last executing test programs: 1.351619307s ago: executing program 2 (id=6): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb) write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8) 1.324761084s ago: executing program 0 (id=1): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000700)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in=@local, 0x4d2, 0x32}, @in=@remote, {0x7fffffffffffffff, 0x7fffffffffffffff, 0x7fffffffffffffff, 0x7fffffffffffffff}, {}, {}, 0x0, 0x0, 0x2, 0x5}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @sa_dir={0x5, 0x21, 0x1}, @iptfs_drop_time={0x8, 0x24, 0x2710}, @iptfs_reorder_window={0x6, 0x25, 0x3}]}, 0x150}}, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @esp={{0x5, 0x4, 0x0, 0x0, 0x26, 0x0, 0x0, 0x40, 0x32, 0x0, @remote, @local}, {0x4d2, 0x1, @basic={0x0, 0x0, 0x0, [@runt="00112233"]}}}}}}, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000200)={@local, @empty, @void, {@ipv4={0x800, @esp={{0x5, 0x4, 0x0, 0x0, 0x26, 0x0, 0x0, 0x40, 0x32, 0x0, @remote, @local}, {0x4d2, 0x3, @basic={0x0, 0x0, 0x0, [@runt="00112233"]}}}}}}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) 1.242213147s ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='tcp 2049\x00', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='1\x00', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000200)='127.0.0.1:/\x00', &(0x7f00000001c0)='./mnt\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='vers=4.1,proto=tcp,addr=127.0.0.1,port=2049,clientaddr=127.0.0.1\x00']) 1.241822287s ago: executing program 2 (id=17): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb) write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8) 1.179739274s ago: executing program 0 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='-2 -3 +4.0\n\x00', 0xb) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='tcp 2049\n\x00', 0x9) close(r1) r2 = socket$inet(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000300)={0x2, 0x801}, 0x10) close(r2) 1.158425221s ago: executing program 2 (id=10): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000400)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x2c, r1, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x14}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth0_to_batadv\x00', 0x0}) sendto$packet(r3, &(0x7f0000000200)="ffffffffffff0011223344554305000f32000000000100112233445500112233445500ff000c010100080000271000002710", 0x32, 0x0, &(0x7f0000000180)={0x11, 0x4305, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 1.082190651s ago: executing program 3 (id=12): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/net/can/stats\x00', 0x0, 0x0) read(r0, &(0x7f0000000100)=""/4096, 0x1000) 1.059697577s ago: executing program 3 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='-4\n', 0x3) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) 976.304651ms ago: executing program 0 (id=14): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80, 0x1000000, 0x8, 0x1}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {0x0, 0xb}, {0x7, 0xffe0}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x81}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008881}, 0x20002010) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05", 0x1, 0x20000005, &(0x7f0000000140)={0x11, 0x7, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 975.209611ms ago: executing program 4 (id=15): setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/x25/x25_forward\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='1\n\x00', 0x2) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1}) ioctl$TUNSETLINK(r2, 0x400454cd, 0x10f) r3 = socket(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', 0x1}) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_x25_SIOCADDRT(r4, 0x890b, &(0x7f0000000300)={@null, 0x0, 'syzkaller1\x00'}) 829.747171ms ago: executing program 1 (id=18): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x1001001}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010006000d0000000000010000000000000001410000001c001700000000000000006574683a73797a5f74756e"], 0x38}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000002b00)=ANY=[@ANYBLOB="ffffffffffffaabbccddeeff88ca5b5000282d000000000000000000aaaa000012670000f5010000aabbccddeeff"], 0x0) 829.512791ms ago: executing program 3 (id=19): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='280', 0x3) unshare(0x40000000) 751.083783ms ago: executing program 1 (id=20): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0) read(r1, &(0x7f0000000100)=""/100, 0x64) close(r1) 714.199923ms ago: executing program 1 (id=21): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb) write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8) 511.489819ms ago: executing program 4 (id=22): r0 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$6lowpan_enable(r0, &(0x7f0000000040)='1', 0x1) syz_emit_vhci(&(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x1, 0xa}, {0x23, 0x40, 0x500, 0x100, 0xa}}}}, 0x17) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$6lowpan_control(r1, &(0x7f0000000300)='connect aa:aa:aa:aa:aa:11 1', 0x1b) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) 270.802266ms ago: executing program 2 (id=23): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/kmsg\x00', 0x800, 0x0) read(r0, &(0x7f0000000180)=""/1000, 0x3e8) 270.660096ms ago: executing program 3 (id=24): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10) connect$inet(r0, &(0x7f00000002c0)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000300)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10) 266.541276ms ago: executing program 1 (id=33): setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/x25/x25_forward\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='1\n\x00', 0x2) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1}) ioctl$TUNSETLINK(r2, 0x400454cd, 0x10f) r3 = socket(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', 0x1}) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_x25_SIOCADDRT(r4, 0x890b, &(0x7f0000000300)={@null, 0x0, 'syzkaller1\x00'}) write$tun(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb) 240.691134ms ago: executing program 3 (id=25): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/sctp/addip_enable\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='1\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/sctp/addip_noauth_enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='1\n', 0x2) r2 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) listen(r2, 0x5) r3 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r3, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10) connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e20, @loopback}, 0x10) 225.879868ms ago: executing program 2 (id=26): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x32}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x94}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r1, &(0x7f0000000100)='\x00\x00', 0x4, 0x0, &(0x7f0000000200)={0x2, 0x3039, @loopback}, 0x10) 207.693473ms ago: executing program 3 (id=27): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='tcp 2049\x00', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='1\x00', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000200)='127.0.0.1:/\x00', &(0x7f00000001c0)='./mnt\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='vers=4.1,proto=tcp,addr=127.0.0.1,port=2049,clientaddr=127.0.0.1\x00']) 169.069904ms ago: executing program 2 (id=28): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc4010203010902120001000000000904"], 0x0) r1 = syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x3f0, 0x4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x40, 0xff, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x1, 0x5, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0xa, 0x7, 0x1}}, [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x9, 0x8, 0x9b}}]}}}]}}]}}, &(0x7f0000000880)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x300, 0xdf, 0x4, 0x4, 0x10, 0xe0}, 0x44, &(0x7f0000000480)={0x5, 0xf, 0x44, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x9, 0x50, 0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "e1993ec923673c0e7c55a7a0a9192d5e"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xa, 0x7, 0x81, 0x4}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x21, "011f47be2e9c7fece9c1b46e8d879d5d"}]}, 0x6, [{0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x4001}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x80a}}, {0x8b, &(0x7f00000006c0)=@string={0x8b, 0x3, "305ece7917465f78ee20b542580282849bef5c23e5263a0d30be676f411957df05fd17ba2f513fa27425f047ce8fb6d4d6d0ece065718a635a3624f2f6d9195c1ec542998b52ba74565690f4a3d58d2966315c6fdf7e44d05c0f8b4fab2fae7c4136c81abaadd9478bc97b94e4887bee0a3a7e964761e9b4d44f907cf0825e5816233f4663906c6c92"}}, {0x76, &(0x7f0000000780)=@string={0x76, 0x3, "0f615b9394a7acaee65014bb15e4b95018bf8e0670686557ed92d57d1de7eaa7efd117011beebb7e9faeca38e5c1a02af459a0ad03201f02a0b9cb2c9436d9c8126fd2f08a0599d1d18e81d56c01f45a5300bc3356d5930fc718133c236dbf3b9ba816f92fccfcafa6ca5fc8fcffb85631cc27b5"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x458}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x4001}}]}) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$video(&(0x7f00000003c0), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000002c0)={0x1, @pix_mp={0x6dc, 0xdaf1, 0x59555956, 0x2, 0x1, [{0x1, 0x1}, {0x3, 0xa}, {0x10001, 0x200}, {0xc061, 0x5}, {0xfffffff8, 0x7}, {0x1, 0xc00}, {0x4, 0x8}, {0x3, 0x400}], 0x0, 0x9b, 0x0, 0x0, 0x5}}) r3 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e23, 0x20002, @empty, 0x80}, @in6={0xa, 0x0, 0xffffffff, @empty}], 0x38) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="5801000010000500010000000000000000000000000000000000000000000001fc02000000000000000000000000000000000000000000000a00808000000000", @ANYRES32=0x0, @ANYRES32=0x80, @ANYBLOB="0000000000000000000000000000000100001234330000000000000000000000000007ba92bd0001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000fdffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000800000000000000048000100686d6163287368613129000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004a65790d959b70aa000000002000170001000000000000000000000000000000000000002000000000000000"], 0x158}, 0x1, 0x0, 0x0, 0x20040004}, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) r6 = open_tree(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x8801) ioctl$SNDRV_TIMER_IOCTL_START(r6, 0x54a0) sendmsg$nl_xfrm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1}, {0x0, 0x400000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@mcast1}]}]}, 0xfc}}, 0x20004048) sendmmsg$inet6(r4, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000680)='A', 0x1}], 0x1}}], 0x1, 0x4000801) 86.420407ms ago: executing program 1 (id=29): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb) write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8) 0s ago: executing program 1 (id=30): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='3\x00', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='1\x00', 0x2) close(r2) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.5' (ED25519) to the list of known hosts. [ 28.936921][ T4316] cgroup: Unknown subsys name 'net' [ 29.228695][ T4316] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 29.513541][ T4316] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 30.259099][ T4331] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 30.260965][ T4336] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 30.263408][ T4331] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 30.265191][ T4331] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 30.267016][ T4331] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 30.268654][ T4331] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 30.269933][ T4331] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 30.271620][ T4336] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 30.273039][ T4336] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 30.274310][ T4336] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 30.275912][ T4331] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 30.279513][ T4336] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 30.292986][ T4329] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 30.294583][ T4329] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 30.296382][ T4329] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 30.298011][ T4329] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 30.299668][ T4329] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 30.299717][ T4334] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 30.302345][ T4334] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 30.304276][ T4334] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 30.306149][ T4334] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 30.316645][ T4341] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 30.318529][ T4334] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 30.320098][ T4341] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 30.320310][ T4334] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 30.323036][ T4334] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 30.324540][ T4334] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 30.336323][ T4334] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 30.338489][ T4331] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 30.339883][ T4331] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 30.439061][ T4328] chnl_net:caif_netlink_parms(): no params data found [ 30.469136][ T4335] chnl_net:caif_netlink_parms(): no params data found [ 30.495852][ T4338] chnl_net:caif_netlink_parms(): no params data found [ 30.500010][ T4332] chnl_net:caif_netlink_parms(): no params data found [ 30.502089][ T4337] chnl_net:caif_netlink_parms(): no params data found [ 30.506413][ T4328] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.507744][ T4328] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.509321][ T4328] device bridge_slave_0 entered promiscuous mode [ 30.512625][ T4328] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.513859][ T4328] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.515435][ T4328] device bridge_slave_1 entered promiscuous mode [ 30.536875][ T4335] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.538243][ T4335] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.539823][ T4335] device bridge_slave_0 entered promiscuous mode [ 30.550513][ T4335] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.551753][ T4335] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.553296][ T4335] device bridge_slave_1 entered promiscuous mode [ 30.558209][ T4328] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.568105][ T4328] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.589887][ T4337] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.591198][ T4337] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.592703][ T4337] device bridge_slave_0 entered promiscuous mode [ 30.594733][ T4338] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.595933][ T4338] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.597800][ T4338] device bridge_slave_0 entered promiscuous mode [ 30.599808][ T4332] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.601144][ T4332] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.602901][ T4332] device bridge_slave_0 entered promiscuous mode [ 30.607904][ T4335] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.609512][ T4332] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.610775][ T4332] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.612450][ T4332] device bridge_slave_1 entered promiscuous mode [ 30.615852][ T4337] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.619130][ T4337] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.620693][ T4337] device bridge_slave_1 entered promiscuous mode [ 30.622085][ T4338] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.623267][ T4338] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.624828][ T4338] device bridge_slave_1 entered promiscuous mode [ 30.627792][ T4328] team0: Port device team_slave_0 added [ 30.630264][ T4335] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.637366][ T4332] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.641535][ T4328] team0: Port device team_slave_1 added [ 30.648701][ T4332] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.658986][ T4335] team0: Port device team_slave_0 added [ 30.660981][ T4335] team0: Port device team_slave_1 added [ 30.663292][ T4337] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.669919][ T4338] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.678654][ T4337] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.683143][ T4328] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.684400][ T4328] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.689922][ T4328] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.693157][ T4338] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.698908][ T4335] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.700128][ T4335] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.704495][ T4335] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.707959][ T4332] team0: Port device team_slave_0 added [ 30.709746][ T4332] team0: Port device team_slave_1 added [ 30.713012][ T4328] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.714233][ T4328] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.720843][ T4328] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.727739][ T4335] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.728990][ T4335] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.733119][ T4335] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.738038][ T4337] team0: Port device team_slave_0 added [ 30.747798][ T4337] team0: Port device team_slave_1 added [ 30.749240][ T4332] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.750431][ T4332] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.754548][ T4332] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.757303][ T4332] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.758436][ T4332] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.762657][ T4332] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.768008][ T4338] team0: Port device team_slave_0 added [ 30.770647][ T4338] team0: Port device team_slave_1 added [ 30.817435][ T4335] device hsr_slave_0 entered promiscuous mode [ 30.856147][ T4335] device hsr_slave_1 entered promiscuous mode [ 30.896473][ T4337] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.897684][ T4337] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.901805][ T4337] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.910419][ T4338] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.911709][ T4338] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.917810][ T4338] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.920079][ T4337] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.921383][ T4337] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.925792][ T4337] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.957104][ T4328] device hsr_slave_0 entered promiscuous mode [ 30.996256][ T4328] device hsr_slave_1 entered promiscuous mode [ 31.036077][ T4328] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 31.037482][ T4328] Cannot create hsr debugfs directory [ 31.048377][ T4338] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.049610][ T4338] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 31.053879][ T4338] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.097125][ T4332] device hsr_slave_0 entered promiscuous mode [ 31.136212][ T4332] device hsr_slave_1 entered promiscuous mode [ 31.186014][ T4332] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 31.187360][ T4332] Cannot create hsr debugfs directory [ 31.247224][ T4337] device hsr_slave_0 entered promiscuous mode [ 31.286270][ T4337] device hsr_slave_1 entered promiscuous mode [ 31.336059][ T4337] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 31.337381][ T4337] Cannot create hsr debugfs directory [ 31.369470][ T4338] device hsr_slave_0 entered promiscuous mode [ 31.408546][ T4338] device hsr_slave_1 entered promiscuous mode [ 31.446089][ T4338] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 31.447335][ T4338] Cannot create hsr debugfs directory [ 31.552018][ T4335] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 31.619091][ T4335] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 31.660714][ T4335] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 31.707305][ T4335] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 31.750944][ T4328] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 31.787265][ T4328] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 31.831864][ T4328] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 31.870602][ T4328] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 31.922384][ T4332] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 31.963177][ T4332] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 31.991270][ T4332] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 32.037199][ T4332] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 32.109913][ T4337] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 32.147119][ T4337] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 32.202123][ T4337] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 32.237265][ T4337] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 32.292247][ T4338] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 32.316151][ T4331] Bluetooth: hci4: command 0x0409 tx timeout [ 32.326338][ T4331] Bluetooth: hci1: command 0x0409 tx timeout [ 32.326349][ T48] Bluetooth: hci0: command 0x0409 tx timeout [ 32.358064][ T4338] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 32.406070][ T4334] Bluetooth: hci3: command 0x0409 tx timeout [ 32.407236][ T4334] Bluetooth: hci2: command 0x0409 tx timeout [ 32.423445][ T4335] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.424757][ T4338] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 32.488050][ T4338] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 32.553880][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.555853][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.562570][ T4328] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.569182][ T4335] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.580509][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.582567][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.584183][ T4373] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.585372][ T4373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.587829][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.589454][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.591046][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 32.593824][ T4328] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.612710][ T4332] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.614486][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.616657][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.618117][ T1654] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.619384][ T1654] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.620808][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 32.631696][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.633412][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.635420][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.636800][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.639466][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.641078][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.642540][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.643845][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.653470][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 32.655287][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 32.658439][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 32.660215][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 32.661932][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 32.663671][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 32.672988][ T4332] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.678972][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 32.680843][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 32.682688][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 32.684532][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 32.687172][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 32.688750][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.690164][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.691676][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.693229][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.695009][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.696254][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.698232][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 32.699963][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 32.701653][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 32.703181][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 32.706886][ T4337] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.709738][ T104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.711348][ T104] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.712801][ T104] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.713990][ T104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.721588][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.723300][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.725199][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.727721][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.731965][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 32.733651][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.735265][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.741897][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.743631][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.745192][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 32.749889][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 32.752159][ T4335] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 32.761637][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.763272][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.764864][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 32.768367][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 32.770098][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 32.771733][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 32.773654][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.775213][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.777890][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.779505][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.783668][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 32.785673][ T4332] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 32.788066][ T4337] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.793155][ T104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.794891][ T104] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.799597][ T104] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.800835][ T104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.802856][ T104] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 32.813417][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.815116][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.819276][ T1654] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.820539][ T1654] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.822018][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 32.823836][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 32.825693][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 32.829716][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 32.831444][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 32.833356][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 32.839302][ T4338] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.849101][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 32.850781][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.852322][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.859895][ T4337] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 32.862141][ T4337] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 32.871113][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.872859][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.874299][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.875813][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.880070][ T4338] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.884969][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.886734][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.888313][ T4387] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.889633][ T4387] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.891551][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 32.896525][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.898349][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.909111][ T4387] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.910326][ T4387] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.913932][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 32.928974][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 32.931043][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 32.937525][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 32.943714][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 32.953069][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 32.954595][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 32.957758][ T4335] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.963585][ T4332] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.970308][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 32.971773][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 32.973014][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.974691][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.981710][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 32.984046][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 32.985668][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.990962][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.992601][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.994396][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.997865][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 33.004759][ T4328] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.011615][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 33.013065][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 33.022173][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 33.023530][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 33.027461][ T4337] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.034496][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.036371][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.038381][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.040080][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.047159][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.048846][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.055280][ T4335] device veth0_vlan entered promiscuous mode [ 33.058801][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.060501][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.074152][ T4335] device veth1_vlan entered promiscuous mode [ 33.078831][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.080504][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.082107][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.083740][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.085337][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.094399][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.097553][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.102494][ T4332] device veth0_vlan entered promiscuous mode [ 33.120345][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.122350][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.124034][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.125649][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.128617][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.130352][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.131852][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.133301][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.134726][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.141973][ T4328] device veth0_vlan entered promiscuous mode [ 33.144000][ T4332] device veth1_vlan entered promiscuous mode [ 33.145532][ T4337] device veth0_vlan entered promiscuous mode [ 33.151868][ T4337] device veth1_vlan entered promiscuous mode [ 33.159617][ T4328] device veth1_vlan entered promiscuous mode [ 33.162808][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.164536][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.167742][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.169406][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.170951][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.172427][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 33.173868][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 33.182030][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.183672][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.185346][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.190072][ T4335] device veth0_macvtap entered promiscuous mode [ 33.192661][ T4335] device veth1_macvtap entered promiscuous mode [ 33.199273][ T4338] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.211198][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.212903][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.214428][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.217578][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.219777][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.221485][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.223940][ T4328] device veth0_macvtap entered promiscuous mode [ 33.229859][ T4337] device veth0_macvtap entered promiscuous mode [ 33.232093][ T4332] device veth0_macvtap entered promiscuous mode [ 33.233529][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.235194][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.237757][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.239410][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.241304][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.245784][ T4335] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.248935][ T4337] device veth1_macvtap entered promiscuous mode [ 33.252159][ T4328] device veth1_macvtap entered promiscuous mode [ 33.253781][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.255336][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.258879][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.260671][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.269632][ T4332] device veth1_macvtap entered promiscuous mode [ 33.274555][ T4335] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.279459][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.281074][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.282724][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.294637][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.297624][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.306749][ T4337] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.308649][ T4335] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.310103][ T4335] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.311431][ T4335] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.313206][ T4335] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.317833][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.319810][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.321512][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.323251][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.325898][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.328831][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.330518][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.332188][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.333855][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.337082][ T4332] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.338892][ T4332] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.340638][ T4332] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.342382][ T4332] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.344104][ T4332] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.345864][ T4332] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.349565][ T4332] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.351334][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.353136][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.355640][ T4337] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.359522][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.361122][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.362856][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.364600][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.369355][ T4337] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.370890][ T4337] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.372377][ T4337] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.373891][ T4337] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.379985][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.381873][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.383585][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.385490][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.388837][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.390108][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.391923][ T4387] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.409052][ T4328] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.410632][ T4328] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.412231][ T4328] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.413766][ T4328] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.419184][ T4332] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.420973][ T4332] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.422628][ T4332] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.424400][ T4332] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.426469][ T4332] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.428317][ T4332] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.431452][ T4332] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.444486][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.446332][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.447964][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.449708][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.467666][ T4332] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.469309][ T4332] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.471039][ T4332] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.472731][ T4332] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.485057][ T4338] device veth0_vlan entered promiscuous mode [ 33.492949][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.494667][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.498887][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.500284][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.503875][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.505255][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.508685][ T1654] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.510152][ T1654] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.516528][ T4338] device veth1_vlan entered promiscuous mode [ 33.524673][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.527972][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.529597][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.539552][ T1654] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.541070][ T1654] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.544187][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 33.553881][ T4373] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.555313][ T4373] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.565056][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 33.582044][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.583535][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.587300][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.600562][ T4338] device veth0_macvtap entered promiscuous mode [ 33.602503][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.604310][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.612344][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.615406][ T4338] device veth1_macvtap entered promiscuous mode [ 33.621466][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.623261][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.624944][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.628207][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.630005][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.637685][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.639421][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.641271][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.641796][ T4408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.643797][ T4338] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.646967][ T4408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.655037][ T4408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.658534][ T4408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.659990][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.661641][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.663372][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.674581][ T4410] tipc: Started in network mode [ 33.675583][ T4410] tipc: Node identity 4, cluster identity 4711 [ 33.678243][ T4410] tipc: Node number set to 4 [ 33.682064][ T1654] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.682842][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.683363][ T1654] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.685323][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.686844][ T4373] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.689555][ T4373] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.689821][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.692724][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.694423][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.698218][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.700218][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.702104][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.705037][ T4338] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.709864][ T4410] tipc: Enabled bearer , priority 0 [ 33.718803][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 33.720437][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.722085][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.723733][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.727099][ T4338] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.728880][ T4338] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.730417][ T4338] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.732079][ T4338] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.735015][ T4410] tipc: Disabling bearer [ 33.747510][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.748825][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.750270][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 33.799245][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.801147][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.802800][ T1654] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.815214][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.817161][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.818169][ T4416] tipc: Started in network mode [ 33.819273][ T4416] tipc: Node identity 1001001, cluster identity 4711 [ 33.820532][ T4416] tipc: Node number set to 16781313 [ 33.822097][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 33.823950][ T4416] tipc: Enabled bearer , priority 0 [ 33.907296][ T4422] svc: failed to register lockdv1 RPC service (errno 111). [ 33.908706][ T4422] lockd_up: makesock failed, error=-111 [ 34.111608][ T4442] svc: failed to register nfsdv3 RPC service (errno 111). [ 34.113385][ T4442] svc: failed to register nfsaclv3 RPC service (errno 111). [ 34.289599][ T4453] FAULT_INJECTION: forcing a failure. [ 34.289599][ T4453] name failslab, interval 1, probability 0, space 0, times 1 [ 34.292067][ T4453] CPU: 1 PID: 4453 Comm: syz.3.19 Not tainted syzkaller #0 [ 34.293212][ T4453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 34.294883][ T4453] Call trace: [ 34.295480][ T4453] dump_backtrace+0x1c4/0x1f0 [ 34.296351][ T4453] show_stack+0x2c/0x3c [ 34.297089][ T4453] __dump_stack+0x30/0x40 [ 34.297899][ T4453] dump_stack_lvl+0xf4/0x15c [ 34.298756][ T4453] dump_stack+0x1c/0x5c [ 34.299528][ T4453] should_fail_ex+0x3cc/0x524 [ 34.300401][ T4453] __should_failslab+0xc0/0x11c [ 34.301294][ T4453] should_failslab+0x10/0x28 [ 34.302167][ T4453] __kmem_cache_alloc_node+0x7c/0x318 [ 34.303224][ T4453] kmalloc_trace+0x48/0x94 [ 34.304105][ T4453] gate_init_net+0x70/0x19c [ 34.304942][ T4453] ops_init+0x2b0/0x53c [ 34.305717][ T4453] setup_net+0x494/0xb6c [ 34.306512][ T4453] copy_net_ns+0x2b8/0x578 [ 34.307356][ T4453] create_new_namespaces+0x30c/0x604 [ 34.308336][ T4453] unshare_nsproxy_namespaces+0x108/0x160 [ 34.309405][ T4453] ksys_unshare+0x3f0/0x70c [ 34.310248][ T4453] __arm64_sys_unshare+0x3c/0x50 [ 34.311149][ T4453] invoke_syscall+0x98/0x290 [ 34.311965][ T4453] el0_svc_common+0x13c/0x258 [ 34.312836][ T4453] do_el0_svc+0x5c/0x134 [ 34.313653][ T4453] el0_svc+0x58/0x128 [ 34.314386][ T4453] el0t_64_sync_handler+0x84/0xf0 [ 34.315335][ T4453] el0t_64_sync+0x18c/0x190 [ 34.319479][ T4448] device syzkaller0 entered promiscuous mode [ 34.326749][ T4454] tipc: Started in network mode [ 34.327703][ T4454] tipc: Node identity 1001001, cluster identity 4711 [ 34.328866][ T4454] tipc: Node number set to 16781313 [ 34.341458][ T4454] tipc: Enabled bearer , priority 0 [ 34.396187][ T48] Bluetooth: hci0: command 0x041b tx timeout [ 34.397353][ T48] Bluetooth: hci1: command 0x041b tx timeout [ 34.398433][ T48] Bluetooth: hci4: command 0x041b tx timeout [ 34.476742][ T4334] Bluetooth: hci2: command 0x041b tx timeout [ 34.479232][ T48] Bluetooth: hci3: command 0x041b tx timeout [ 34.951896][ T4502] svc: failed to register lockdv1 RPC service (errno 111). [ 34.952023][ T4505] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.963926][ T4505] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.970037][ T4505] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.971674][ T4505] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.143832][ T4524] svc: failed to register nfsdv3 RPC service (errno 111). [ 35.145839][ T4524] svc: failed to register nfsaclv3 RPC service (errno 111). [ 35.153522][ T4524] ================================================================== [ 35.154891][ T4524] BUG: KASAN: use-after-free in nfsd_create_serv+0x104/0x6a4 [ 35.156431][ T4524] Write of size 4 at addr ffff0000d6b84050 by task syz.1.30/4524 [ 35.158036][ T4524] [ 35.158529][ T4524] CPU: 1 PID: 4524 Comm: syz.1.30 Not tainted syzkaller #0 [ 35.160027][ T4524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 35.161952][ T4524] Call trace: [ 35.162570][ T4524] dump_backtrace+0x1c4/0x1f0 [ 35.163429][ T4524] show_stack+0x2c/0x3c [ 35.164224][ T4524] __dump_stack+0x30/0x40 [ 35.165067][ T4524] dump_stack_lvl+0xf4/0x15c [ 35.165970][ T4524] print_address_description+0x88/0x218 [ 35.167048][ T4524] print_report+0x50/0x68 [ 35.167899][ T4524] kasan_report+0xa8/0xfc [ 35.168743][ T4524] kasan_check_range+0x258/0x290 [ 35.169685][ T4524] __kasan_check_write+0x2c/0x3c [ 35.170651][ T4524] nfsd_create_serv+0x104/0x6a4 [ 35.171541][ T4524] nfsd_svc+0x168/0x948 [ 35.172326][ T4524] write_threads+0x2b4/0x310 [ 35.173190][ T4524] nfsctl_transaction_write+0x114/0x164 [ 35.174126][ T4524] vfs_write+0x2a8/0x7c8 [ 35.174869][ T4524] ksys_write+0x12c/0x228 [ 35.175602][ T4524] __arm64_sys_write+0x7c/0x90 [ 35.176438][ T4524] invoke_syscall+0x98/0x290 [ 35.177274][ T4524] el0_svc_common+0x13c/0x258 [ 35.178138][ T4524] do_el0_svc+0x5c/0x134 [ 35.178903][ T4524] el0_svc+0x58/0x128 [ 35.179626][ T4524] el0t_64_sync_handler+0x84/0xf0 [ 35.180534][ T4524] el0t_64_sync+0x18c/0x190 [ 35.181346][ T4524] [ 35.181766][ T4524] Allocated by task 4524: [ 35.182541][ T4524] kasan_set_track+0x4c/0x80 [ 35.183418][ T4524] kasan_save_alloc_info+0x24/0x30 [ 35.184335][ T4524] __kasan_kmalloc+0xa0/0xb8 [ 35.185144][ T4524] kmalloc_trace+0x7c/0x94 [ 35.185938][ T4524] __svc_create+0x80/0x89c [ 35.186759][ T4524] svc_create_pooled+0x648/0x7d8 [ 35.187689][ T4524] nfsd_create_serv+0x284/0x6a4 [ 35.188606][ T4524] write_ports+0x3b8/0x9f0 [ 35.189429][ T4524] nfsctl_transaction_write+0x114/0x164 [ 35.190459][ T4524] vfs_write+0x2a8/0x7c8 [ 35.191263][ T4524] ksys_write+0x12c/0x228 [ 35.192117][ T4524] __arm64_sys_write+0x7c/0x90 [ 35.193003][ T4524] invoke_syscall+0x98/0x290 [ 35.193840][ T4524] el0_svc_common+0x13c/0x258 [ 35.194701][ T4524] do_el0_svc+0x5c/0x134 [ 35.195459][ T4524] el0_svc+0x58/0x128 [ 35.196187][ T4524] el0t_64_sync_handler+0x84/0xf0 [ 35.197140][ T4524] el0t_64_sync+0x18c/0x190 [ 35.197969][ T4524] [ 35.198413][ T4524] Freed by task 4524: [ 35.199145][ T4524] kasan_set_track+0x4c/0x80 [ 35.200004][ T4524] kasan_save_free_info+0x38/0x5c [ 35.200940][ T4524] ____kasan_slab_free+0x148/0x1b0 [ 35.201851][ T4524] __kasan_slab_free+0x18/0x28 [ 35.202737][ T4524] slab_free_freelist_hook+0x16c/0x1e8 [ 35.203735][ T4524] __kmem_cache_free+0xbc/0x21c [ 35.204579][ T4524] kfree+0xd0/0x1a8 [ 35.205319][ T4524] svc_destroy+0x144/0x184 [ 35.206119][ T4524] write_ports+0x7dc/0x9f0 [ 35.206914][ T4524] nfsctl_transaction_write+0x114/0x164 [ 35.207915][ T4524] vfs_write+0x2a8/0x7c8 [ 35.208678][ T4524] ksys_write+0x12c/0x228 [ 35.209457][ T4524] __arm64_sys_write+0x7c/0x90 [ 35.210319][ T4524] invoke_syscall+0x98/0x290 [ 35.211130][ T4524] el0_svc_common+0x13c/0x258 [ 35.211961][ T4524] do_el0_svc+0x5c/0x134 [ 35.212729][ T4524] el0_svc+0x58/0x128 [ 35.213455][ T4524] el0t_64_sync_handler+0x84/0xf0 [ 35.214420][ T4524] el0t_64_sync+0x18c/0x190 [ 35.215274][ T4524] [ 35.215700][ T4524] The buggy address belongs to the object at ffff0000d6b84000 [ 35.215700][ T4524] which belongs to the cache kmalloc-512 of size 512 [ 35.218134][ T4524] The buggy address is located 80 bytes inside of [ 35.218134][ T4524] 512-byte region [ffff0000d6b84000, ffff0000d6b84200) [ 35.220387][ T4524] [ 35.220791][ T4524] The buggy address belongs to the physical page: [ 35.221937][ T4524] page:000000003468deb1 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116b84 [ 35.223804][ T4524] head:000000003468deb1 order:2 compound_mapcount:0 compound_pincount:0 [ 35.225317][ T4524] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 35.226791][ T4524] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002600 [ 35.228372][ T4524] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 35.229940][ T4524] page dumped because: kasan: bad access detected [ 35.231101][ T4524] [ 35.231550][ T4524] Memory state around the buggy address: [ 35.232591][ T4524] ffff0000d6b83f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.234065][ T4524] ffff0000d6b83f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.235530][ T4524] >ffff0000d6b84000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.237002][ T4524] ^ [ 35.238234][ T4524] ffff0000d6b84080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.239738][ T4524] ffff0000d6b84100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.241250][ T4524] ================================================================== [ 35.252377][ T4524] Disabling lock debugging due to kernel taint [ 35.253577][ T4524] ------------[ cut here ]------------ [ 35.254470][ T4524] refcount_t: addition on 0; use-after-free. [ 35.255768][ T4524] WARNING: CPU: 1 PID: 4524 at lib/refcount.c:25 refcount_warn_saturate+0x134/0x1f8 [ 35.257468][ T4524] Modules linked in: [ 35.258190][ T4524] CPU: 1 PID: 4524 Comm: syz.1.30 Tainted: G B syzkaller #0 [ 35.259776][ T4524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 35.261586][ T4524] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 35.263010][ T4524] pc : refcount_warn_saturate+0x134/0x1f8 [ 35.264048][ T4524] lr : refcount_warn_saturate+0x134/0x1f8 [ 35.265120][ T4524] sp : ffff800021657780 [ 35.265908][ T4524] x29: ffff800021657780 x28: dfff800000000000 x27: 1fffe0001e2c1858 [ 35.267336][ T4524] x26: ffff0000f160c2c0 x25: ffff8000216577c0 x24: dfff800000000000 [ 35.268847][ T4524] x23: ffff7000042caef8 x22: ffff80001c772000 x21: ffff0000d5c8d4c0 [ 35.270409][ T4524] x20: ffff0000d6b84050 x19: ffff800017d98000 x18: 1fffe00033e6db7e [ 35.271973][ T4524] x17: ffff8000153bd000 x16: ffff800008043b30 x15: 0000000040000000 [ 35.273559][ T4524] x14: 0000000000000001 x13: 1fffe00033e70270 x12: 0000000000000000 [ 35.275095][ T4524] x11: ff00800008048e14 x10: 0000000040000002 x9 : 997e44ea7ecb7100 [ 35.276678][ T4524] x8 : 997e44ea7ecb7100 x7 : ffff800011d1c160 x6 : ffff80000825ab20 [ 35.278211][ T4524] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 [ 35.279712][ T4524] x2 : ffff800021657340 x1 : 0000000000000000 x0 : ffff80000825abb4 [ 35.281265][ T4524] Call trace: [ 35.281901][ T4524] refcount_warn_saturate+0x134/0x1f8 [ 35.282883][ T4524] nfsd_create_serv+0x510/0x6a4 [ 35.283774][ T4524] nfsd_svc+0x168/0x948 [ 35.284565][ T4524] write_threads+0x2b4/0x310 [ 35.285451][ T4524] nfsctl_transaction_write+0x114/0x164 [ 35.286503][ T4524] vfs_write+0x2a8/0x7c8 [ 35.287308][ T4524] ksys_write+0x12c/0x228 [ 35.288104][ T4524] __arm64_sys_write+0x7c/0x90 [ 35.289053][ T4524] invoke_syscall+0x98/0x290 [ 35.289966][ T4524] el0_svc_common+0x13c/0x258 [ 35.290873][ T4524] do_el0_svc+0x5c/0x134 [ 35.291664][ T4524] el0_svc+0x58/0x128 [ 35.292431][ T4524] el0t_64_sync_handler+0x84/0xf0 [ 35.293371][ T4524] el0t_64_sync+0x18c/0x190 [ 35.294187][ T4524] irq event stamp: 2767 [ 35.294925][ T4524] hardirqs last enabled at (2767): [] finish_lock_switch+0xb0/0x1c8 [ 35.296711][ T4524] hardirqs last disabled at (2766): [] __schedule+0x294/0x1a6c [ 35.298423][ T4524] softirqs last enabled at (2510): [] local_bh_enable+0x10/0x34 [ 35.300189][ T4524] softirqs last disabled at (2508): [] local_bh_disable+0x10/0x34 [ 35.301952][ T4524] ---[ end trace 0000000000000000 ]--- [ 35.304578][ T4524] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 35.306493][ T4524] Mem abort info: [ 35.307160][ T4524] ESR = 0x0000000086000006 [ 35.307949][ T4524] EC = 0x21: IABT (current EL), IL = 32 bits [ 35.309011][ T4524] SET = 0, FnV = 0 [ 35.309673][ T4524] EA = 0, S1PTW = 0 [ 35.310352][ T4524] FSC = 0x06: level 2 translation fault [ 35.311245][ T4524] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001143dc000 [ 35.312368][ T4524] [0000000000000000] pgd=0800000112cd2003, p4d=0800000112cd2003, pud=0800000135ff6003, pmd=0000000000000000 [ 35.314152][ T4524] Internal error: Oops: 0000000086000006 [#1] PREEMPT SMP [ 35.315222][ T4524] Modules linked in: [ 35.315816][ T4524] CPU: 0 PID: 4524 Comm: syz.1.30 Tainted: G B W syzkaller #0 [ 35.317355][ T4524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 35.319109][ T4524] pstate: 02400805 (nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=-c) [ 35.320450][ T4524] pc : 0x0 [ 35.320976][ T4524] lr : svc_register+0x100/0x214 [ 35.321860][ T4524] sp : ffff8000216574e0 [ 35.322620][ T4524] x29: ffff8000216574f0 x28: ffff0000e1826c1c x27: dfff800000000000 [ 35.324127][ T4524] x26: 0000000000000000 x25: 0000000000000000 x24: 1fffe0001c304d83 [ 35.325578][ T4524] x23: ffff0000e1826c08 x22: ffff0000d5c8d4c0 x21: 0000000000000011 [ 35.327046][ T4524] x20: 0000000000000801 x19: 1fffe0001c304d89 x18: 0000000000000060 [ 35.328469][ T4524] x17: 0000000000001000 x16: ffff800008043b30 x15: 0000000000000000 [ 35.329884][ T4524] x14: 00000000ffff8000 x13: 00000000778d7487 x12: 0000000000080000 [ 35.331336][ T4524] x11: ff00800010f3079c x10: 0000000000000002 x9 : ffff80001c635b50 [ 35.332821][ T4524] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f [ 35.334327][ T4524] x5 : 0000000000000801 x4 : 0000000000000011 x3 : 0000000000000002 [ 35.335836][ T4524] x2 : 0000000000000000 x1 : ffff0000e1826c08 x0 : ffff0000d5c8d4c0 [ 35.337313][ T4524] Call trace: [ 35.337905][ T4524] 0x0 [ 35.338395][ T4524] svc_setup_socket+0x118/0xe5c [ 35.339286][ T4524] svc_create_socket+0x590/0x874 [ 35.340169][ T4524] svc_udp_create+0x4c/0x64 [ 35.341006][ T4524] _svc_xprt_create+0x28c/0x76c [ 35.341900][ T4524] svc_xprt_create+0x5c/0xd8 [ 35.342716][ T4524] nfsd_svc+0x350/0x948 [ 35.343498][ T4524] write_threads+0x2b4/0x310 [ 35.344372][ T4524] nfsctl_transaction_write+0x114/0x164 [ 35.345418][ T4524] vfs_write+0x2a8/0x7c8 [ 35.346212][ T4524] ksys_write+0x12c/0x228 [ 35.347062][ T4524] __arm64_sys_write+0x7c/0x90 [ 35.347955][ T4524] invoke_syscall+0x98/0x290 [ 35.348842][ T4524] el0_svc_common+0x13c/0x258 [ 35.349725][ T4524] do_el0_svc+0x5c/0x134 [ 35.350538][ T4524] el0_svc+0x58/0x128 [ 35.351291][ T4524] el0t_64_sync_handler+0x84/0xf0 [ 35.352198][ T4524] el0t_64_sync+0x18c/0x190 [ 35.353038][ T4524] Code: bad PC value [ 35.353738][ T4524] ---[ end trace 0000000000000000 ]--- [ 35.593334][ T4524] Kernel panic - not syncing: Oops: Fatal exception [ 35.594595][ T4524] SMP: stopping secondary CPUs [ 35.595443][ T4524] Kernel Offset: disabled [ 35.596215][ T4524] CPU features: 0x0a0000,000f0097,a65bfea7 [ 35.597214][ T4524] Memory Limit: none [ 35.853626][ T4524] Rebooting in 86400 seconds..