7f0000000000)='./file0\x00') mount$tmpfs(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x210006b, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='.\x00', 0x0, 0x0) symlinkat(&(0x7f0000000100)='./file0\x00', r0, &(0x7f0000000180)='./file0\x00') executing program 4: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x0) r1 = openat$cgroup_pressure(r0, &(0x7f0000000000)='memory.pressure\x00', 0xe0, 0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r1, 0x5452, &(0x7f0000000180)) executing program 1: r0 = memfd_create(&(0x7f0000000080)=']\xaf.+#\x00', 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = dup3(r0, r1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = dup3(r3, r2, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(r4, 0x5450, 0x0) executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x0, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r0, 0x8903, &(0x7f0000000040)) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) getpeername(r0, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f0000000040)=0x80) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_SEND(r1, 0x5450, 0x0) executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg$unix(r0, &(0x7f0000001a00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001980)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}}], 0x1, 0x0, 0x0) fstatfs(r1, &(0x7f0000000340)=""/171) executing program 4: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000c00), 0x88401, 0x0) write$binfmt_elf64(r0, 0x0, 0x772) executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$sock_SIOCADDDLCI(r0, 0x5452, &(0x7f0000000080)={'pim6reg1\x00'}) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$inet(r0, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x8000) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) mknodat$loop(r0, &(0x7f00000000c0)='./file0\x00', 0x1000, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) executing program 4: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder-control\x00', 0x56085d08cb10f875, 0x0) write$binfmt_elf64(r0, 0x0, 0x0) [ 51.537764][ T4027] [ 51.538431][ T4027] ====================================================== [ 51.540038][ T4027] WARNING: possible circular locking dependency detected [ 51.541598][ T4027] 5.15.159-syzkaller #0 Not tainted [ 51.542756][ T4027] ------------------------------------------------------ [ 51.544371][ T4027] syz-executor.4/4027 is trying to acquire lock: [ 51.545854][ T4027] ffff0000d449c3f8 (&journal->j_checkpoint_mutex){+.+.}-{3:3}, at: __jbd2_log_wait_for_space+0x1a4/0x5cc [ 51.548497][ T4027] [ 51.548497][ T4027] but task is already holding lock: [ 51.550182][ T4027] ffff0000e7fdd3b0 (&sb->s_type->i_mutex_key#9){++++}-{3:3}, at: vfs_unlink+0xd8/0x508 [ 51.552394][ T4027] [ 51.552394][ T4027] which lock already depends on the new lock. [ 51.552394][ T4027] [ 51.554871][ T4027] [ 51.554871][ T4027] the existing dependency chain (in reverse order) is: [ 51.556967][ T4027] [ 51.556967][ T4027] -> #1 (&sb->s_type->i_mutex_key#9){++++}-{3:3}: [ 51.558970][ T4027] down_read+0xc0/0x398 [ 51.560128][ T4027] ext4_bmap+0x58/0x36c [ 51.561170][ T4027] bmap+0xa8/0xe8 [ 51.562108][ T4027] jbd2_journal_flush+0x63c/0xaa0 [ 51.563378][ T4027] ext4_ioctl+0x3454/0x61bc [ 51.564549][ T4027] __arm64_sys_ioctl+0x14c/0x1c8 [ 51.565785][ T4027] invoke_syscall+0x98/0x2b8 [ 51.566905][ T4027] el0_svc_common+0x138/0x258 [ 51.568126][ T4027] do_el0_svc+0x58/0x14c [ 51.569243][ T4027] el0_svc+0x7c/0x1f0 [ 51.570368][ T4027] el0t_64_sync_handler+0x84/0xe4 [ 51.571605][ T4027] el0t_64_sync+0x1a0/0x1a4 [ 51.572787][ T4027] [ 51.572787][ T4027] -> #0 (&journal->j_checkpoint_mutex){+.+.}-{3:3}: [ 51.574894][ T4027] __lock_acquire+0x32d4/0x7638 [ 51.576112][ T4027] lock_acquire+0x240/0x77c [ 51.577286][ T4027] __mutex_lock_common+0x194/0x2154 [ 51.578634][ T4027] mutex_lock_io_nested+0xcc/0x12c [ 51.579992][ T4027] __jbd2_log_wait_for_space+0x1a4/0x5cc [ 51.581467][ T4027] add_transaction_credits+0x814/0xb90 [ 51.582869][ T4027] start_this_handle+0x578/0x12a4 [ 51.584115][ T4027] jbd2__journal_start+0x29c/0x7b4 [ 51.585423][ T4027] __ext4_journal_start_sb+0x358/0x70c [ 51.586790][ T4027] __ext4_unlink+0x2e4/0x90c [ 51.588044][ T4027] ext4_unlink+0x1b4/0x6a0 [ 51.589181][ T4027] vfs_unlink+0x2f0/0x508 [ 51.590363][ T4027] do_unlinkat+0x4cc/0x830 [ 51.591494][ T4027] __arm64_sys_unlinkat+0xcc/0xfc [ 51.592740][ T4027] invoke_syscall+0x98/0x2b8 [ 51.593982][ T4027] el0_svc_common+0x138/0x258 [ 51.595226][ T4027] do_el0_svc+0x58/0x14c [ 51.596333][ T4027] el0_svc+0x7c/0x1f0 [ 51.597415][ T4027] el0t_64_sync_handler+0x84/0xe4 [ 51.598732][ T4027] el0t_64_sync+0x1a0/0x1a4 [ 51.599921][ T4027] [ 51.599921][ T4027] other info that might help us debug this: [ 51.599921][ T4027] [ 51.602360][ T4027] Possible unsafe locking scenario: [ 51.602360][ T4027] [ 51.604037][ T4027] CPU0 CPU1 [ 51.605268][ T4027] ---- ---- [ 51.606497][ T4027] lock(&sb->s_type->i_mutex_key#9); [ 51.607724][ T4027] lock(&journal->j_checkpoint_mutex); [ 51.609530][ T4027] lock(&sb->s_type->i_mutex_key#9); [ 51.611457][ T4027] lock(&journal->j_checkpoint_mutex); [ 51.613034][ T4027] [ 51.613034][ T4027] *** DEADLOCK *** [ 51.613034][ T4027] [ 51.614903][ T4027] 3 locks held by syz-executor.4/4027: [ 51.616203][ T4027] #0: ffff0000d4496460 (sb_writers#3){.+.+}-{0:0}, at: mnt_want_write+0x44/0x9c [ 51.618333][ T4027] #1: ffff0000e7d1f198 (&type->i_mutex_dir_key#3/1){+.+.}-{3:3}, at: do_unlinkat+0x2d0/0x830 [ 51.620828][ T4027] #2: ffff0000e7fdd3b0 (&sb->s_type->i_mutex_key#9){++++}-{3:3}, at: vfs_unlink+0xd8/0x508 [ 51.623212][ T4027] [ 51.623212][ T4027] stack backtrace: [ 51.624668][ T4027] CPU: 1 PID: 4027 Comm: syz-executor.4 Not tainted 5.15.159-syzkaller #0 [ 51.626625][ T4027] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 51.629088][ T4027] Call trace: [ 51.629887][ T4027] dump_backtrace+0x0/0x530 [ 51.631000][ T4027] show_stack+0x2c/0x3c [ 51.631961][ T4027] dump_stack_lvl+0x108/0x170 [ 51.633050][ T4027] dump_stack+0x1c/0x58 [ 51.633974][ T4027] print_circular_bug+0x150/0x1b8 [ 51.635091][ T4027] check_noncircular+0x2cc/0x378 [ 51.636289][ T4027] __lock_acquire+0x32d4/0x7638 [ 51.637433][ T4027] lock_acquire+0x240/0x77c [ 51.638468][ T4027] __mutex_lock_common+0x194/0x2154 [ 51.639644][ T4027] mutex_lock_io_nested+0xcc/0x12c [ 51.640822][ T4027] __jbd2_log_wait_for_space+0x1a4/0x5cc [ 51.642114][ T4027] add_transaction_credits+0x814/0xb90 [ 51.643554][ T4027] start_this_handle+0x578/0x12a4 [ 51.644716][ T4027] jbd2__journal_start+0x29c/0x7b4 [ 51.645908][ T4027] __ext4_journal_start_sb+0x358/0x70c [ 51.647185][ T4027] __ext4_unlink+0x2e4/0x90c [ 51.648246][ T4027] ext4_unlink+0x1b4/0x6a0 [ 51.649200][ T4027] vfs_unlink+0x2f0/0x508 [ 51.650178][ T4027] do_unlinkat+0x4cc/0x830 [ 51.651176][ T4027] __arm64_sys_unlinkat+0xcc/0xfc [ 51.652409][ T4027] invoke_syscall+0x98/0x2b8 [ 51.653471][ T4027] el0_svc_common+0x138/0x258 [ 51.654577][ T4027] do_el0_svc+0x58/0x14c [ 51.655539][ T4027] el0_svc+0x7c/0x1f0 [ 51.656484][ T4027] el0t_64_sync_handler+0x84/0xe4 [ 51.657628][ T4027] el0t_64_sync+0x1a0/0x1a4