last executing test programs: 7.019824049s ago: executing program 2 (id=3): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x7, &(0x7f0000006680)) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0xfffffffffffffe01, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002540)=ANY=[@ANYBLOB="14efff001000010000039f00000000000000000a54000000060a00000009000200000900010073797a300000000028000480240001800b00010072656a656374000014000280050002000a0000000800014057bc338f6e3dc70eb32531e98a00000002140000001100010000000000000000000000000adabe17361ebf3e04ef1fd8730f519541a9b7976840b1236300145405fee5723dee821c58bdbcb0b9efaebb4bf8a78e1de60724ee3ecf65b11e33c5a5fcf911c092ca494e7b1cd7a140eeeebb"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x24048810) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40010, 0xffffffffffffffff, 0x89f99000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0585609, &(0x7f0000000080)={0xfe48, 0x3, 0x0, 0x0, 0x3}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000009007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000", @ANYRES16=r3, @ANYRESOCT], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x51c7}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x4e, &(0x7f00000002c0)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2, 0x40, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010104, @dev={0xac, 0x14, 0x14, 0x42}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, {[@exp_fastopen={0x1d, 0x5, 0xf989, "cf"}, @md5sig={0x13, 0x12, "c140c2ba3d3f09659390e45c2a2b031e"}]}}}}}}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) socket(0x10, 0x3, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, 0x0, 0x0) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='smaps_rollup\x00') read$FUSE(r8, &(0x7f0000000500)={0x2020}, 0x2020) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={'geneve1\x00', {0x2, 0x4e23, @local}}) 6.574134793s ago: executing program 3 (id=4): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000540)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000000c0)=0x7fff, 0x4) sendto(r0, &(0x7f00000002c0)='=', 0x1, 0x0, 0x0, 0x0) 5.726623535s ago: executing program 3 (id=6): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xfffff, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2429}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x18800000000000, 0x4, 0xfffffffffffffffd, 0x669a, 0x1, 0x6, 0x3}, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="1801000000000000000000006dfeff008500"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null-generic\x00'}, 0x58) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x0, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000380)={0x2, 0x34000, 0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0x3000, 0x2000, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.656111853s ago: executing program 1 (id=2): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) sendmsg$GTP_CMD_ECHOREQ(r0, 0x0, 0x4000) getsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x20, 0x0, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r1 = syz_open_dev$vbi(0x0, 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000000)=0x1) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r2, &(0x7f0000000180)='connect aa:aa:aa:aa:aa:11 0', 0x1b) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x6) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x40000, 0x19) 5.396558317s ago: executing program 0 (id=7): ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, &(0x7f0000000080)={0x0, 0x0, 0x8, 0x1b, 0x100, &(0x7f00000000c0)="387ed7626d850509a2d6c1aa38f15cd00f85c263cb226db671261fff7ce9c555f189afae3530db6dd493f28fd988721b9ae21b3e3b4523ae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef495689092883b902a41cd75387ef6f7bc7d460d5e665f398ff95596dc94ec97003a3db08e500c2fb07e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd81761e74c38a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1f7a1e850ecb3421143c5c4ded0f083a0c524dcf320827266819b6a952db5bc96141b26c54db857edbcbbc81c7af7aadf50bc549974b6401a19cdb130282b955592efa94242065a4c8d695a2cdd9ada350defd58c775b92d348305774d3a256c7520b285d8da0dbf5e20d604413ed2ddf9bcbf881caf811852806175d63892a15234fbcd7a88a2a0aea45d19148f0e7dada7d6d0d77881387fdeaa02863be90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695ef060000001bbe1b649f42f310859122c0d2c1e558dc6586958a28374f386ecf369274e43003a09b5159ea515eb44521901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90040c4bd2a3d6bc509254a12cece59181fcb5bad8c24bd9f8f78d17ab01831325501e80d899e9252f99d3a2666343392fda115048e4f4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd3330000000000000009a3237aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b5b66ab89d2d6333f699b16db68986ab3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9b647ba812f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d14df8aa9df6f40a80ace2bb8a2aad3b0c66915927db4173181943d88c0c76d5969e2043db5bd77fd60ba0f012139929ccfec965c1f769785a4d23332d71f0875e3146afef5b20cc306d3ecee65944fe9829e0ad0c3f6bb2fdc1bc31152538db50f47dc38ba908a0d808687e478a609fe0daa0000000000000000e7f2e98597e27f3e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d4794ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e8fd4e71929f918b98c4cbfcb11a90139264a9ee807c973167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d174d2465380b1a00ddc42915e4f3a5db640600000095a3d63904c9ecd1c313c08e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e04c93a5470774975b42091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d00000000ddffffff00"}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/56, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/231, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1, r1}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 4.687365928s ago: executing program 0 (id=8): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) socket$rds(0x15, 0x5, 0x0) getsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x20, 0x0, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) ioctl$VIDIOC_S_OUTPUT(0xffffffffffffffff, 0xc004562f, &(0x7f0000000000)=0x1) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r1, &(0x7f0000000180)='connect aa:aa:aa:aa:aa:11 0', 0x1b) openat$sysfs(0xffffffffffffff9c, 0x0, 0x800, 0x2) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x6) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x40000, 0x19) 4.171205869s ago: executing program 4 (id=5): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000240), 0x2) r1 = memfd_create(0x0, 0x2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3000001, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0xe4621000) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket(0x15, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) socket$xdp(0x2c, 0x3, 0x0) syz_io_uring_setup(0x838, 0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) socket$pppl2tp(0x18, 0x1, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x5a, 0x1, 0x1}) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') getdents64(r4, &(0x7f0000002f40)=""/4098, 0x1002) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000000)={r1, 0x1}) 3.762879927s ago: executing program 3 (id=9): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f0000000140)={0xc, r1}) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, &(0x7f0000000440)=ANY=[@ANYBLOB="1800007f0000000000200000000000000001"]) 3.289083147s ago: executing program 1 (id=10): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x48}}, 0x0) 2.717685607s ago: executing program 3 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) unshare(0x22020400) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = inotify_init() inotify_add_watch(r0, &(0x7f00000000c0)='./file0\x00', 0x4000001) inotify_add_watch(r0, &(0x7f0000000100)='./file0/bus\x00', 0xc4000100) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) 2.674386465s ago: executing program 4 (id=12): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000003, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e22, 0x81, @private1}]}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f00005a4000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x840) ioctl$BTRFS_IOC_SPACE_INFO(0xffffffffffffffff, 0xc0109414, &(0x7f0000000340)={0x28, 0x100000001, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) io_uring_setup(0x291d, 0x0) r0 = io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) poll(0x0, 0x0, 0x9) 2.543570698s ago: executing program 0 (id=13): pipe(&(0x7f00000001c0)={0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) close(0x4) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r3, 0x0, 0xf3a, 0x0) splice(r0, 0x0, r3, 0x0, 0x80, 0x6) write(r1, 0x0, 0x0) 2.463619475s ago: executing program 1 (id=14): r0 = gettid() timer_create(0xb, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x2182) ioctl$CEC_RECEIVE(r1, 0xc0386106, &(0x7f0000000000)={0x4, 0x7, 0x80005, 0x0, 0x0, 0x1, '&\x00', 0xc, 0x0, 0x5, 0x0, 0x0, 0x0, 0xe}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) 1.939041937s ago: executing program 4 (id=15): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000000)={0x48, 0x2, r1}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1}) 1.879630153s ago: executing program 3 (id=16): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ppoll(&(0x7f0000000080)=[{r0, 0x40}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_GETISPACE(r0, 0x8010500d, &(0x7f0000000040)) 1.761937676s ago: executing program 0 (id=17): ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, &(0x7f0000000080)={0x0, 0x0, 0x8, 0x1b, 0x100, &(0x7f00000000c0)="387ed7626d850509a2d6c1aa38f15cd00f85c263cb226db671261fff7ce9c555f189afae3530db6dd493f28fd988721b9ae21b3e3b4523ae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef495689092883b902a41cd75387ef6f7bc7d460d5e665f398ff95596dc94ec97003a3db08e500c2fb07e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd81761e74c38a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1f7a1e850ecb3421143c5c4ded0f083a0c524dcf320827266819b6a952db5bc96141b26c54db857edbcbbc81c7af7aadf50bc549974b6401a19cdb130282b955592efa94242065a4c8d695a2cdd9ada350defd58c775b92d348305774d3a256c7520b285d8da0dbf5e20d604413ed2ddf9bcbf881caf811852806175d63892a15234fbcd7a88a2a0aea45d19148f0e7dada7d6d0d77881387fdeaa02863be90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695ef060000001bbe1b649f42f310859122c0d2c1e558dc6586958a28374f386ecf369274e43003a09b5159ea515eb44521901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90040c4bd2a3d6bc509254a12cece59181fcb5bad8c24bd9f8f78d17ab01831325501e80d899e9252f99d3a2666343392fda115048e4f4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd3330000000000000009a3237aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b5b66ab89d2d6333f699b16db68986ab3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9b647ba812f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d14df8aa9df6f40a80ace2bb8a2aad3b0c66915927db4173181943d88c0c76d5969e2043db5bd77fd60ba0f012139929ccfec965c1f769785a4d23332d71f0875e3146afef5b20cc306d3ecee65944fe9829e0ad0c3f6bb2fdc1bc31152538db50f47dc38ba908a0d808687e478a609fe0daa0000000000000000e7f2e98597e27f3e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d4794ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e8fd4e71929f918b98c4cbfcb11a90139264a9ee807c973167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d174d2465380b1a00ddc42915e4f3a5db640600000095a3d63904c9ecd1c313c08e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e04c93a5470774975b42091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d00000000ddffffff00"}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/56, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/231, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1, r1}) 1.311548095s ago: executing program 4 (id=18): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0xe8, 0x65, 0x2, 0x70bd27, 0x25dfdbf8, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0xffffffff}, @filter_kind_options=@f_bpf={{0x8}, {0x4}}, @filter_kind_options=@f_bpf={{0x8}, {0xa8, 0x2, [@TCA_BPF_ACT={0xa4, 0x1, [@m_connmark={0xa0, 0xa, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffffe, 0x9, 0x3, 0x3, 0x1}}}]}, {0x51, 0x6, "7d1c2f218ab42f594fe5adbe85eea4a07891f03c95b96ccd9c2cc998aa5257967475522c2ef4397c75e5cd9a15b78828602efb5bb8d8f18605fd1d4ac132fc6229edf4a2184213ba5ea94b254e"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1}}}}]}]}}]}, 0xe8}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.298618998s ago: executing program 3 (id=19): read$watch_queue(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x9, 0xa, 0xfff) pipe(&(0x7f0000000140)) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r3, &(0x7f0000001440)=[{{&(0x7f0000000280)=@un=@abs, 0x0, &(0x7f0000001400)=[{&(0x7f0000001480)=""/1}, {&(0x7f0000000300)=""/102}, {&(0x7f0000000380)=""/4096}, {&(0x7f0000001380)=""/111}]}}], 0x700, 0x40002002, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xffc1) 1.051309346s ago: executing program 0 (id=20): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x32, 0x0, &(0x7f0000000400)=[@increfs], 0xfffffcb0, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f00000004c0)=[@increfs], 0x0, 0x0, 0x0}) 1.050723011s ago: executing program 1 (id=21): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)={0xfffffffe}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x5, 0x2, 0x180, 0x4, 0x0, 0xf1, 0x50, 0x12, 0x5, 0x0, 0x29, 0x0, 0x7, 0x4, 0xbdb], 0x5000, 0x42900}) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff, 0x2f, 0x0, @void}, 0x10) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x14, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x7, 0x1000000000, 0x1000, 0x43, 0x2000001, 0x0, 0x2004cb, 0x77, 0xa7c, 0x68ff, 0x5, 0x9, 0x3], 0xeeee8000, 0x302}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0xeeee0000, 0x8, 0x8, 0xb, 0xe6, 0x42, 0x9, 0x0, 0x81, 0x45}, {0x5000, 0x3000, 0x3, 0x0, 0x42, 0x4, 0x7d, 0x7, 0x36, 0x2, 0x2, 0x87}, {0x0, 0x33325000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0xfe, 0xa4, 0x5, 0x5}, {0x1, 0xeeee0000, 0xb, 0x6, 0x5, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0x3000, 0xd000, 0xf, 0x3, 0x16, 0xa, 0xab, 0x8, 0xc, 0x3, 0x8, 0x97}, {0x2000, 0xeeef0000, 0xf, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x31, 0x1, 0x7}, {0x3000, 0x1, 0x0, 0x5, 0x7, 0x5, 0xa, 0x3, 0x8, 0x81, 0x42, 0x6c}, {0x0, 0x4000, 0xa, 0x5, 0xcd, 0x9, 0x1, 0x9, 0x2, 0xc, 0xb0, 0x81}, {0xeeee0000, 0x30}, {0xdddd0000, 0x7}, 0x80000031, 0x0, 0x3000, 0x2024, 0x2, 0x0, 0xeeee0000, [0x6800000000000000, 0x4, 0x3, 0x8]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 304.076564ms ago: executing program 0 (id=22): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x3, {{0xa, 0xfffc, 0xc0000000, @mcast2}}, {{0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}}}, 0x108) 261.275312ms ago: executing program 4 (id=23): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x1c, 0x40, 0x119, 0xfffffffe, 0x0, {0x2, 0x7c}, [@nested={0x4, 0x142}, @nested={0x4, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48814}, 0xc000) 0s ago: executing program 1 (id=24): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000014000780080008400000000008001240ffffffe80500"], 0x5c}}, 0x0) r0 = syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r1, 0x8b1a, &(0x7f0000000040)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.189' (ED25519) to the list of known hosts. [ 174.893379][ T5783] cgroup: Unknown subsys name 'net' [ 175.009310][ T5783] cgroup: Unknown subsys name 'cpuset' [ 175.024381][ T5783] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 180.779057][ T5783] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 185.878145][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 185.925849][ T5802] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 185.935667][ T5804] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 185.943873][ T5802] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 185.951697][ T5802] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 185.961163][ T5802] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 185.972368][ T5804] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 185.984080][ T5804] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 185.992409][ T5809] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 186.004417][ T5804] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 186.049165][ T5809] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 186.066481][ T5098] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 186.093266][ T5098] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 186.102425][ T5098] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 186.116467][ T5098] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 186.135762][ T5811] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 186.146995][ T5811] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 186.148553][ T5809] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 186.172821][ T5811] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 186.181790][ T5804] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 186.219240][ T5804] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 186.227366][ T5811] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 186.240344][ T5802] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 186.299520][ T5811] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 186.310356][ T5811] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 187.263629][ T5799] chnl_net:caif_netlink_parms(): no params data found [ 187.720692][ T5810] chnl_net:caif_netlink_parms(): no params data found [ 187.844108][ T5803] chnl_net:caif_netlink_parms(): no params data found [ 188.110846][ T5811] Bluetooth: hci1: command tx timeout [ 188.116026][ T5098] Bluetooth: hci0: command tx timeout [ 188.269293][ T5098] Bluetooth: hci3: command tx timeout [ 188.276261][ T5812] chnl_net:caif_netlink_parms(): no params data found [ 188.373576][ T5098] Bluetooth: hci2: command tx timeout [ 188.373772][ T5811] Bluetooth: hci4: command tx timeout [ 188.563118][ T5808] chnl_net:caif_netlink_parms(): no params data found [ 188.597839][ T5799] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.607167][ T5799] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.614869][ T5799] bridge_slave_0: entered allmulticast mode [ 188.624233][ T5799] bridge_slave_0: entered promiscuous mode [ 188.672892][ T5799] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.680526][ T5799] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.688228][ T5799] bridge_slave_1: entered allmulticast mode [ 188.697938][ T5799] bridge_slave_1: entered promiscuous mode [ 188.899734][ T5810] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.909000][ T5810] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.916698][ T5810] bridge_slave_0: entered allmulticast mode [ 188.926149][ T5810] bridge_slave_0: entered promiscuous mode [ 189.013098][ T5810] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.020779][ T5810] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.030393][ T5810] bridge_slave_1: entered allmulticast mode [ 189.040204][ T5810] bridge_slave_1: entered promiscuous mode [ 189.179050][ T5799] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 189.222425][ T5803] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.230127][ T5803] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.238075][ T5803] bridge_slave_0: entered allmulticast mode [ 189.246505][ T5803] bridge_slave_0: entered promiscuous mode [ 189.308894][ T5799] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.329860][ T5810] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 189.339719][ T5803] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.347633][ T5803] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.355304][ T5803] bridge_slave_1: entered allmulticast mode [ 189.364361][ T5803] bridge_slave_1: entered promiscuous mode [ 189.425985][ T5810] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.496766][ T5812] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.504327][ T5812] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.512206][ T5812] bridge_slave_0: entered allmulticast mode [ 189.521275][ T5812] bridge_slave_0: entered promiscuous mode [ 189.698050][ T5812] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.705772][ T5812] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.713403][ T5812] bridge_slave_1: entered allmulticast mode [ 189.722705][ T5812] bridge_slave_1: entered promiscuous mode [ 189.745670][ T5803] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 189.793736][ T5799] team0: Port device team_slave_0 added [ 189.807936][ T5810] team0: Port device team_slave_0 added [ 189.895361][ T5803] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.911854][ T5810] team0: Port device team_slave_1 added [ 189.958763][ T5799] team0: Port device team_slave_1 added [ 189.966824][ T5808] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.974404][ T5808] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.982089][ T5808] bridge_slave_0: entered allmulticast mode [ 189.991115][ T5808] bridge_slave_0: entered promiscuous mode [ 190.160989][ T5808] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.168649][ T5808] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.177710][ T5808] bridge_slave_1: entered allmulticast mode [ 190.185486][ T5811] Bluetooth: hci0: command tx timeout [ 190.186606][ T5808] bridge_slave_1: entered promiscuous mode [ 190.191006][ T5811] Bluetooth: hci1: command tx timeout [ 190.238837][ T5812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 190.251080][ T5810] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 190.258321][ T5810] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 190.285821][ T5810] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 190.306085][ T5803] team0: Port device team_slave_0 added [ 190.315815][ T5810] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 190.322894][ T5810] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 190.349367][ T5811] Bluetooth: hci3: command tx timeout [ 190.355073][ T5810] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 190.396510][ T5799] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 190.403607][ T5799] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 190.430050][ T5799] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 190.430110][ T5811] Bluetooth: hci2: command tx timeout [ 190.434987][ T5811] Bluetooth: hci4: command tx timeout [ 190.455129][ T5812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 190.466546][ T5799] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 190.473629][ T5799] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 190.500965][ T5799] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 190.521413][ T5803] team0: Port device team_slave_1 added [ 190.749182][ T5808] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 190.760536][ T5803] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 190.767770][ T5803] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 190.793929][ T5803] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 190.814241][ T5812] team0: Port device team_slave_0 added [ 190.823853][ T5803] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 190.831101][ T5803] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 190.857389][ T5803] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 190.933750][ T5808] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 190.983922][ T5812] team0: Port device team_slave_1 added [ 191.110915][ T5810] hsr_slave_0: entered promiscuous mode [ 191.120759][ T5810] hsr_slave_1: entered promiscuous mode [ 191.211696][ T5799] hsr_slave_0: entered promiscuous mode [ 191.222349][ T5799] hsr_slave_1: entered promiscuous mode [ 191.230530][ T5799] debugfs: 'hsr0' already exists in 'hsr' [ 191.236443][ T5799] Cannot create hsr debugfs directory [ 191.249534][ T5808] team0: Port device team_slave_0 added [ 191.304459][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 191.312340][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 191.338695][ T5812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 191.357612][ T5808] team0: Port device team_slave_1 added [ 191.366880][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 191.373972][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 191.400443][ T5812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 191.635899][ T5803] hsr_slave_0: entered promiscuous mode [ 191.645692][ T5803] hsr_slave_1: entered promiscuous mode [ 191.653413][ T5803] debugfs: 'hsr0' already exists in 'hsr' [ 191.659377][ T5803] Cannot create hsr debugfs directory [ 191.679117][ T5808] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 191.686269][ T5808] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 191.712532][ T5808] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 191.856091][ T5808] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 191.863217][ T5808] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 191.889585][ T5808] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 192.118993][ T5812] hsr_slave_0: entered promiscuous mode [ 192.127791][ T5812] hsr_slave_1: entered promiscuous mode [ 192.136111][ T5812] debugfs: 'hsr0' already exists in 'hsr' [ 192.141979][ T5812] Cannot create hsr debugfs directory [ 192.268064][ T5811] Bluetooth: hci0: command tx timeout [ 192.273744][ T5811] Bluetooth: hci1: command tx timeout [ 192.323245][ T5808] hsr_slave_0: entered promiscuous mode [ 192.332843][ T5808] hsr_slave_1: entered promiscuous mode [ 192.341317][ T5808] debugfs: 'hsr0' already exists in 'hsr' [ 192.347601][ T5808] Cannot create hsr debugfs directory [ 192.427729][ T5098] Bluetooth: hci3: command tx timeout [ 192.504987][ T5098] Bluetooth: hci4: command tx timeout [ 192.510585][ T5098] Bluetooth: hci2: command tx timeout [ 193.272534][ T5810] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 193.322307][ T5810] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 193.340563][ T5810] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 193.375514][ T5810] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 193.504789][ T5803] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 193.572964][ T5803] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 193.643198][ T5803] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 193.800460][ T5803] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 193.832208][ T5799] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 193.869286][ T5799] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 193.995743][ T5812] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 194.020917][ T5799] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 194.050161][ T5799] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 194.089905][ T5812] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 194.162042][ T5812] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 194.232654][ T5812] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 194.277143][ T5808] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 194.322871][ T5808] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 194.375674][ T5098] Bluetooth: hci1: command tx timeout [ 194.381265][ T5098] Bluetooth: hci0: command tx timeout [ 194.423110][ T5808] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 194.452733][ T5808] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 194.507003][ T5098] Bluetooth: hci3: command tx timeout [ 194.587483][ T5098] Bluetooth: hci4: command tx timeout [ 194.587854][ T5811] Bluetooth: hci2: command tx timeout [ 194.841240][ T5810] 8021q: adding VLAN 0 to HW filter on device bond0 [ 195.000103][ T5803] 8021q: adding VLAN 0 to HW filter on device bond0 [ 195.094590][ T5810] 8021q: adding VLAN 0 to HW filter on device team0 [ 195.133197][ T5799] 8021q: adding VLAN 0 to HW filter on device bond0 [ 195.251409][ T3974] bridge0: port 1(bridge_slave_0) entered blocking state [ 195.258915][ T3974] bridge0: port 1(bridge_slave_0) entered forwarding state [ 195.279801][ T3974] bridge0: port 2(bridge_slave_1) entered blocking state [ 195.287371][ T3974] bridge0: port 2(bridge_slave_1) entered forwarding state [ 195.367175][ T5803] 8021q: adding VLAN 0 to HW filter on device team0 [ 195.383964][ T5799] 8021q: adding VLAN 0 to HW filter on device team0 [ 195.466322][ T5812] 8021q: adding VLAN 0 to HW filter on device bond0 [ 195.503113][ T3754] bridge0: port 1(bridge_slave_0) entered blocking state [ 195.510639][ T3754] bridge0: port 1(bridge_slave_0) entered forwarding state [ 195.526092][ T3754] bridge0: port 1(bridge_slave_0) entered blocking state [ 195.533657][ T3754] bridge0: port 1(bridge_slave_0) entered forwarding state [ 195.588318][ T3754] bridge0: port 2(bridge_slave_1) entered blocking state [ 195.595947][ T3754] bridge0: port 2(bridge_slave_1) entered forwarding state [ 195.677736][ T3754] bridge0: port 2(bridge_slave_1) entered blocking state [ 195.685368][ T3754] bridge0: port 2(bridge_slave_1) entered forwarding state [ 195.861071][ T5812] 8021q: adding VLAN 0 to HW filter on device team0 [ 195.911173][ T5808] 8021q: adding VLAN 0 to HW filter on device bond0 [ 195.928793][ T5810] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 195.940283][ T5810] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 196.022609][ T1847] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.030159][ T1847] bridge0: port 1(bridge_slave_0) entered forwarding state [ 196.216230][ T5808] 8021q: adding VLAN 0 to HW filter on device team0 [ 196.261610][ T1847] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.269120][ T1847] bridge0: port 2(bridge_slave_1) entered forwarding state [ 196.340718][ T1847] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.348251][ T1847] bridge0: port 1(bridge_slave_0) entered forwarding state [ 196.368488][ T1847] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.376014][ T1847] bridge0: port 2(bridge_slave_1) entered forwarding state [ 196.683208][ T5812] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 196.694252][ T5812] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 196.883802][ T5808] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 197.759356][ T5803] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 197.782826][ T5810] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 198.174141][ T5803] veth0_vlan: entered promiscuous mode [ 198.244548][ T5799] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 198.328055][ T5803] veth1_vlan: entered promiscuous mode [ 198.369807][ T5812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 198.396159][ T5810] veth0_vlan: entered promiscuous mode [ 198.524214][ T5810] veth1_vlan: entered promiscuous mode [ 198.658502][ T5803] veth0_macvtap: entered promiscuous mode [ 198.721285][ T5803] veth1_macvtap: entered promiscuous mode [ 198.821558][ T5808] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 198.899456][ T5799] veth0_vlan: entered promiscuous mode [ 198.940284][ T5803] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 198.997037][ T5812] veth0_vlan: entered promiscuous mode [ 199.020528][ T5803] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 199.059311][ T5810] veth0_macvtap: entered promiscuous mode [ 199.090690][ T5799] veth1_vlan: entered promiscuous mode [ 199.107488][ T5812] veth1_vlan: entered promiscuous mode [ 199.138718][ T5810] veth1_macvtap: entered promiscuous mode [ 199.191323][ T1847] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.300586][ T1847] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.376224][ T1847] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.400419][ T5810] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 199.463781][ T1847] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.508464][ T5810] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 199.538422][ T5812] veth0_macvtap: entered promiscuous mode [ 199.555785][ T5799] veth0_macvtap: entered promiscuous mode [ 199.604942][ T1847] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.621214][ T5812] veth1_macvtap: entered promiscuous mode [ 199.647442][ T5799] veth1_macvtap: entered promiscuous mode [ 199.657422][ T1847] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.698772][ T1847] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.742473][ T1847] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.828253][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 199.904943][ T5799] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 199.953088][ T5799] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 200.003013][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 200.060583][ T3511] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.127472][ T3511] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.200808][ T3511] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.255144][ T3511] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.292002][ T3511] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.360356][ T3511] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.402500][ T3511] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.445929][ T3511] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.423815][ T5808] veth0_vlan: entered promiscuous mode [ 201.501874][ T5808] veth1_vlan: entered promiscuous mode [ 201.737415][ T5808] veth0_macvtap: entered promiscuous mode [ 201.815415][ T5808] veth1_macvtap: entered promiscuous mode [ 202.000817][ T5808] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 202.113298][ T5808] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 202.225022][ T3754] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.266183][ T1847] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.305158][ T1847] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.314165][ T1847] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.884953][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 204.892962][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 205.088344][ T3638] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 205.096516][ T3638] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 205.435928][ T1152] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 205.443905][ T1152] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 205.569653][ T5803] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 205.693978][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 205.705058][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 205.773655][ T3511] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 205.783971][ T3511] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 205.979658][ T1152] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 205.988922][ T1152] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 206.355497][ T3511] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 206.363510][ T3511] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 206.691639][ T1847] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 206.702534][ T1847] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 207.030858][ T5990] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 207.852685][ T3638] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 207.861072][ T3638] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 208.119606][ T5996] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 208.120451][ T3511] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 208.126228][ T5996] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 208.138474][ T3511] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 208.164426][ T5996] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 208.200563][ T5996] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 208.207119][ T5996] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 208.265666][ T5996] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 208.325194][ T5996] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 208.331806][ T5996] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 208.379648][ T5996] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 208.503274][ T5996] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 208.510008][ T5996] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 208.588361][ T5996] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 208.632612][ T5996] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 208.640326][ T5996] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 208.709682][ T5996] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 209.124007][ T6007] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 209.131849][ T6007] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 209.139494][ T6007] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 209.147051][ T6007] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 209.163567][ T6007] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 210.905089][ T5098] Bluetooth: hci0: command 0x0c1a tx timeout [ 211.225627][ T5098] Bluetooth: hci4: command 0x0405 tx timeout [ 211.232804][ T5802] Bluetooth: hci3: command 0x0c1a tx timeout [ 211.239416][ T5811] Bluetooth: hci2: command 0x0c1a tx timeout [ 211.246574][ T5811] Bluetooth: hci1: command 0x0c1a tx timeout [ 212.129375][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 212.333840][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 212.365964][ T6046] binder: 6045:6046 unknown command 0 [ 212.371692][ T6046] binder: 6045:6046 ioctl c0306201 80000080 returned -22 [ 212.747086][ T0] NOHZ tick-stop error: local softirq work is pending, handler #242!!! [ 212.994941][ T5802] Bluetooth: hci0: command 0x0c1a tx timeout [ 213.196245][ T6056] warning: `syz.1.24' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 213.208951][ T5451] ===================================================== [ 213.216381][ T5451] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0xef3/0x33f0 [ 213.223816][ T5451] _copy_to_iter+0xef3/0x33f0 [ 213.229657][ T5451] __skb_datagram_iter+0x196/0x12c0 [ 213.235185][ T5451] skb_copy_datagram_iter+0x5b/0x1e0 [ 213.240577][ T5451] netlink_recvmsg+0x4bb/0xfe0 [ 213.245545][ T5451] sock_recvmsg+0x2df/0x390 [ 213.250444][ T5451] ____sys_recvmsg+0x193/0x610 [ 213.255713][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 213.267787][ T5451] ___sys_recvmsg+0x20b/0x850 [ 213.272658][ T5451] __x64_sys_recvmsg+0x20e/0x3d0 [ 213.277850][ T5451] x64_sys_call+0x35f0/0x3e30 [ 213.282691][ T5451] do_syscall_64+0xd9/0xfa0 [ 213.287446][ T5451] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.293445][ T5451] [ 213.297149][ T5451] Uninit was stored to memory at: [ 213.302352][ T5451] pskb_expand_head+0x310/0x1610 [ 213.307712][ T5451] netlink_trim+0x496/0x500 [ 213.312322][ T5451] netlink_broadcast_filtered+0x80/0x28f0 [ 213.318312][ T5451] nlmsg_notify+0x15b/0x2f0 [ 213.322910][ T5451] rtnl_notify+0xba/0x100 [ 213.327407][ T5451] wireless_nlevent_process+0xfe/0x290 [ 213.332959][ T5451] process_scheduled_works+0xb91/0x1d80 [ 213.338748][ T5451] worker_thread+0xedf/0x1590 [ 213.343542][ T5451] kthread+0xd5c/0xf00 [ 213.347823][ T5451] ret_from_fork+0x1f5/0x4c0 [ 213.352583][ T5451] ret_from_fork_asm+0x1a/0x30 [ 213.361101][ T5451] [ 213.363505][ T5451] Uninit was stored to memory at: [ 213.369968][ T5451] wireless_send_event+0x67f/0x1530 [ 213.375422][ T5451] ioctl_standard_iw_point+0x12b0/0x13f0 [ 213.376808][ T5802] Bluetooth: hci3: command 0x0c1a tx timeout [ 213.381197][ T5451] compat_standard_call+0x188/0x4c0 [ 213.389554][ T5802] Bluetooth: hci4: command 0x0405 tx timeout [ 213.392605][ T5451] wext_ioctl_dispatch+0x192/0x7a0 [ 213.399540][ T5802] Bluetooth: hci1: command 0x0c1a tx timeout [ 213.403898][ T5451] compat_wext_handle_ioctl+0x1a1/0x300 [ 213.410243][ T5802] Bluetooth: hci2: command 0x0c1a tx timeout [ 213.417139][ T5451] compat_sock_ioctl+0x20c/0xff0 [ 213.426809][ T5451] __ia32_compat_sys_ioctl+0x7f9/0x1270 [ 213.432539][ T5451] ia32_sys_call+0x2d5f/0x4310 [ 213.437621][ T5451] __do_fast_syscall_32+0xb0/0x150 [ 213.442910][ T5451] do_fast_syscall_32+0x38/0x80 [ 213.448139][ T5451] do_SYSENTER_32+0x1f/0x30 [ 213.452824][ T5451] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 213.462928][ T5451] [ 213.466458][ T5451] Local variable iwp created at: [ 213.471481][ T5451] compat_standard_call+0x4a/0x4c0 [ 213.476848][ T5451] wext_ioctl_dispatch+0x192/0x7a0 [ 213.482092][ T5451] [ 213.484490][ T5451] Bytes 60-63 of 64 are uninitialized [ 213.490058][ T5451] Memory access of size 64 starts at ffff888103094dc0 [ 213.497038][ T5451] Data copied to user address 00007ffdd8e865a0 [ 213.503291][ T5451] [ 213.505923][ T5451] CPU: 0 UID: 101 PID: 5451 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(none) [ 213.515309][ T5451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 213.525591][ T5451] ===================================================== [ 213.532609][ T5451] Disabling lock debugging due to kernel taint [ 213.538985][ T5451] Kernel panic - not syncing: kmsan.panic set ... [ 213.545523][ T5451] CPU: 0 UID: 101 PID: 5451 Comm: dhcpcd Tainted: G B syzkaller #0 PREEMPT(none) [ 213.556369][ T5451] Tainted: [B]=BAD_PAGE [ 213.560643][ T5451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 213.570811][ T5451] Call Trace: [ 213.574171][ T5451] [ 213.577173][ T5451] __dump_stack+0x26/0x30 [ 213.581642][ T5451] dump_stack_lvl+0x53/0x270 [ 213.586366][ T5451] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 213.592339][ T5451] dump_stack+0x1e/0x25 [ 213.596639][ T5451] vpanic+0x435/0xd30 [ 213.600815][ T5451] panic+0x15d/0x160 [ 213.604888][ T5451] kmsan_report+0x31c/0x320 [ 213.609544][ T5451] ? kmsan_internal_check_memory+0x1e1/0x230 [ 213.615757][ T5451] ? kmsan_copy_to_user+0xf1/0x190 [ 213.620991][ T5451] ? _copy_to_iter+0xef3/0x33f0 [ 213.625963][ T5451] ? __skb_datagram_iter+0x196/0x12c0 [ 213.631495][ T5451] ? skb_copy_datagram_iter+0x5b/0x1e0 [ 213.637104][ T5451] ? netlink_recvmsg+0x4bb/0xfe0 [ 213.642198][ T5451] ? sock_recvmsg+0x2df/0x390 [ 213.646995][ T5451] ? ____sys_recvmsg+0x193/0x610 [ 213.652088][ T5451] ? ___sys_recvmsg+0x20b/0x850 [ 213.657104][ T5451] ? __x64_sys_recvmsg+0x20e/0x3d0 [ 213.662384][ T5451] ? x64_sys_call+0x35f0/0x3e30 [ 213.667411][ T5451] ? do_syscall_64+0xd9/0xfa0 [ 213.672252][ T5451] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.678447][ T5451] ? kmsan_internal_unpoison_memory+0x14/0x20 [ 213.684706][ T5451] ? kmsan_get_metadata+0xfb/0x160 [ 213.689954][ T5451] ? kmsan_get_metadata+0xfb/0x160 [ 213.695203][ T5451] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 213.701146][ T5451] ? kmsan_get_metadata+0xfb/0x160 [ 213.706386][ T5451] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 213.712332][ T5451] ? __pfx__raw_spin_lock+0x1/0x10 [ 213.717572][ T5451] ? kmsan_get_metadata+0xfb/0x160 [ 213.722819][ T5451] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 213.728796][ T5451] kmsan_internal_check_memory+0x1e1/0x230 [ 213.734809][ T5451] kmsan_copy_to_user+0xf1/0x190 [ 213.739876][ T5451] _copy_to_iter+0xef3/0x33f0 [ 213.744681][ T5451] ? kmsan_internal_set_shadow_origin+0x7a/0x110 [ 213.751205][ T5451] ? kmsan_get_metadata+0xfb/0x160 [ 213.756455][ T5451] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 213.762406][ T5451] ? kmsan_get_metadata+0xfb/0x160 [ 213.767659][ T5451] ? kmsan_internal_set_shadow_origin+0x7a/0x110 [ 213.774208][ T5451] __skb_datagram_iter+0x196/0x12c0 [ 213.779574][ T5451] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 213.785399][ T5451] skb_copy_datagram_iter+0x5b/0x1e0 [ 213.790848][ T5451] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 213.796801][ T5451] netlink_recvmsg+0x4bb/0xfe0 [ 213.801729][ T5451] ? aa_sock_msg_perm+0x29c/0x2f0 [ 213.806907][ T5451] ? __pfx_netlink_recvmsg+0x10/0x10 [ 213.812347][ T5451] sock_recvmsg+0x2df/0x390 [ 213.816988][ T5451] ____sys_recvmsg+0x193/0x610 [ 213.821917][ T5451] ? should_fail_ex+0x10/0x8a0 [ 213.826819][ T5451] ? stack_depot_save_flags+0x35/0x7b0 [ 213.832442][ T5451] ___sys_recvmsg+0x20b/0x850 [ 213.837332][ T5451] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 213.843292][ T5451] ? kmsan_get_metadata+0xfb/0x160 [ 213.848533][ T5451] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 213.854507][ T5451] __x64_sys_recvmsg+0x20e/0x3d0 [ 213.859641][ T5451] ? kmsan_get_metadata+0xfb/0x160 [ 213.864898][ T5451] x64_sys_call+0x35f0/0x3e30 [ 213.869749][ T5451] do_syscall_64+0xd9/0xfa0 [ 213.874448][ T5451] ? irqentry_exit+0x16/0x60 [ 213.879178][ T5451] ? clear_bhb_loop+0x40/0x90 [ 213.883992][ T5451] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.890014][ T5451] RIP: 0033:0x7f7775b9c407 [ 213.894533][ T5451] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 213.914269][ T5451] RSP: 002b:00007ffdd8e86490 EFLAGS: 00000202 ORIG_RAX: 000000000000002f [ 213.922846][ T5451] RAX: ffffffffffffffda RBX: 00007f7775b12740 RCX: 00007f7775b9c407 [ 213.930924][ T5451] RDX: 0000000000000040 RSI: 00007ffdd8e86510 RDI: 0000000000000009 [ 213.938984][ T5451] RBP: 000055d05cbd2aa0 R08: 0000000000000000 R09: 0000000000000000 [ 213.947048][ T5451] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000009 [ 213.955106][ T5451] R13: 00007ffdd8e8a670 R14: 0000000000000000 R15: 00007ffdd8e8a660 [ 213.963203][ T5451] [ 213.966711][ T5451] Kernel Offset: disabled [ 213.971101][ T5451] Rebooting in 86400 seconds..