last executing test programs: 9.456654422s ago: executing program 3 (id=6): r0 = socket(0x11, 0x3, 0x2) socket(0x200000000000011, 0x2, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) bind$packet(r0, &(0x7f00000001c0)={0x11, 0x0, r2, 0x1, 0x2, 0x6, @broadcast}, 0x14) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 9.207949508s ago: executing program 0 (id=1): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, 0x0) 9.013829061s ago: executing program 1 (id=2): setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x400c084) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) fstat(r0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x8, 0x0, 0x0, 0x41000}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) r5 = gettid() sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000003c0)={0x24, r3, 0xd66771a5e8224ded, 0x4, 0x0, {{}, {@void, @void, @void}}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r4}, @NL80211_ATTR_PID={0x8, 0x52, r5}]}, 0x24}}, 0x4008040) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) socket$nl_netfilter(0x10, 0x3, 0xc) 8.949920779s ago: executing program 3 (id=7): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYRES32=r1, @ANYBLOB="01980000000000002000128008000100677265001400028008000100", @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=@newtfilter={0x3c, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0x7}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}, @TCA_RATE={0x6, 0x5, {0x3, 0x1}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x810}, 0x40c4) 8.115909804s ago: executing program 0 (id=8): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a58000000060a0f0400000000000000000a00fffd0900010073797a31000000002c0004802800018007000100637400001c0002800500030001000000080002400000001008000140000000010900020073797a32"], 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) 8.115623048s ago: executing program 1 (id=9): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) fcntl$notify(0xffffffffffffffff, 0x402, 0xd) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) connect$x25(r4, &(0x7f0000000000), 0x12) 7.94320831s ago: executing program 2 (id=3): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0xb, 0x8, 0xc, 0xffffbfff, 0x1, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000810018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r1}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r3, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x177b6a8, 0x0) close(r4) 7.818287082s ago: executing program 3 (id=10): unshare(0x2020600) r0 = open$dir(&(0x7f0000000240)='.\x00', 0x0, 0x0) sync_file_range(r0, 0x5, 0x9, 0x1) 6.967873736s ago: executing program 1 (id=11): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r4}, 0x10) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000400), 0x6001) syz_open_dev$tty1(0xc, 0x4, 0x3) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000140)={0x3, 0x6}, 0x4) setsockopt$packet_fanout_data(r5, 0x107, 0x16, &(0x7f00000001c0)={0x1, &(0x7f0000000200)=[{0x9, 0x0, 0x1, 0x8000}]}, 0x10) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x85, 0x0, 0x0) 4.980956062s ago: executing program 0 (id=12): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f00000011c0), 0xffffffffffffffff) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, 0x0, 0x0) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000740), 0x0, 0x8804, 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000180)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r4, 0xc01864b0, &(0x7f0000000240)={r5, 0x0, 0x0, 0x0, 0x4}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r4, 0xc01864b0, &(0x7f0000000000)={r5, 0x0, 0x1, 0x0, 0x1000000000003}) 4.980496224s ago: executing program 3 (id=13): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockname$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000086c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000050000000900010073797a30000000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a300000000044000000060a010400000000000000000500000008000b40000000001c000480180001800d00010073796e70726f787900000000040002800900010073797a3000000000140000001100010000"], 0xb8}}, 0x0) 4.710280153s ago: executing program 1 (id=14): syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$key(0xf, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x402000, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x3, &(0x7f0000000540)=""/181, 0xffffffffffffffce) ioctl$PIO_SCRNMAP(r3, 0x4b52, &(0x7f0000000000)) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) 3.287100734s ago: executing program 0 (id=15): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={0x0, 0x0, 0x80800}) 2.055429425s ago: executing program 3 (id=16): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, 0x0) 1.902591785s ago: executing program 2 (id=17): bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_pts(0xffffffffffffffff, 0x2800) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) renameat2(0xffffffffffffffff, &(0x7f00000010c0)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffffff, 0x0, 0x3) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r6}, &(0x7f0000000000), &(0x7f0000000080)=r4}, 0x20) close(r5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) 1.778518473s ago: executing program 1 (id=18): bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r2, 0x0, 0x4008840) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x24, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}}, 0x24}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@newqdisc={0x6c, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x3c, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x4}, @TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0xd}, @TCA_CAKE_NAT={0x8}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}, @TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x1}, @TCA_CAKE_MPU={0x8, 0xe, 0x50}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000051}, 0x4000) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) bind$inet6(r0, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454da, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000ff94000000000000004f67ad790000000000000000000000c116c2d874da9ed5df41f10f9de5ed790b1e0578d943bc58516db61756acd7d70b801a85ad52e98585ca8fe2be16a5dc88e7f0c6ad8f0671b0a7213bff43c204982e1cba2c618897f73d9cd5f4edf9205e117579f17d2088c7e04f208388f3fb007b70190842bf61f49563eae9b3802225680009bc51f91982f92fa5fe79c5bf237515277ee36b06bcddf67450472d9b1563ed6f32b8"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x80400, 0x0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 1.221814175s ago: executing program 0 (id=19): syz_usb_connect$uac1(0x0, 0xa4, 0x0, 0x0) syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x0, 0x0, 0x0, 0x7995}, 0xfff7, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) 966.169845ms ago: executing program 1 (id=20): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0xff43, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) io_uring_setup(0x4b87, 0x0) r0 = syz_io_uring_setup(0x111, 0x0, &(0x7f0000000680)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) io_uring_enter(r0, 0xf000, 0x80004000, 0x4f, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) r3 = syz_open_dev$usbmon(&(0x7f0000000000), 0x40, 0x2800) ioctl$MON_IOCX_GET(r3, 0x40189206, &(0x7f00000000c0)={0x0, 0x0}) mount$cgroup(0x0, 0x0, &(0x7f00000000c0), 0x10012, &(0x7f0000000080)={[{@clone_children}]}) 71.849708ms ago: executing program 2 (id=21): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) ioctl$MON_IOCX_GETX(r3, 0x80089203, 0x0) 1.369571ms ago: executing program 3 (id=22): unshare(0x2040400) r0 = socket(0x2d, 0x2, 0x0) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, 0x0, 0x0) 0s ago: executing program 4 (id=5): syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.142' (ED25519) to the list of known hosts. [ 82.986241][ T5822] cgroup: Unknown subsys name 'net' [ 83.235467][ T5822] cgroup: Unknown subsys name 'cpuset' [ 83.271250][ T5822] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 84.967815][ T5822] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.576719][ T31] cfg80211: failed to load regulatory.db [ 87.692446][ T5839] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 87.702592][ T5846] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 87.703721][ T5846] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.704642][ T5848] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 87.705939][ T5848] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.710062][ T5848] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 87.712406][ T5848] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 87.713151][ T5848] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 87.713620][ T5848] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 87.713893][ T5848] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 87.716672][ T5848] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.718250][ T5848] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 87.718598][ T5848] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 87.719957][ T5848] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 87.724063][ T5846] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 87.860860][ T5839] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 87.877458][ T5848] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 87.878122][ T5848] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 87.880055][ T5848] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 87.890885][ T5846] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 87.902776][ T5848] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 87.903529][ T5846] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 87.903766][ T5846] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 87.905150][ T5846] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 87.905953][ T5846] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 88.757598][ T5837] chnl_net:caif_netlink_parms(): no params data found [ 88.835079][ T5840] chnl_net:caif_netlink_parms(): no params data found [ 88.848252][ T5841] chnl_net:caif_netlink_parms(): no params data found [ 89.162107][ T5845] chnl_net:caif_netlink_parms(): no params data found [ 89.179855][ T5851] chnl_net:caif_netlink_parms(): no params data found [ 89.738169][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.739050][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.739591][ T5837] bridge_slave_0: entered allmulticast mode [ 89.742273][ T5837] bridge_slave_0: entered promiscuous mode [ 89.851861][ T5839] Bluetooth: hci1: command tx timeout [ 89.910725][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.910865][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.911019][ T5837] bridge_slave_1: entered allmulticast mode [ 89.913663][ T5837] bridge_slave_1: entered promiscuous mode [ 89.930181][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.930332][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.931515][ T5840] bridge_slave_0: entered allmulticast mode [ 89.934400][ T5840] bridge_slave_0: entered promiscuous mode [ 89.935711][ T5839] Bluetooth: hci4: command tx timeout [ 89.935807][ T5839] Bluetooth: hci0: command tx timeout [ 89.935874][ T5839] Bluetooth: hci2: command tx timeout [ 89.951067][ T5841] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.951200][ T5841] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.951382][ T5841] bridge_slave_0: entered allmulticast mode [ 89.954386][ T5841] bridge_slave_0: entered promiscuous mode [ 90.010648][ T59] Bluetooth: hci3: command tx timeout [ 90.069721][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.069817][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.069925][ T5840] bridge_slave_1: entered allmulticast mode [ 90.074988][ T5840] bridge_slave_1: entered promiscuous mode [ 90.079450][ T5841] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.079600][ T5841] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.079768][ T5841] bridge_slave_1: entered allmulticast mode [ 90.083808][ T5841] bridge_slave_1: entered promiscuous mode [ 90.517145][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.753160][ T5845] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.753351][ T5845] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.753507][ T5845] bridge_slave_0: entered allmulticast mode [ 90.755989][ T5845] bridge_slave_0: entered promiscuous mode [ 90.763350][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.763581][ T5851] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.763711][ T5851] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.763869][ T5851] bridge_slave_0: entered allmulticast mode [ 90.766464][ T5851] bridge_slave_0: entered promiscuous mode [ 90.778333][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.783832][ T5841] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.790661][ T5845] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.797233][ T5845] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.797406][ T5845] bridge_slave_1: entered allmulticast mode [ 90.800081][ T5845] bridge_slave_1: entered promiscuous mode [ 90.901697][ T5851] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.901842][ T5851] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.902015][ T5851] bridge_slave_1: entered allmulticast mode [ 90.904622][ T5851] bridge_slave_1: entered promiscuous mode [ 90.909444][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.914614][ T5841] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.557124][ T5837] team0: Port device team_slave_0 added [ 91.746991][ T5845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.749632][ T5837] team0: Port device team_slave_1 added [ 91.758344][ T5851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.762467][ T5840] team0: Port device team_slave_0 added [ 91.767945][ T5841] team0: Port device team_slave_0 added [ 91.855258][ T5845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.857852][ T5851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.859662][ T5840] team0: Port device team_slave_1 added [ 91.864066][ T5841] team0: Port device team_slave_1 added [ 91.930697][ T59] Bluetooth: hci1: command tx timeout [ 92.017896][ T59] Bluetooth: hci2: command tx timeout [ 92.017926][ T59] Bluetooth: hci0: command tx timeout [ 92.017949][ T59] Bluetooth: hci4: command tx timeout [ 92.090559][ T5839] Bluetooth: hci3: command tx timeout [ 92.192158][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.192169][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.192188][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.693276][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.693292][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.693321][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.695956][ T5845] team0: Port device team_slave_0 added [ 92.698497][ T5851] team0: Port device team_slave_0 added [ 92.699473][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.699485][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.699509][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.707201][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.707215][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.707241][ T5841] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.731428][ T5845] team0: Port device team_slave_1 added [ 92.737186][ T5851] team0: Port device team_slave_1 added [ 92.738577][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.738590][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.738617][ T5841] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.963550][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.963561][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.963578][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 93.203041][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 93.203055][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 93.203071][ T5845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 93.332496][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 93.332513][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 93.332553][ T5851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 93.431823][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 93.431835][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 93.431855][ T5845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 93.535129][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 93.535144][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 93.535168][ T5851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 93.717539][ T5837] hsr_slave_0: entered promiscuous mode [ 93.718587][ T5837] hsr_slave_1: entered promiscuous mode [ 93.817905][ T5841] hsr_slave_0: entered promiscuous mode [ 93.818703][ T5841] hsr_slave_1: entered promiscuous mode [ 93.819288][ T5841] debugfs: 'hsr0' already exists in 'hsr' [ 93.819359][ T5841] Cannot create hsr debugfs directory [ 93.907885][ T5840] hsr_slave_0: entered promiscuous mode [ 93.908822][ T5840] hsr_slave_1: entered promiscuous mode [ 93.909388][ T5840] debugfs: 'hsr0' already exists in 'hsr' [ 93.909409][ T5840] Cannot create hsr debugfs directory [ 94.010620][ T5839] Bluetooth: hci1: command tx timeout [ 94.090731][ T59] Bluetooth: hci0: command tx timeout [ 94.090757][ T59] Bluetooth: hci2: command tx timeout [ 94.090909][ T5839] Bluetooth: hci4: command tx timeout [ 94.170637][ T5839] Bluetooth: hci3: command tx timeout [ 94.412823][ T5845] hsr_slave_0: entered promiscuous mode [ 94.414407][ T5845] hsr_slave_1: entered promiscuous mode [ 94.415214][ T5845] debugfs: 'hsr0' already exists in 'hsr' [ 94.415235][ T5845] Cannot create hsr debugfs directory [ 94.496920][ T5851] hsr_slave_0: entered promiscuous mode [ 94.497915][ T5851] hsr_slave_1: entered promiscuous mode [ 94.498543][ T5851] debugfs: 'hsr0' already exists in 'hsr' [ 94.498576][ T5851] Cannot create hsr debugfs directory [ 96.034015][ T5837] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 96.068411][ T5837] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 96.090745][ T5839] Bluetooth: hci1: command tx timeout [ 96.109991][ T5837] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 96.160329][ T5837] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 96.170775][ T5839] Bluetooth: hci4: command tx timeout [ 96.170801][ T5839] Bluetooth: hci2: command tx timeout [ 96.170821][ T5839] Bluetooth: hci0: command tx timeout [ 96.250661][ T5846] Bluetooth: hci3: command tx timeout [ 96.301887][ T5841] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 96.337656][ T5841] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 96.386086][ T5841] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 96.445892][ T5841] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 96.571589][ T5840] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 96.628071][ T5840] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 96.675119][ T5840] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 96.723615][ T5840] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 96.874773][ T5845] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 96.923049][ T5845] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 96.958129][ T5845] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 97.009428][ T5845] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 97.178601][ T5851] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 97.210309][ T5851] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 97.259355][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.269486][ T5851] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 97.304813][ T5851] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 97.414344][ T5837] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.477856][ T5841] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.493524][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.493680][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.540237][ T70] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.540368][ T70] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.608701][ T5841] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.634901][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.673615][ T70] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.673795][ T70] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.727757][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.727914][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.763424][ T5840] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.805054][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.805178][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.809404][ T5845] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.868162][ T774] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.868262][ T774] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.973263][ T5845] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.009252][ T5851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.033656][ T774] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.034417][ T774] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.095369][ T1288] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.095537][ T1288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.169302][ T5851] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.232890][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.233019][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.286136][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.286243][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.399966][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.771745][ T5841] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.796559][ T5837] veth0_vlan: entered promiscuous mode [ 98.821339][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.887791][ T5837] veth1_vlan: entered promiscuous mode [ 98.993541][ T5845] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.087603][ T5851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.099971][ T5841] veth0_vlan: entered promiscuous mode [ 99.113750][ T5837] veth0_macvtap: entered promiscuous mode [ 99.186289][ T5837] veth1_macvtap: entered promiscuous mode [ 99.190984][ T5840] veth0_vlan: entered promiscuous mode [ 99.214626][ T5841] veth1_vlan: entered promiscuous mode [ 99.279020][ T5840] veth1_vlan: entered promiscuous mode [ 99.324403][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.375962][ T5845] veth0_vlan: entered promiscuous mode [ 99.381069][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.426208][ T57] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.433311][ T57] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.437789][ T57] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.439028][ T5845] veth1_vlan: entered promiscuous mode [ 99.457991][ T57] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.463335][ T5841] veth0_macvtap: entered promiscuous mode [ 99.533751][ T5841] veth1_macvtap: entered promiscuous mode [ 99.609708][ T5840] veth0_macvtap: entered promiscuous mode [ 99.648499][ T5840] veth1_macvtap: entered promiscuous mode [ 99.755107][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.816962][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.827742][ T5845] veth0_macvtap: entered promiscuous mode [ 99.846085][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.846108][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.880915][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.883691][ T5845] veth1_macvtap: entered promiscuous mode [ 99.884881][ T70] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.917285][ T70] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.934279][ T70] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.959089][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.974686][ T70] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.013811][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.013827][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.074667][ T43] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.082851][ T43] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.113642][ T43] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.129678][ T43] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.179999][ T5851] veth0_vlan: entered promiscuous mode [ 100.194316][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.372113][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.340276][ T5851] veth1_vlan: entered promiscuous mode [ 101.384385][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.437408][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.455127][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.455202][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.455215][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.487931][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.591522][ T3620] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.591540][ T3620] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.735713][ T774] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.735730][ T774] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.821527][ T5851] veth0_macvtap: entered promiscuous mode [ 101.897473][ T5851] veth1_macvtap: entered promiscuous mode [ 101.959576][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.959590][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.049747][ T5956] netlink: 'syz.3.6': attribute type 10 has an invalid length. [ 102.090163][ T5956] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.105686][ T5956] bond0: (slave team0): Enslaving as an active interface with an up link [ 102.111163][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.111186][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.129852][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.257750][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.318026][ T1288] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.318048][ T1288] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.339344][ T43] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.365398][ T43] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.372453][ T43] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.396129][ T43] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.500586][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 102.590837][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 102.710498][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 104.350558][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 104.390832][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 104.390881][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 104.620498][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 105.150506][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 105.160497][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 105.170489][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 106.464875][ T157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.464893][ T157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.470531][ T5993] Zero length message leads to an empty skb [ 107.912723][ C1] vkms_vblank_simulate: vblank timer overrun [ 108.058310][ C1] vkms_vblank_simulate: vblank timer overrun [ 108.324046][ C1] vkms_vblank_simulate: vblank timer overrun [ 108.539218][ C1] vkms_vblank_simulate: vblank timer overrun [ 109.239979][ C1] vkms_vblank_simulate: vblank timer overrun [ 109.595041][ T1288] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.595084][ T1288] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.380911][ C1] vkms_vblank_simulate: vblank timer overrun [ 110.624188][ C1] vkms_vblank_simulate: vblank timer overrun [ 111.052377][ C1] vkms_vblank_simulate: vblank timer overrun [ 111.210900][ C1] vkms_vblank_simulate: vblank timer overrun [ 111.410527][ C1] vkms_vblank_simulate: vblank timer overrun [ 111.565973][ C0] ------------[ cut here ]------------ [ 111.565992][ C0] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 est_timer+0x6dc/0x9f0 [ 111.566020][ C0] Modules linked in: [ 111.566045][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 111.566061][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 111.566072][ C0] RIP: 0010:est_timer+0x6dc/0x9f0 [ 111.566088][ C0] Code: ff c7 42 80 3c 23 00 74 08 4c 89 f7 e8 7d 35 41 f9 4d 89 3e 42 80 3c 23 00 0f 85 54 ff ff ff e9 57 ff ff ff e8 95 fd e1 f8 90 <0f> 0b 90 e9 63 fd ff ff 44 89 e1 80 e1 07 38 c1 0f 8c 65 fa ff ff [ 111.566099][ C0] RSP: 0018:ffffc900001577a0 EFLAGS: 00010246 [ 111.566111][ C0] RAX: ffffffff88dc5ebb RBX: 0000000000000001 RCX: ffff88801ae85940 [ 111.566121][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 [ 111.566130][ C0] RBP: ffffc900001578b0 R08: 0000000000000000 R09: 0000000000000100 [ 111.566139][ C0] R10: dffffc0000000000 R11: fffff5200002af0a R12: 0000000000000001 [ 111.566149][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: ffff88814d4e3a68 [ 111.566158][ C0] FS: 0000000000000000(0000) GS:ffff8881268c2000(0000) knlGS:0000000000000000 [ 111.566170][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 111.566179][ C0] CR2: 00007f872cddea90 CR3: 000000003d908000 CR4: 00000000003526f0 [ 111.566191][ C0] Call Trace: [ 111.566196][ C0] [ 111.566212][ C0] ? __pfx_est_timer+0x10/0x10 [ 111.566235][ C0] call_timer_fn+0x17b/0x5f0 [ 111.566255][ C0] ? __pfx_est_timer+0x10/0x10 [ 111.566269][ C0] ? call_timer_fn+0xbe/0x5f0 [ 111.566288][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 111.566313][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 111.566350][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 111.566380][ C0] ? __pfx_est_timer+0x10/0x10 [ 111.566397][ C0] __run_timer_base+0x648/0x970 [ 111.566425][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 111.566454][ C0] run_timer_softirq+0xb7/0x180 [ 111.566472][ C0] handle_softirqs+0x22c/0x710 [ 111.566497][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 111.566523][ C0] run_ktimerd+0xcf/0x190 [ 111.566542][ C0] ? __pfx_run_ktimerd+0x10/0x10 [ 111.566560][ C0] ? schedule+0x91/0x360 [ 111.566582][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 111.566599][ C0] smpboot_thread_fn+0x542/0xa60 [ 111.566617][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 111.566641][ C0] kthread+0x711/0x8a0 [ 111.566670][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 111.566688][ C0] ? __pfx_kthread+0x10/0x10 [ 111.566713][ C0] ? __pfx_kthread+0x10/0x10 [ 111.566735][ C0] ret_from_fork+0x3fc/0x770 [ 111.566755][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 111.566778][ C0] ? __switch_to_asm+0x39/0x70 [ 111.566791][ C0] ? __switch_to_asm+0x33/0x70 [ 111.566803][ C0] ? __pfx_kthread+0x10/0x10 [ 111.566825][ C0] ret_from_fork_asm+0x1a/0x30 [ 111.566850][ C0] [ 111.566857][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 111.566866][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 111.566881][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 111.566889][ C0] Call Trace: [ 111.566894][ C0] [ 111.566899][ C0] dump_stack_lvl+0x99/0x250 [ 111.566921][ C0] ? __asan_memcpy+0x40/0x70 [ 111.566936][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 111.566957][ C0] ? __pfx__printk+0x10/0x10 [ 111.566982][ C0] vpanic+0x281/0x750 [ 111.567003][ C0] ? __pfx__printk+0x10/0x10 [ 111.567018][ C0] ? __pfx_vpanic+0x10/0x10 [ 111.567039][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 111.567067][ C0] panic+0xb9/0xc0 [ 111.567087][ C0] ? __pfx_panic+0x10/0x10 [ 111.567118][ C0] __warn+0x31b/0x4b0 [ 111.567138][ C0] ? est_timer+0x6dc/0x9f0 [ 111.567154][ C0] ? est_timer+0x6dc/0x9f0 [ 111.567168][ C0] report_bug+0x2be/0x4f0 [ 111.567185][ C0] ? est_timer+0x6dc/0x9f0 [ 111.567200][ C0] ? est_timer+0x6dc/0x9f0 [ 111.567214][ C0] ? est_timer+0x6de/0x9f0 [ 111.567229][ C0] handle_bug+0x84/0x160 [ 111.567250][ C0] exc_invalid_op+0x1a/0x50 [ 111.567271][ C0] asm_exc_invalid_op+0x1a/0x20 [ 111.567284][ C0] RIP: 0010:est_timer+0x6dc/0x9f0 [ 111.567298][ C0] Code: ff c7 42 80 3c 23 00 74 08 4c 89 f7 e8 7d 35 41 f9 4d 89 3e 42 80 3c 23 00 0f 85 54 ff ff ff e9 57 ff ff ff e8 95 fd e1 f8 90 <0f> 0b 90 e9 63 fd ff ff 44 89 e1 80 e1 07 38 c1 0f 8c 65 fa ff ff [ 111.567309][ C0] RSP: 0018:ffffc900001577a0 EFLAGS: 00010246 [ 111.567321][ C0] RAX: ffffffff88dc5ebb RBX: 0000000000000001 RCX: ffff88801ae85940 [ 111.567331][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 [ 111.567339][ C0] RBP: ffffc900001578b0 R08: 0000000000000000 R09: 0000000000000100 [ 111.567348][ C0] R10: dffffc0000000000 R11: fffff5200002af0a R12: 0000000000000001 [ 111.567358][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: ffff88814d4e3a68 [ 111.567373][ C0] ? est_timer+0x6db/0x9f0 [ 111.567402][ C0] ? __pfx_est_timer+0x10/0x10 [ 111.567424][ C0] call_timer_fn+0x17b/0x5f0 [ 111.567443][ C0] ? __pfx_est_timer+0x10/0x10 [ 111.567457][ C0] ? call_timer_fn+0xbe/0x5f0 [ 111.567475][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 111.567500][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 111.567518][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 111.567534][ C0] ? __pfx_est_timer+0x10/0x10 [ 111.567551][ C0] __run_timer_base+0x648/0x970 [ 111.567578][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 111.567607][ C0] run_timer_softirq+0xb7/0x180 [ 111.567625][ C0] handle_softirqs+0x22c/0x710 [ 111.567650][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 111.567680][ C0] run_ktimerd+0xcf/0x190 [ 111.567700][ C0] ? __pfx_run_ktimerd+0x10/0x10 [ 111.567718][ C0] ? schedule+0x91/0x360 [ 111.567740][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 111.567756][ C0] smpboot_thread_fn+0x542/0xa60 [ 111.567775][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 111.567799][ C0] kthread+0x711/0x8a0 [ 111.567822][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 111.567840][ C0] ? __pfx_kthread+0x10/0x10 [ 111.567865][ C0] ? __pfx_kthread+0x10/0x10 [ 111.567887][ C0] ret_from_fork+0x3fc/0x770 [ 111.567907][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 111.567930][ C0] ? __switch_to_asm+0x39/0x70 [ 111.567942][ C0] ? __switch_to_asm+0x33/0x70 [ 111.567955][ C0] ? __pfx_kthread+0x10/0x10 [ 111.567977][ C0] ret_from_fork_asm+0x1a/0x30 [ 111.568002][ C0] [ 111.568355][ C0] Kernel Offset: disabled