last executing test programs: 5.141842667s ago: executing program 0 (id=1): r0 = shmget$private(0x0, 0x3000, 0x10, &(0x7f0000ffa000/0x3000)=nil) shmat(r0, &(0x7f0000001000/0x3000)=nil, 0xc000) 4.919721158s ago: executing program 0 (id=6): socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000900)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24}, 0x94) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb94235", 0x3d, 0x0, 0x0, 0x0) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000800)={r1, r1, r1}, 0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)={'sha384\x00'}}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x40000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00') ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) 4.480013137s ago: executing program 3 (id=4): mkdir(0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$snapshot(0xffffff9c, &(0x7f0000000000), 0x80000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(0x0, 0x0) mount$9p_virtio(0x0, 0x0, 0x0, 0x8c, 0x0) r4 = syz_open_dev$cec(0x0, 0x0, 0xe8c00) io_submit(0x0, 0x0, 0x0) ioctl$IOC_PR_PREEMPT(r4, 0x40046109, &(0x7f0000000040)={0xd0, 0xfffffffffffffffe, 0x1000000}) ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc044560f, &(0x7f0000000080)=@mmap={0x0, 0x2, 0x4, 0x0, 0x7, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "10110401"}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xb) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[], [], 0x2f}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x48) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0x6, 0x9, 0x0, 0x0, 0x3}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8, 0x20}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0x6, 0x0}, {0x18, 0x9, 0x2, 0x0, r6}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x6, 0x1, 0x5, 0x2}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback=0xd, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00'}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 1.802422277s ago: executing program 0 (id=7): openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cpuinfo\x00', 0x0, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setgroups(0x8, &(0x7f00000009c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0xee01, 0x0, 0xee00]) syz_usbip_server_init(0x6) setgroups(0x0, 0x0) socket$netlink(0x10, 0x3, 0x15) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x88000) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000000940)={{}, {0x20}, 0x0, 0x4}) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, 0x0}, 0x58) setsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000180)=0x1, 0x4) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000004c0)={'syz0\x00', {0x87, 0x3, 0x1, 0x9}, 0xb, [0x4, 0x6, 0x802, 0xe9a2, 0x1, 0x0, 0xa9ba, 0xc1f, 0x1, 0x7f5b, 0x3, 0x4, 0x5, 0x10004, 0x2, 0x3, 0x0, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x0, 0x3, 0x9, 0xfff, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xfffffffc, 0x0, 0x9, 0xb, 0xcc, 0x4, 0x80, 0x401, 0x5, 0x5, 0xfffffffd, 0x8, 0xb, 0x3, 0xffff8001, 0x6, 0x3, 0x80000000, 0x1, 0xa, 0x7, 0x8, 0x5, 0xfff, 0x1, 0x7fe, 0x7fff, 0x10000, 0x2, 0x8], [0x2, 0x1, 0x10000, 0x7, 0x9, 0x6, 0x5, 0x4, 0x9, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x7, 0x8, 0x5, 0xcc, 0xbc1, 0x80000, 0x0, 0x5e81339d, 0xffffc256, 0xb, 0x80000001, 0x0, 0x0, 0x4, 0x4, 0x7, 0x8, 0x10d, 0x1, 0x5, 0x5, 0xfffffb66, 0xfb5, 0x2, 0x4, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x4, 0x6f, 0x80b, 0x1, 0x1, 0x525ba681, 0x4f74, 0x7, 0x1, 0x1, 0xfffffffd, 0x100, 0x6, 0x10000, 0x1306, 0x8b, 0x10000, 0xfe4, 0x3ff], [0x2, 0x40, 0x200, 0xfffffff9, 0x7aa, 0x10, 0x80, 0x8001, 0x5, 0x0, 0x9, 0x8, 0x7fffffff, 0x1, 0x1, 0x4, 0x8, 0xa9, 0x7, 0x49, 0x6, 0x4, 0x5, 0xa3, 0x40003, 0x2, 0x0, 0x3, 0x4c, 0x3, 0x5, 0x4, 0xd21e, 0x9, 0x12, 0x0, 0x2, 0xfff, 0x926, 0x800100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x81, 0x47, 0x7, 0x0, 0x11, 0x2, 0xffd, 0x7, 0x7, 0x7ffd, 0x7ff, 0x10, 0x9, 0x10001, 0x8000001, 0x10001, 0x6, 0x71c], [0x81, 0x3, 0x10, 0x4e26, 0x3, 0x7, 0xfffffff3, 0x497, 0x4, 0x1, 0x3, 0x5, 0x56, 0xc28, 0x9, 0x5, 0x5, 0xa, 0x79a, 0x4, 0x9, 0x6, 0xc41f, 0x5, 0x8b6, 0xffffffff, 0x0, 0x0, 0x6a, 0x9, 0x0, 0x0, 0x1000, 0x10, 0xd, 0x6, 0x8000, 0x53, 0x78d, 0x4, 0x1, 0x9, 0xfffffff8, 0x9, 0x7, 0x7, 0x101, 0x7, 0x7, 0x4, 0x0, 0xb, 0x400400, 0x8, 0x0, 0x8, 0x7, 0x9, 0x8, 0x0, 0x1, 0x8001, 0xfffffff7, 0x5]}, 0x45c) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000000314230c2dbd7000ffdbdf250900020073797a32000f00000800410072786500140033007767320000000000000000000000000066129cbdaaf92ea305126427a766b1c085924cd6ad57b03cfe9655f622d77d2aeea86454e08d702ca2d6392ca31ef21b722d78da5d90886bb0db32b0e33c89a5e901bb4e0379f25665d395238e6730ad37288567b268fe7f1586d588e526e7d727ec73b81279a75e879dd960e5107507609756ec582a8032a0ae41beb16ed972c66cc59029b79ace6666660cde28316ee23ff7ea64e39ae6d39b5f45f5ccf2adaffee80cc44776710ba5c2a2e806dcb0a1fd133d11902dea4f"], 0x38}, 0x1, 0x0, 0x0, 0x400c080}, 0x0) pipe(&(0x7f0000000080)) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') write$RDMA_USER_CM_CMD_GET_EVENT(r4, 0x0, 0x0) 828.588221ms ago: executing program 2 (id=3): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x258, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08060cdc030ec0007f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) 200.51618ms ago: executing program 2 (id=8): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getpeername$inet6(r0, 0x0, 0x0) 0s ago: executing program 2 (id=9): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mount(0x0, 0x0, 0x0, 0x44021, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400001016000103000000fcdbdf250900"], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) getsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x2, &(0x7f0000000200), 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000000600)={r3, r3, 0x8, 0x0, 0x0, 0x6, 0xfe, 0x10cf, 0x5, 0x5, 0x2, 0x1, 'syz0\x00'}) shutdown(r3, 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r4, 0x800448d2, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) unshare(0x6a040000) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000002c0)=0x11) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000100)=0x2) mmap(&(0x7f00005f7000/0x1000)=nil, 0x1000, 0x0, 0x80010, 0xffffffffffffffff, 0xffffd000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.202' (ED25519) to the list of known hosts. [ 82.619385][ T5782] cgroup: Unknown subsys name 'net' [ 82.880645][ T5782] cgroup: Unknown subsys name 'cpuset' [ 82.945577][ T5782] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 84.909481][ T5782] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 88.447035][ T5800] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 88.454422][ T5800] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.465519][ T5800] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.467231][ T5800] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.471999][ T5800] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.481404][ T5800] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.486125][ T5800] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.497915][ T5800] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.500731][ T5800] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.504198][ T5800] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.552189][ T5114] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 88.554296][ T5114] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.556367][ T5114] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.590639][ T5114] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.591475][ T5114] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 88.625485][ T5800] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 88.627744][ T5810] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 88.652122][ T5800] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 88.655689][ T5810] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 88.659299][ T5810] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 88.670696][ T5810] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 88.673403][ T5810] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 88.693851][ T5114] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 88.706398][ T5114] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 88.711999][ T5114] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 89.590098][ T5796] chnl_net:caif_netlink_parms(): no params data found [ 89.669341][ T5795] chnl_net:caif_netlink_parms(): no params data found [ 89.731071][ T5802] chnl_net:caif_netlink_parms(): no params data found [ 89.823085][ T5804] chnl_net:caif_netlink_parms(): no params data found [ 89.850027][ T5803] chnl_net:caif_netlink_parms(): no params data found [ 90.080500][ T5796] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.081746][ T5796] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.082394][ T5796] bridge_slave_0: entered allmulticast mode [ 90.084448][ T5796] bridge_slave_0: entered promiscuous mode [ 90.157469][ T5796] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.157555][ T5796] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.157701][ T5796] bridge_slave_1: entered allmulticast mode [ 90.159617][ T5796] bridge_slave_1: entered promiscuous mode [ 90.161273][ T5795] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.161385][ T5795] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.161983][ T5795] bridge_slave_0: entered allmulticast mode [ 90.164112][ T5795] bridge_slave_0: entered promiscuous mode [ 90.256957][ T5795] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.257091][ T5795] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.257212][ T5795] bridge_slave_1: entered allmulticast mode [ 90.259101][ T5795] bridge_slave_1: entered promiscuous mode [ 90.306207][ T5802] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.306386][ T5802] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.306515][ T5802] bridge_slave_0: entered allmulticast mode [ 90.308372][ T5802] bridge_slave_0: entered promiscuous mode [ 90.396065][ T5802] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.396265][ T5802] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.396445][ T5802] bridge_slave_1: entered allmulticast mode [ 90.398557][ T5802] bridge_slave_1: entered promiscuous mode [ 90.438193][ T5796] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.480733][ T5804] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.480877][ T5804] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.481058][ T5804] bridge_slave_0: entered allmulticast mode [ 90.483166][ T5804] bridge_slave_0: entered promiscuous mode [ 90.520933][ T5803] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.521032][ T5803] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.521161][ T5803] bridge_slave_0: entered allmulticast mode [ 90.522921][ T5803] bridge_slave_0: entered promiscuous mode [ 90.534376][ T5796] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.538872][ T5810] Bluetooth: hci1: command tx timeout [ 90.557535][ T5795] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.558188][ T5804] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.558501][ T5804] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.559184][ T5804] bridge_slave_1: entered allmulticast mode [ 90.572782][ T5804] bridge_slave_1: entered promiscuous mode [ 90.614207][ T5803] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.614352][ T5803] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.614589][ T5803] bridge_slave_1: entered allmulticast mode [ 90.615736][ T5810] Bluetooth: hci0: command tx timeout [ 90.644253][ T5803] bridge_slave_1: entered promiscuous mode [ 90.668753][ T5795] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.691852][ T5802] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.696019][ T5810] Bluetooth: hci2: command tx timeout [ 90.750643][ T5802] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.776194][ T60] Bluetooth: hci4: command tx timeout [ 90.776368][ T5810] Bluetooth: hci3: command tx timeout [ 90.801063][ T5796] team0: Port device team_slave_0 added [ 90.837862][ T5804] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.841046][ T5803] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.843217][ T5796] team0: Port device team_slave_1 added [ 90.876559][ T5795] team0: Port device team_slave_0 added [ 90.905900][ T5804] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.909223][ T5803] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.943325][ T5795] team0: Port device team_slave_1 added [ 90.950835][ T5802] team0: Port device team_slave_0 added [ 91.016119][ T5802] team0: Port device team_slave_1 added [ 91.050457][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.050471][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.050491][ T5796] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.128302][ T5804] team0: Port device team_slave_0 added [ 91.130511][ T5803] team0: Port device team_slave_0 added [ 91.131373][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.131388][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.131415][ T5796] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.132705][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.132715][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.132734][ T5795] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.249550][ T5804] team0: Port device team_slave_1 added [ 91.251595][ T5803] team0: Port device team_slave_1 added [ 91.273123][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.273136][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.273156][ T5795] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.274686][ T5802] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.274698][ T5802] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.274717][ T5802] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.386946][ T5802] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.386959][ T5802] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.386979][ T5802] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.471603][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.471616][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.471635][ T5804] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.520434][ T5803] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.520447][ T5803] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.520467][ T5803] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.524427][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.524441][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.524461][ T5804] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.962946][ T5803] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.962965][ T5803] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.962995][ T5803] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.016977][ T811] cfg80211: failed to load regulatory.db [ 92.069065][ T5796] hsr_slave_0: entered promiscuous mode [ 92.070326][ T5796] hsr_slave_1: entered promiscuous mode [ 92.133538][ T5795] hsr_slave_0: entered promiscuous mode [ 92.134662][ T5795] hsr_slave_1: entered promiscuous mode [ 92.148517][ T5795] debugfs: 'hsr0' already exists in 'hsr' [ 92.148612][ T5795] Cannot create hsr debugfs directory [ 92.195212][ T5802] hsr_slave_0: entered promiscuous mode [ 92.196230][ T5802] hsr_slave_1: entered promiscuous mode [ 92.196889][ T5802] debugfs: 'hsr0' already exists in 'hsr' [ 92.196907][ T5802] Cannot create hsr debugfs directory [ 92.300485][ T5804] hsr_slave_0: entered promiscuous mode [ 92.301532][ T5804] hsr_slave_1: entered promiscuous mode [ 92.302430][ T5804] debugfs: 'hsr0' already exists in 'hsr' [ 92.302449][ T5804] Cannot create hsr debugfs directory [ 92.342954][ T5803] hsr_slave_0: entered promiscuous mode [ 92.343941][ T5803] hsr_slave_1: entered promiscuous mode [ 92.344757][ T5803] debugfs: 'hsr0' already exists in 'hsr' [ 92.354937][ T5803] Cannot create hsr debugfs directory [ 92.615131][ T5810] Bluetooth: hci1: command tx timeout [ 92.695209][ T5810] Bluetooth: hci0: command tx timeout [ 92.785079][ T5810] Bluetooth: hci2: command tx timeout [ 92.855142][ T60] Bluetooth: hci4: command tx timeout [ 92.855235][ T5810] Bluetooth: hci3: command tx timeout [ 93.291726][ T5796] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.345251][ T5796] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.392232][ T5796] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 93.447557][ T5796] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 93.559933][ T5795] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 93.591722][ T5795] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 93.614470][ T5795] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 93.678079][ T5795] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 93.805764][ T5802] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 93.848671][ T5802] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 93.883597][ T5802] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 93.939754][ T5802] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 94.089254][ T5804] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 94.149773][ T5804] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 94.186385][ T5804] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 94.246493][ T5804] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 94.388700][ T5796] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.421937][ T5803] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 94.453416][ T5803] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 94.480484][ T5803] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 94.518592][ T5803] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 94.587643][ T5796] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.628496][ T1286] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.631446][ T1286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.667227][ T5795] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.687387][ T1286] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.687521][ T1286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.700875][ T5810] Bluetooth: hci1: command tx timeout [ 94.775191][ T5810] Bluetooth: hci0: command tx timeout [ 94.793660][ T5795] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.815646][ T5802] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.848704][ T160] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.849711][ T160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.855664][ T5810] Bluetooth: hci2: command tx timeout [ 94.908303][ T1286] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.908399][ T1286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.935802][ T60] Bluetooth: hci4: command tx timeout [ 94.935896][ T5810] Bluetooth: hci3: command tx timeout [ 94.998869][ T5802] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.031406][ T5804] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.049147][ T160] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.049932][ T160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.125877][ T1126] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.125985][ T1126] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.212557][ T5804] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.256769][ T5803] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.263128][ T1126] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.263386][ T1126] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.329396][ T1126] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.329619][ T1126] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.427291][ T5803] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.494024][ T160] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.494443][ T160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.560310][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.560449][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.598088][ T5796] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.871084][ T5796] veth0_vlan: entered promiscuous mode [ 95.938177][ T5796] veth1_vlan: entered promiscuous mode [ 95.984321][ T5795] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.147394][ T5802] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.150241][ T5796] veth0_macvtap: entered promiscuous mode [ 96.198822][ T5796] veth1_macvtap: entered promiscuous mode [ 96.266568][ T5795] veth0_vlan: entered promiscuous mode [ 96.282984][ T5804] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.318804][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.340141][ T5795] veth1_vlan: entered promiscuous mode [ 96.357197][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.401288][ T5803] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.413005][ T1307] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.430851][ T1286] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.451572][ T1286] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.477665][ T1286] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.494303][ T5802] veth0_vlan: entered promiscuous mode [ 96.650551][ T5802] veth1_vlan: entered promiscuous mode [ 96.739576][ T5795] veth0_macvtap: entered promiscuous mode [ 96.772261][ T5804] veth0_vlan: entered promiscuous mode [ 96.775007][ T5810] Bluetooth: hci1: command tx timeout [ 96.812946][ T5795] veth1_macvtap: entered promiscuous mode [ 96.856368][ T5810] Bluetooth: hci0: command tx timeout [ 96.856993][ T5804] veth1_vlan: entered promiscuous mode [ 96.935666][ T5810] Bluetooth: hci2: command tx timeout [ 96.937983][ T160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.938005][ T160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.966969][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.003290][ T5802] veth0_macvtap: entered promiscuous mode [ 97.013123][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.025287][ T60] Bluetooth: hci4: command tx timeout [ 97.025342][ T5810] Bluetooth: hci3: command tx timeout [ 97.064546][ T5802] veth1_macvtap: entered promiscuous mode [ 97.089445][ T160] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.093712][ T160] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.118192][ T160] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.119631][ T1286] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.119651][ T1286] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.137818][ T160] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.214151][ T5804] veth0_macvtap: entered promiscuous mode [ 97.274102][ T5802] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.309382][ T5804] veth1_macvtap: entered promiscuous mode [ 97.346231][ T5803] veth0_vlan: entered promiscuous mode [ 97.348906][ T5802] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.440826][ T1126] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.485034][ T1126] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.511024][ T1126] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.532585][ T1126] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.533229][ T5803] veth1_vlan: entered promiscuous mode [ 97.540119][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.540138][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.611717][ T38] audit: type=1800 audit(1775909390.239:2): pid=5913 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.1" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 97.652506][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.796486][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.821948][ T160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.821967][ T160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.919291][ T1126] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.926475][ T1126] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.940587][ T1126] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.983593][ T1126] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.120742][ T1286] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.120764][ T1286] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.123882][ T5803] veth0_macvtap: entered promiscuous mode [ 98.266267][ T5803] veth1_macvtap: entered promiscuous mode [ 98.407933][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.407955][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.471677][ T5803] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.499611][ T5803] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.530969][ T37] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.532214][ T37] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.532259][ T37] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.532299][ T37] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.951691][ T5921] overlay: Unknown parameter '/' [ 101.889764][ T5810] Bluetooth: hci1: command 0x0c1a tx timeout [ 101.904971][ T5918] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 101.905515][ T5918] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 102.280001][ T5918] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 102.420628][ T5931] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 102.452218][ T5918] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 102.452332][ T5918] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 102.554540][ T5918] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 102.664485][ T5918] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 102.664566][ T5918] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 102.728403][ T5918] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 102.837575][ T5935] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 103.042585][ T5918] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 103.042724][ T5918] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 103.166429][ T5918] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 103.252191][ T5918] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 103.252309][ T5918] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 103.567334][ T5926] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 103.567441][ T5926] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 103.569040][ T5926] vhci_hcd vhci_hcd.0: Device attached [ 103.571859][ T5940] wg2 speed is unknown, defaulting to 1000 [ 103.662773][ T5940] wg2 speed is unknown, defaulting to 1000 [ 103.975464][ T60] Bluetooth: hci1: command 0x0c1a tx timeout [ 103.996003][ T5945] usb 34-1: SetAddress Request (2) to port 0 [ 103.996094][ T5945] usb 34-1: new SuperSpeed USB device number 2 using vhci_hcd [ 104.081218][ T5939] vhci_hcd: connection reset by peer [ 104.093248][ T37] vhci_hcd vhci_hcd.0: stop threads [ 104.093797][ T37] vhci_hcd vhci_hcd.0: release socket [ 104.118693][ T37] vhci_hcd vhci_hcd.0: disconnect device [ 104.242585][ T5940] wg2 speed is unknown, defaulting to 1000 [ 104.253371][ T5935] can0: slcan on ttyS3. [ 104.379297][ T5947] ================================================================== [ 104.379314][ T5947] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x3d/0x50 [ 104.379355][ T5947] Read of size 1 at addr ffff88803a150330 by task khidpd_10cf0005/5947 [ 104.379371][ T5947] [ 104.379396][ T5947] CPU: 0 UID: 0 PID: 5947 Comm: khidpd_10cf0005 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 104.379423][ T5947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 104.379442][ T5947] Call Trace: [ 104.379450][ T5947] [ 104.379460][ T5947] dump_stack_lvl+0xe8/0x150 [ 104.379487][ T5947] print_report+0xba/0x230 [ 104.379509][ T5947] ? _raw_spin_lock_irq+0x3d/0x50 [ 104.379527][ T5947] kasan_report+0x117/0x150 [ 104.379546][ T5947] ? _raw_spin_lock_irq+0x3d/0x50 [ 104.379567][ T5947] __kasan_check_byte+0x2a/0x40 [ 104.379582][ T5947] lock_acquire+0x79/0x2e0 [ 104.379601][ T5947] ? rcu_is_watching+0x15/0xb0 [ 104.379622][ T5947] _raw_spin_lock_irq+0x3d/0x50 [ 104.379640][ T5947] ? rt_mutex_slowlock_block+0x510/0x680 [ 104.379667][ T5947] rt_mutex_slowlock_block+0x510/0x680 [ 104.379702][ T5947] rt_mutex_slowlock+0x2dc/0x7b0 [ 104.379729][ T5947] ? rt_mutex_slowlock+0x1fd/0x7b0 [ 104.379756][ T5947] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 104.379783][ T5947] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.379818][ T5947] ? l2cap_unregister_user+0x36/0x170 [ 104.379841][ T5947] ? l2cap_unregister_user+0x36/0x170 [ 104.379858][ T5947] mutex_lock_nested+0x168/0x1d0 [ 104.379881][ T5947] ? lockdep_hardirqs_on+0x7a/0x110 [ 104.379902][ T5947] l2cap_unregister_user+0x36/0x170 [ 104.379931][ T5947] ? hidp_session_thread+0x1987/0x1a70 [ 104.379953][ T5947] hidp_session_thread+0x1996/0x1a70 [ 104.379984][ T5947] ? __pfx_hidp_session_thread+0x10/0x10 [ 104.380006][ T5947] ? __pfx_woken_wake_function+0x10/0x10 [ 104.380026][ T5947] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 104.380053][ T5947] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 104.380076][ T5947] ? __kthread_parkme+0x7a/0x1f0 [ 104.380106][ T5947] ? __kthread_parkme+0x19c/0x1f0 [ 104.380136][ T5947] kthread+0x388/0x470 [ 104.380156][ T5947] ? __pfx_hidp_session_thread+0x10/0x10 [ 104.380181][ T5947] ? __pfx_kthread+0x10/0x10 [ 104.380199][ T5947] ret_from_fork+0x51e/0xb90 [ 104.380229][ T5947] ? __pfx_ret_from_fork+0x10/0x10 [ 104.380259][ T5947] ? __switch_to+0xc7d/0x1450 [ 104.380285][ T5947] ? __pfx_kthread+0x10/0x10 [ 104.380307][ T5947] ret_from_fork_asm+0x1a/0x30 [ 104.380336][ T5947] [ 104.380344][ T5947] [ 104.380349][ T5947] Allocated by task 5810: [ 104.380359][ T5947] kasan_save_track+0x3e/0x80 [ 104.380389][ T5947] __kasan_kmalloc+0x93/0xb0 [ 104.380417][ T5947] __kmalloc_cache_noprof+0x3a6/0x690 [ 104.380434][ T5947] l2cap_conn_add+0xaa/0x970 [ 104.380455][ T5947] l2cap_connect_cfm+0x142/0x1560 [ 104.380481][ T5947] hci_remote_features_evt+0x5b9/0x950 [ 104.380500][ T5947] hci_event_packet+0x6ab/0xef0 [ 104.380518][ T5947] hci_rx_work+0x3ee/0x1030 [ 104.380535][ T5947] process_scheduled_works+0xb6e/0x18c0 [ 104.380561][ T5947] worker_thread+0xa53/0xfc0 [ 104.380587][ T5947] kthread+0x388/0x470 [ 104.380605][ T5947] ret_from_fork+0x51e/0xb90 [ 104.380630][ T5947] ret_from_fork_asm+0x1a/0x30 [ 104.380647][ T5947] [ 104.380652][ T5947] Freed by task 5918: [ 104.380660][ T5947] kasan_save_track+0x3e/0x80 [ 104.380687][ T5947] kasan_save_free_info+0x46/0x50 [ 104.380709][ T5947] __kasan_slab_free+0x5c/0x80 [ 104.380737][ T5947] kfree+0x1c1/0x6c0 [ 104.380762][ T5947] l2cap_connect_cfm+0x12b/0x1560 [ 104.380787][ T5947] hci_conn_failed+0x1ce/0x340 [ 104.380810][ T5947] hci_abort_conn_sync+0xdd0/0x1190 [ 104.380833][ T5947] hci_disconnect_all_sync+0x1b5/0x350 [ 104.380857][ T5947] hci_suspend_sync+0x417/0xd20 [ 104.380880][ T5947] hci_suspend_dev+0x28d/0x540 [ 104.380899][ T5947] hci_suspend_notifier+0xf2/0x2f0 [ 104.380928][ T5947] notifier_call_chain+0x1be/0x400 [ 104.380947][ T5947] blocking_notifier_call_chain_robust+0x85/0x100 [ 104.380967][ T5947] pm_notifier_call_chain_robust+0x2c/0x60 [ 104.380998][ T5947] snapshot_open+0x1a2/0x280 [ 104.381016][ T5947] misc_open+0x2de/0x350 [ 104.381040][ T5947] chrdev_open+0x4d0/0x5f0 [ 104.381058][ T5947] do_dentry_open+0x83d/0x13e0 [ 104.381080][ T5947] vfs_open+0x3b/0x350 [ 104.381101][ T5947] path_openat+0x2e43/0x38a0 [ 104.381129][ T5947] do_file_open+0x23e/0x4a0 [ 104.381156][ T5947] do_sys_openat2+0x113/0x200 [ 104.381179][ T5947] __x64_sys_openat+0x138/0x170 [ 104.381202][ T5947] do_syscall_64+0x14d/0xf80 [ 104.381223][ T5947] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.381243][ T5947] [ 104.381248][ T5947] Last potentially related work creation: [ 104.381255][ T5947] kasan_save_stack+0x3e/0x60 [ 104.381282][ T5947] kasan_record_aux_stack+0xbd/0xd0 [ 104.381304][ T5947] insert_work+0x3d/0x330 [ 104.381327][ T5947] __queue_work+0xcc6/0xff0 [ 104.381354][ T5947] call_timer_fn+0x192/0x640 [ 104.381372][ T5947] __run_timer_base+0x764/0x9f0 [ 104.381398][ T5947] run_timer_softirq+0xb7/0x170 [ 104.381426][ T5947] handle_softirqs+0x1de/0x6f0 [ 104.381453][ T5947] run_ktimerd+0x69/0x100 [ 104.381468][ T5947] smpboot_thread_fn+0x541/0xa50 [ 104.381498][ T5947] kthread+0x388/0x470 [ 104.381515][ T5947] ret_from_fork+0x51e/0xb90 [ 104.381541][ T5947] ret_from_fork_asm+0x1a/0x30 [ 104.381558][ T5947] [ 104.381563][ T5947] Second to last potentially related work creation: [ 104.381571][ T5947] kasan_save_stack+0x3e/0x60 [ 104.381597][ T5947] kasan_record_aux_stack+0xbd/0xd0 [ 104.381620][ T5947] insert_work+0x3d/0x330 [ 104.381643][ T5947] __queue_work+0xbb3/0xff0 [ 104.381670][ T5947] queue_work_on+0x106/0x1d0 [ 104.381697][ T5947] l2cap_connect_cfm+0x10f5/0x1560 [ 104.381723][ T5947] hci_remote_features_evt+0x5b9/0x950 [ 104.381743][ T5947] hci_event_packet+0x6ab/0xef0 [ 104.381760][ T5947] hci_rx_work+0x3ee/0x1030 [ 104.381778][ T5947] process_scheduled_works+0xb6e/0x18c0 [ 104.381804][ T5947] worker_thread+0xa53/0xfc0 [ 104.381830][ T5947] kthread+0x388/0x470 [ 104.381847][ T5947] ret_from_fork+0x51e/0xb90 [ 104.381873][ T5947] ret_from_fork_asm+0x1a/0x30 [ 104.381890][ T5947] [ 104.381894][ T5947] The buggy address belongs to the object at ffff88803a150000 [ 104.381894][ T5947] which belongs to the cache kmalloc-1k of size 1024 [ 104.381919][ T5947] The buggy address is located 816 bytes inside of [ 104.381919][ T5947] freed 1024-byte region [ffff88803a150000, ffff88803a150400) [ 104.381940][ T5947] [ 104.381945][ T5947] The buggy address belongs to the physical page: [ 104.381969][ T5947] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3a150 [ 104.381989][ T5947] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 104.382005][ T5947] flags: 0x80000000000040(head|node=0|zone=1) [ 104.382026][ T5947] page_type: f5(slab) [ 104.382046][ T5947] raw: 0080000000000040 ffff88813fe1adc0 dead000000000100 dead000000000122 [ 104.382062][ T5947] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 104.382080][ T5947] head: 0080000000000040 ffff88813fe1adc0 dead000000000100 dead000000000122 [ 104.382097][ T5947] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 104.382114][ T5947] head: 0080000000000003 ffffea0000e85401 00000000ffffffff 00000000ffffffff [ 104.382130][ T5947] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 104.382140][ T5947] page dumped because: kasan: bad access detected [ 104.382154][ T5947] page_owner tracks the page as allocated [ 104.382161][ T5947] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5805, tgid 5805 (udevd), ts 88561014710, free_ts 87780994056 [ 104.382198][ T5947] post_alloc_hook+0x231/0x280 [ 104.382227][ T5947] get_page_from_freelist+0x28bb/0x2950 [ 104.382249][ T5947] __alloc_frozen_pages_noprof+0x18d/0x380 [ 104.382271][ T5947] allocate_slab+0x77/0x660 [ 104.382293][ T5947] refill_objects+0x334/0x3c0 [ 104.382314][ T5947] __pcs_replace_empty_main+0x35c/0x710 [ 104.382339][ T5947] __kmalloc_cache_noprof+0x44e/0x690 [ 104.382357][ T5947] do_epoll_create+0x75/0x3b0 [ 104.382385][ T5947] __x64_sys_epoll_create1+0x37/0x40 [ 104.382409][ T5947] do_syscall_64+0x14d/0xf80 [ 104.382430][ T5947] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.382449][ T5947] page last free pid 5782 tgid 5782 stack trace: [ 104.382460][ T5947] __free_frozen_pages+0xfe3/0x1170 [ 104.382478][ T5947] __slab_free+0x24f/0x2a0 [ 104.382495][ T5947] qlist_free_all+0x97/0x100 [ 104.382523][ T5947] kasan_quarantine_reduce+0x148/0x160 [ 104.382551][ T5947] __kasan_slab_alloc+0x22/0x80 [ 104.382580][ T5947] __kmalloc_noprof+0x399/0x7b0 [ 104.382596][ T5947] tomoyo_realpath_from_path+0xe3/0x5d0 [ 104.382621][ T5947] tomoyo_path_perm+0x283/0x560 [ 104.382638][ T5947] security_file_truncate+0xa9/0x240 [ 104.382660][ T5947] do_ftruncate+0x27c/0x5c0 [ 104.382677][ T5947] __x64_sys_ftruncate+0x92/0xf0 [ 104.382694][ T5947] do_syscall_64+0x14d/0xf80 [ 104.382714][ T5947] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.382734][ T5947] [ 104.382739][ T5947] Memory state around the buggy address: [ 104.382750][ T5947] ffff88803a150200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.382764][ T5947] ffff88803a150280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.382778][ T5947] >ffff88803a150300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.382788][ T5947] ^ [ 104.382799][ T5947] ffff88803a150380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.382813][ T5947] ffff88803a150400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.382823][ T5947] ================================================================== [ 104.382840][ T5947] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 104.382857][ T5947] CPU: 0 UID: 0 PID: 5947 Comm: khidpd_10cf0005 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 104.382881][ T5947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 104.382893][ T5947] Call Trace: [ 104.382901][ T5947] [ 104.382917][ T5947] vpanic+0x56c/0xa60 [ 104.382952][ T5947] ? __pfx_vpanic+0x10/0x10 [ 104.382990][ T5947] panic+0xc5/0xd0 [ 104.383019][ T5947] ? __pfx_panic+0x10/0x10 [ 104.383053][ T5947] ? _raw_spin_lock_irq+0x3d/0x50 [ 104.383077][ T5947] ? rcu_is_watching+0x15/0xb0 [ 104.383101][ T5947] ? _raw_spin_lock_irq+0x3d/0x50 [ 104.383125][ T5947] ? _raw_spin_lock_irq+0x3d/0x50 [ 104.383147][ T5947] check_panic_on_warn+0x89/0xb0 [ 104.383171][ T5947] ? _raw_spin_lock_irq+0x3d/0x50 [ 104.383193][ T5947] end_report+0x73/0x180 [ 104.383213][ T5947] ? _raw_spin_lock_irq+0x3d/0x50 [ 104.383283][ T5947] kasan_report+0x128/0x150 [ 104.383306][ T5947] ? _raw_spin_lock_irq+0x3d/0x50 [ 104.383334][ T5947] __kasan_check_byte+0x2a/0x40 [ 104.383354][ T5947] lock_acquire+0x79/0x2e0 [ 104.383376][ T5947] ? rcu_is_watching+0x15/0xb0 [ 104.383401][ T5947] _raw_spin_lock_irq+0x3d/0x50 [ 104.383424][ T5947] ? rt_mutex_slowlock_block+0x510/0x680 [ 104.383455][ T5947] rt_mutex_slowlock_block+0x510/0x680 [ 104.383496][ T5947] rt_mutex_slowlock+0x2dc/0x7b0 [ 104.383529][ T5947] ? rt_mutex_slowlock+0x1fd/0x7b0 [ 104.383562][ T5947] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 104.383594][ T5947] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.383632][ T5947] ? l2cap_unregister_user+0x36/0x170 [ 104.383660][ T5947] ? l2cap_unregister_user+0x36/0x170 [ 104.383682][ T5947] mutex_lock_nested+0x168/0x1d0 [ 104.383714][ T5947] ? lockdep_hardirqs_on+0x7a/0x110 [ 104.383741][ T5947] l2cap_unregister_user+0x36/0x170 [ 104.383764][ T5947] ? hidp_session_thread+0x1987/0x1a70 [ 104.383793][ T5947] hidp_session_thread+0x1996/0x1a70 [ 104.383834][ T5947] ? __pfx_hidp_session_thread+0x10/0x10 [ 104.383862][ T5947] ? __pfx_woken_wake_function+0x10/0x10 [ 104.383886][ T5947] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 104.383925][ T5947] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 104.383955][ T5947] ? __kthread_parkme+0x7a/0x1f0 [ 104.383986][ T5947] ? __kthread_parkme+0x19c/0x1f0 [ 104.384023][ T5947] kthread+0x388/0x470 [ 104.384045][ T5947] ? __pfx_hidp_session_thread+0x10/0x10 [ 104.384070][ T5947] ? __pfx_kthread+0x10/0x10 [ 104.384093][ T5947] ret_from_fork+0x51e/0xb90 [ 104.384124][ T5947] ? __pfx_ret_from_fork+0x10/0x10 [ 104.384154][ T5947] ? __switch_to+0xc7d/0x1450 [ 104.384183][ T5947] ? __pfx_kthread+0x10/0x10 [ 104.384206][ T5947] ret_from_fork_asm+0x1a/0x30 [ 104.384235][ T5947] [ 104.384831][ T5947] Kernel Offset: disabled