last executing test programs: 37.342643901s ago: executing program 1 (id=19): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000003c0)={0x0, 0x2000000, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f00000001c0)={0x0, 0x0, 0x9}) dup2(r2, r1) 32.303674228s ago: executing program 1 (id=28): openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa08, 0x0) writev(r4, 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0xfffffc01, 0x166}, 0x9c) r6 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) write$binfmt_aout(r6, 0x0, 0xc8) 31.307989216s ago: executing program 1 (id=34): socket$inet6_sctp(0xa, 0x1, 0x84) fsopen(&(0x7f0000000000)='cgroup\x00', 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x8000) fsopen(&(0x7f0000000000)='rpc_pipefs\x00', 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x80000, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x0, 0x83, 0x2, 0x3, 0x200007f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x10007, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0xda, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454c, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0x40000ff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x47, 0x6, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x20000008, 0x4, 0x6d01, 0x6, 0x4038, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x200807ff, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb35, 0x7, 0xb, 0x5, 0x4, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x4184, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0x1, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0xffffffff, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 27.645107447s ago: executing program 1 (id=39): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) prlimit64(0x0, 0x6, 0x0, &(0x7f00000000c0)) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39dcdb) gettid() timer_create(0x0, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r4 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000)) setregid(0xffffffffffffffff, 0x0) close(r3) r5 = memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xecz\xabq\x95t*T9\xa9\b X \x04\"\x17\xbf\xcb\xccF\xda\xcf\xdd^\xa0\x15\xc0\xcb^h>\x1b\xb5d\xc7\x7f0\x9a&\xb0\x12#\x9c`\xa6\xed\x05\x95g\a\xccYb\xaf\xe9\xb6G?\x9f\xf5\xfe\xc1\xc0JJ\xc8\xd9d\x80\x13\x8fX\xb4\x19\xc4\\\xcb\x89-)\x90\x01\v\xac^\xdbBQ|\xaej;\x92\\\xf8u\x19Y\xee\x99EI\xf1t\xadn<\x9b\xc9\x87\xd0\xa7\x1a\x81\xb9\xc87sq\xd7\x15\xd6\x91O\x9c\x99!9>\xff\xa8\xfa\xe6=d\xcf\xca\xa9\xc61!\xc6P\x13\xd0\x88gZ\xbe\xdfl\xfa\xff\xb0m;d07tx\xbb\xabd\xe5\x16\xc4\xae\xf0', 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="a60a00000000000061118000000000001800"/31], &(0x7f0000000000)='GPL\x00'}, 0x94) write$binfmt_script(r5, &(0x7f0000000340)={'#! ', './file0'}, 0xb) execveat(r5, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 17.436359003s ago: executing program 1 (id=62): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x9, 0xff, 0x0, 0x0, 0x0, 0x3}}) 17.036284832s ago: executing program 1 (id=63): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x81}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x4) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) 13.453954605s ago: executing program 0 (id=70): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r3}, 0x10) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$AUTOFS_IOC_FAIL(r4, 0x4c80, 0xffffffffffffffb6) 13.140116935s ago: executing program 2 (id=72): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x6) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) rmdir(&(0x7f00000001c0)='./cgroup/../file0\x00') 10.765139249s ago: executing program 0 (id=73): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r3}, 0x10) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x700, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x4e23, @empty}}, @sadb_address={0x3, 0x6, 0xb8, 0x0, 0x0, @in={0x2, 0x3, @private}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x3, 0x2, 0x20000001}]}, 0x50}, 0x1, 0x7}, 0x0) 9.652818399s ago: executing program 0 (id=75): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x500, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) open(&(0x7f00000007c0)='./file1/file0\x00', 0x8001, 0x104) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x60602, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x60, 0x1403, 0x4, 0x70bd2d, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'batadv_slave_1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'syzkaller1\x00'}}]}, 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x800) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_open_dev$audion(&(0x7f0000000040), 0x1ff, 0x0) syz_open_dev$sndctrl(&(0x7f0000000040), 0x80000000, 0x0) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x109002) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x1cf) openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x0) syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x8000, 0x44, 0x18}, 0x18) 9.564112908s ago: executing program 2 (id=78): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000100)=0x8763ffe, 0x4) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, 0x0, &(0x7f0000000040)) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000080), 0x8) 8.02384364s ago: executing program 4 (id=79): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffff70) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) getdents(r0, 0x0, 0x58) 7.908061131s ago: executing program 2 (id=81): write$P9_RATTACH(0xffffffffffffffff, 0x0, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xb, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x200000000000000) 7.866074185s ago: executing program 4 (id=82): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x91ea6c1af182532) r1 = getpgid(0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000000)={0x2, r1}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000180)=ANY=[], 0x118) 7.632386948s ago: executing program 4 (id=83): socket$inet_udplite(0x2, 0x2, 0x88) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_usbip_server_init(0x1) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x5, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000380)={'vxcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000100)={0x1d, r4, 0x0, {0x0, 0xff, 0x2}, 0x6621350e9d60fd79}, 0x18) connect$can_j1939(r3, &(0x7f0000000080)={0x1d, r4, 0x0, {0x1, 0xf0}, 0x1}, 0x18) sendmsg$can_j1939(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0x0) 7.624809999s ago: executing program 0 (id=93): openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x8000, 0x44, 0x18}, 0x18) 7.504059161s ago: executing program 0 (id=85): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x7}, 0x50) r3 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) getdents64(r3, &(0x7f00000002c0)=""/37, 0x25) getdents64(r3, 0x0, 0x18) 6.025654416s ago: executing program 2 (id=87): socket$kcm(0xa, 0x3, 0x3a) fchown(0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$tipc(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) syz_open_dev$dri(0x0, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$sock_rose_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000200)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0xbc, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x5, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) pread64(0xffffffffffffffff, 0x0, 0x0, 0x1000000300) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f000001b700)=""/102392, 0x18ff8) syz_socket_connect_nvme_tcp() setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'8255\x00', [0x4f27, 0x7, 0x1, 0x16, 0x5, 0x5, 0x8, 0x3, 0xa, 0xfd, 0x1, 0x1, 0x1, 0x1, 0x6, 0x80009, 0xfffffffe, 0x7f, 0x3, 0x40000004, 0x89, 0xca9f, 0x3, 0x20001e58, 0xb, 0xe66, 0x3, 0x995d000, 0x4085, 0x0, 0xfffffff8]}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, 0x0) ioctl$DMA_BUF_SET_NAME_A(0xffffffffffffffff, 0x40046201, &(0x7f0000000040)='/dev/dma_heap/system\x00') preadv(0xffffffffffffffff, &(0x7f0000001240)=[{&(0x7f0000000040)=""/18, 0x12}], 0x1, 0x0, 0x0) 3.717824204s ago: executing program 3 (id=89): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000600)=ANY=[], 0x48) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x1c) 3.717486344s ago: executing program 4 (id=90): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000600)=ANY=[], 0x48) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe80000000000000000000"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x1c) 3.712541985s ago: executing program 2 (id=100): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x4, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r3}, 0x10) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$AUTOFS_IOC_FAIL(r4, 0x4c80, 0xffffffffffffffb6) 1.685935194s ago: executing program 32 (id=63): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x81}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x4) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) 1.531574179s ago: executing program 3 (id=92): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) getgroups(0x0, 0x0) setgroups(0x0, 0x0) keyctl$chown(0x4, r3, 0xee01, 0x0) keyctl$setperm(0x5, r3, 0x30925) 1.530130029s ago: executing program 4 (id=94): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60242, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000f40)={'pimreg\x00', 0x3c32}) pwritev2(r0, &(0x7f0000000340)=[{&(0x7f0000000080)='!', 0x1}], 0x1, 0xa74a, 0x80000000, 0x18) 1.411202481s ago: executing program 0 (id=95): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x9, 0x3, 0x8, 0x4, 0x2}, 0x50) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = syz_io_uring_setup(0x23c, &(0x7f0000000740)={0x0, 0x1c2c, 0x10100, 0x2, 0x315, 0x0, r2}, &(0x7f0000000500)=0x0, &(0x7f00000001c0)=0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f00000003c0)='./bus\x00', &(0x7f0000000540)='system.posix_acl_access\x00', &(0x7f0000000980), 0x24, 0x0) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f00000005c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0xc8c4}, 0x4011) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r2, 0x0, 0x0, 0x0, {0x609}, 0x1}) io_uring_enter(r3, 0x2ded, 0x4000, 0x0, 0x0, 0x0) read$FUSE(r6, &(0x7f00000007c0)={0x2020}, 0x2020) r7 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r0) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000000b80)={0x0, 0x11, &(0x7f0000000b40)={&(0x7f0000000000)={0x24, r7, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x24004810}, 0x20020000) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x4, 0x4, 0x39c, 0xffffffff, 0x0, 0x0, 0x0, 0xfeffffff, 0xffffffff, 0x2d4, 0x2d4, 0x2d4, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0xfc, 0x120, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'team0\x00', {0x6d, 0x6, 0x81, 0x9, 0x8, 0xf, 0x5, 0x20, 0x80}, {0x7}}}]}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0xa4, 0xc8}, @REJECT={0x24}}, {{@uncond, 0x0, 0xc8, 0xec, 0x0, {}, [@common=@inet=@dscp={{0x24}, {0x4, 0x1}}]}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x6}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x40c) syz_usb_connect$cdc_ncm(0x6, 0x9b, &(0x7f0000002800)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x89, 0x2, 0x1, 0x9, 0x30, 0x1, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "0ef798"}, {0x5, 0x24, 0x0, 0x3b}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x11, 0x5, 0x7}, {0x6, 0x24, 0x1a, 0x0, 0x8}, [@obex={0x5, 0x24, 0x15, 0x5}, @country_functional={0x10, 0x24, 0x7, 0xbc, 0x9, [0xa, 0x5, 0x5, 0xb, 0xfff]}, @mbim_extended={0x8, 0x24, 0x1c, 0x8, 0x9}, @obex={0x5, 0x24, 0x15, 0x86}, @country_functional={0x8, 0x24, 0x7, 0x8, 0x3ff, [0x40]}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0xff, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0x44, 0x2, 0x2c}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x0, 0x6, 0x6}}}}}}}]}}, &(0x7f0000002b00)={0xa, &(0x7f0000000600)={0xa, 0x6, 0x310, 0x1, 0x2, 0xf1, 0xff, 0xc}, 0x3d, &(0x7f00000006c0)={0x5, 0xf, 0x3d, 0x5, [@ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x3, "49910b417a58f19cc267164f19713de6"}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x4, "3f4095f3d2eb054f06dd1a1797cd53dc"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x0, 0x7, 0x6fc0}]}, 0x6, [{0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x2401}}, {0x1e, &(0x7f00000028c0)=@string={0x1e, 0x3, "ec0e53db530c548072c770879775f26e27630d3ad4dcc287c702c9c6"}}, {0x87, &(0x7f0000002900)=@string={0x87, 0x3, "7393d7e51982e43f0c58697ecc27ecd0897305c2c6b0c9003e1278aa0975b5504c90e9c8e951a8d35132792d126b677566c2f1711f2f207fd0290c2725f98b9774fbf6b51288de6b6e49781fda43cd4c52ee7fe8c7dac018961e855cccf460db047d4b5b778964d68bceb72f123b5f892d5710ed487e8e2e87e9383317ac7aba67902349d4"}}, {0x4, &(0x7f00000029c0)=@lang_id={0x4, 0x3, 0x44e}}, {0x4, &(0x7f0000002a00)=@lang_id={0x4, 0x3, 0x3c17}}, {0x98, &(0x7f0000002a40)=@string={0x98, 0x3, "3f2d2dcd3b5a46dc8dbf2f940c34896e25a5e5b11e7afb5368ae8614e6f5b93548e1358b2bb2f06ea495ceecfb8434544101111f099ed46d35b59ef025aedbb2794e3a2b31700ccc93debea8124ac0e789b22c5bfb73db867ec8d568200bc289ae8e8d7d0afdbc0f087996d0ae2e1960ea0455e6ffe970af2612e7e076a549e11c5980d3be96a09690ae9573029757c267178343fc90"}}]}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) 288.898702ms ago: executing program 3 (id=96): openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x8000, 0x44, 0x18}, 0x18) 156.164835ms ago: executing program 2 (id=97): r0 = syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d000009040101"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000300)={0x40, 0x17, 0x14, "5ceb88210b1997a86c3decf7e6d983b35ea7ca31"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 155.788795ms ago: executing program 3 (id=98): ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, &(0x7f0000000280)={0xd, 0x6, {0x56, 0x4, 0x5, {0x0, 0x97}, {0x9ede, 0x3}, @cond=[{0x1, 0x5, 0x8, 0x8, 0xc, 0x4}, {0x6, 0x7, 0xa, 0x9bc, 0x0, 0x22e}]}, {0x57, 0xd, 0x229, {0x101}, {0x3, 0x1}, @const={0x10, {0x0, 0x24, 0x39, 0x6}}}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@any, 0x2}) 120.589798ms ago: executing program 3 (id=99): r0 = syz_open_dev$I2C(&(0x7f0000000880), 0x0, 0x101001) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000b80)={&(0x7f0000000b00)=[{0x236, 0xf411, 0x29, &(0x7f00000008c0)="090767b9a869995f8d19b8db6adb68e8f1d4ecc55c313574620e12c02fc41bb0114bb67d5a4fa8140d"}], 0x1}) 82.516752ms ago: executing program 4 (id=101): syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 0s ago: executing program 3 (id=102): bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0xfffffffffffffda2, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregset(0x4205, r0, 0x1, &(0x7f0000000100)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aedba283413e674c7719c33a4b17f028f68610a6c55bb2bf8282853f3e16f8394a8676ff55a3507e2ad50248c6130863b0f7433c7fbc9b978a39eae88bffd05d139cedbee444f7c98e1f92b0f64462b4b470bedced2125e0b1f38fbaa348c6d75aa1a4011e9cdae15ecb9309b0101edbf6dd6d111d6132f1821a4e4cbec8438c571a70e7ca7b0451a6cc55c", 0x98}) ptrace$setregset(0x4205, r0, 0x1, &(0x7f00000001c0)={&(0x7f0000000000)="c945b941eb6a3f6dedf11f1508685636", 0xfffffffffffffda4}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.104' (ED25519) to the list of known hosts. syzkaller login: [ 64.463050][ T4171] cgroup: Unknown subsys name 'net' [ 64.595039][ T4171] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 66.080163][ T4171] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 68.055300][ T4192] chnl_net:caif_netlink_parms(): no params data found [ 68.121130][ T4190] chnl_net:caif_netlink_parms(): no params data found [ 68.132687][ T4186] chnl_net:caif_netlink_parms(): no params data found [ 68.152854][ T4181] chnl_net:caif_netlink_parms(): no params data found [ 68.212629][ T4182] chnl_net:caif_netlink_parms(): no params data found [ 68.263496][ T4192] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.273657][ T4192] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.282359][ T4192] device bridge_slave_0 entered promiscuous mode [ 68.296140][ T4192] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.303560][ T4192] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.311779][ T4192] device bridge_slave_1 entered promiscuous mode [ 68.409046][ T4192] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.418471][ T4181] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.425549][ T4181] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.433726][ T4181] device bridge_slave_0 entered promiscuous mode [ 68.450445][ T4186] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.457552][ T4186] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.466166][ T4186] device bridge_slave_0 entered promiscuous mode [ 68.484407][ T4192] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.502507][ T4181] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.509787][ T4181] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.517596][ T4181] device bridge_slave_1 entered promiscuous mode [ 68.524937][ T4190] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.535661][ T4190] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.543912][ T4190] device bridge_slave_0 entered promiscuous mode [ 68.551495][ T4186] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.562262][ T4186] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.570571][ T4186] device bridge_slave_1 entered promiscuous mode [ 68.600334][ T4190] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.607416][ T4190] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.615557][ T4190] device bridge_slave_1 entered promiscuous mode [ 68.638161][ T4182] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.645264][ T4182] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.653330][ T4182] device bridge_slave_0 entered promiscuous mode [ 68.663525][ T4192] team0: Port device team_slave_0 added [ 68.671876][ T4192] team0: Port device team_slave_1 added [ 68.700904][ T4182] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.708279][ T4182] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.716113][ T4182] device bridge_slave_1 entered promiscuous mode [ 68.733610][ T4181] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.744817][ T4190] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.756253][ T4186] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.782412][ T4181] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.799376][ T4190] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.810489][ T4186] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.827026][ T4192] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.834355][ T4192] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.860795][ T4192] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.897598][ T4182] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.907324][ T4192] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.915015][ T4192] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.941000][ T4192] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.976643][ T4182] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.000299][ T4181] team0: Port device team_slave_0 added [ 69.009330][ T4190] team0: Port device team_slave_0 added [ 69.017394][ T4181] team0: Port device team_slave_1 added [ 69.031859][ T4186] team0: Port device team_slave_0 added [ 69.048875][ T4182] team0: Port device team_slave_0 added [ 69.056503][ T4190] team0: Port device team_slave_1 added [ 69.080709][ T4186] team0: Port device team_slave_1 added [ 69.087656][ T4182] team0: Port device team_slave_1 added [ 69.108419][ T4181] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.115404][ T4181] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.141337][ T4181] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.186449][ T4181] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.193620][ T4181] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.219717][ T4181] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.250308][ T4192] device hsr_slave_0 entered promiscuous mode [ 69.257087][ T4192] device hsr_slave_1 entered promiscuous mode [ 69.264793][ T4190] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.272227][ T4190] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.298524][ T4190] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.311319][ T4190] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.318464][ T4190] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.344985][ T4190] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.360284][ T4186] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.367450][ T4186] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.393510][ T4186] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.405125][ T4182] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.412283][ T4182] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.438256][ T4182] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.463562][ T4186] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.470738][ T4186] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.496712][ T4186] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.508538][ T4182] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.515524][ T4182] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.541705][ T4182] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.619702][ T4190] device hsr_slave_0 entered promiscuous mode [ 69.626620][ T4190] device hsr_slave_1 entered promiscuous mode [ 69.634884][ T4190] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 69.643675][ T4190] Cannot create hsr debugfs directory [ 69.664495][ T4181] device hsr_slave_0 entered promiscuous mode [ 69.671672][ T4181] device hsr_slave_1 entered promiscuous mode [ 69.678953][ T4181] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 69.686532][ T4181] Cannot create hsr debugfs directory [ 69.709048][ T7] Bluetooth: hci2: command 0x0409 tx timeout [ 69.716053][ T7] Bluetooth: hci1: command 0x0409 tx timeout [ 69.718090][ T2239] Bluetooth: hci4: command 0x0409 tx timeout [ 69.729010][ T2239] Bluetooth: hci3: command 0x0409 tx timeout [ 69.735493][ T2239] Bluetooth: hci0: command 0x0409 tx timeout [ 69.740504][ T4182] device hsr_slave_0 entered promiscuous mode [ 69.749294][ T4182] device hsr_slave_1 entered promiscuous mode [ 69.756275][ T4182] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 69.763934][ T4182] Cannot create hsr debugfs directory [ 69.817875][ T4186] device hsr_slave_0 entered promiscuous mode [ 69.828655][ T4186] device hsr_slave_1 entered promiscuous mode [ 69.835827][ T4186] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 69.844132][ T4186] Cannot create hsr debugfs directory [ 70.125241][ T4192] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 70.136899][ T4192] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 70.146683][ T4192] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 70.166964][ T4192] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 70.229505][ T4181] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.241524][ T4181] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.252581][ T4181] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.265603][ T4181] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.317296][ T4190] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 70.332118][ T4190] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 70.343262][ T4190] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 70.356201][ T4190] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 70.404004][ T4192] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.443527][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.453127][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.465156][ T4182] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 70.484307][ T4182] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 70.498502][ T4192] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.518901][ T4182] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 70.534648][ T4182] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 70.545145][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.554237][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 70.564284][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.571617][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.581686][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.591359][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 70.600229][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.607412][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.615227][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 70.627059][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 70.654924][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 70.677247][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 70.687160][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 70.696495][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 70.706106][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 70.724301][ T4181] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.747693][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 70.782667][ T4186] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 70.794601][ T4186] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 70.805920][ T4186] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 70.816442][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 70.826119][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 70.835266][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 70.844214][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 70.854261][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.862890][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.876871][ T4192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 70.891439][ T4181] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.899105][ T4186] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 70.947441][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.962029][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 70.972617][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.980034][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.001128][ T4190] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.019611][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.035752][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.045520][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.062033][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.069209][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.087876][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.096342][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.119775][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.129080][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.144243][ T4192] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.180428][ T4190] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.187346][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.197443][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.213037][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.225757][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.242320][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.262078][ T4182] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.280539][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.296026][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.306169][ T155] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.313679][ T155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.329951][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.340391][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.349974][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.375093][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.384914][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.395211][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.402408][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.403301][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.413212][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.417074][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.431992][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.469636][ T4182] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.481121][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.494533][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.506498][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.518935][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.527329][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.536782][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.546062][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.556992][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.565797][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.578634][ T4181] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.602456][ T4190] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 71.613182][ T4190] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.626004][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.635781][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.645008][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.653849][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.664765][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.673367][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.682046][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.691189][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.699806][ T155] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.706870][ T155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.722709][ T4186] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.750790][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.769598][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.779501][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.793855][ T4267] Bluetooth: hci0: command 0x041b tx timeout [ 71.800739][ T4267] Bluetooth: hci3: command 0x041b tx timeout [ 71.807783][ T4267] Bluetooth: hci4: command 0x041b tx timeout [ 71.821561][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.833232][ T4267] Bluetooth: hci1: command 0x041b tx timeout [ 71.842465][ T4267] Bluetooth: hci2: command 0x041b tx timeout [ 71.852781][ T155] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.859954][ T155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.877685][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.903354][ T4186] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.918491][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.932544][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.946692][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.982747][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.996796][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 72.048158][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 72.056764][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.069435][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.080331][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 72.089484][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 72.097886][ T1482] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.105013][ T1482] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.113474][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 72.122765][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 72.131750][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 72.140445][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.149304][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 72.156831][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 72.164655][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 72.172472][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 72.180684][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 72.197513][ T4181] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.210287][ T4182] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 72.224694][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 72.234830][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 72.243428][ T1482] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.250647][ T1482] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.259267][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.267514][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.283885][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 72.292625][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.303288][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.311680][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.325704][ T4190] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.358993][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 72.370115][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 72.379404][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 72.395907][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 72.404915][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 72.420591][ T4192] device veth0_vlan entered promiscuous mode [ 72.469366][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.482337][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.491896][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 72.501412][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 72.511226][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 72.520336][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.536582][ T4186] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 72.551253][ T4186] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 72.569805][ T4192] device veth1_vlan entered promiscuous mode [ 72.579180][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 72.587517][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 72.599377][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.607834][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.616927][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.626198][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.635207][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.644769][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.653176][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.670462][ T4190] device veth0_vlan entered promiscuous mode [ 72.696733][ T4181] device veth0_vlan entered promiscuous mode [ 72.708599][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 72.719236][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.727699][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.736741][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 72.745564][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 72.761753][ T4182] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.788964][ T4190] device veth1_vlan entered promiscuous mode [ 72.796095][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 72.811618][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.819824][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.832892][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 72.843019][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.880281][ T4192] device veth0_macvtap entered promiscuous mode [ 72.890405][ T4181] device veth1_vlan entered promiscuous mode [ 72.901932][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 72.911477][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 72.920447][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 72.936896][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.946923][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.973916][ T4192] device veth1_macvtap entered promiscuous mode [ 73.002959][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 73.011733][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 73.022343][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.031404][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.051321][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.066646][ T4181] device veth0_macvtap entered promiscuous mode [ 73.079962][ T4181] device veth1_macvtap entered promiscuous mode [ 73.087625][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 73.096030][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 73.103886][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.114804][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.123986][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.133591][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.142590][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 73.151641][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 73.161295][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 73.170397][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.179992][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 73.187846][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 73.198976][ T4182] device veth0_vlan entered promiscuous mode [ 73.210032][ T4190] device veth0_macvtap entered promiscuous mode [ 73.230183][ T4186] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.237670][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.248428][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.259166][ T4192] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.268993][ T4192] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.277731][ T4192] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.286886][ T4192] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.303921][ T4182] device veth1_vlan entered promiscuous mode [ 73.317785][ T4181] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.329129][ T4181] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.341079][ T4181] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.355008][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.363954][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.373233][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.382497][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.412758][ T4190] device veth1_macvtap entered promiscuous mode [ 73.441018][ T4182] device veth0_macvtap entered promiscuous mode [ 73.449307][ T4181] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.461002][ T4181] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.473484][ T4181] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.484482][ T4181] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.493680][ T4181] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.502480][ T4181] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.511431][ T4181] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.523313][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.532398][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.541700][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.551861][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.561414][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.577483][ T4182] device veth1_macvtap entered promiscuous mode [ 73.622119][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.635510][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.646334][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.656973][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.669501][ T4190] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.681795][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 73.691271][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 73.700702][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 73.711187][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.720427][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.743905][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.755107][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.765089][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.775570][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.787033][ T4190] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.804658][ T4190] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.815598][ T4190] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.825086][ T4190] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.834134][ T4190] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.847845][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.856957][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.866843][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 73.875196][ T4250] Bluetooth: hci1: command 0x040f tx timeout [ 73.877274][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 73.882292][ T4250] Bluetooth: hci4: command 0x040f tx timeout [ 73.895783][ T4250] Bluetooth: hci3: command 0x040f tx timeout [ 73.896299][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 73.909681][ T4250] Bluetooth: hci0: command 0x040f tx timeout [ 73.917678][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 73.934110][ T4182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.947319][ T4182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.958155][ T4267] Bluetooth: hci2: command 0x040f tx timeout [ 73.963383][ T4182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.975181][ T4182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.985114][ T4182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.995627][ T4182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.006863][ T4182] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.038784][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 74.052002][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 74.062717][ T4186] device veth0_vlan entered promiscuous mode [ 74.107201][ T4182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.124251][ T4182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.134782][ T4182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.145562][ T4182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.155730][ T4182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.166529][ T4182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.177750][ T4182] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.230613][ T1482] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.239825][ T1482] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.240466][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 74.257696][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 74.267136][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.286124][ T4186] device veth1_vlan entered promiscuous mode [ 74.301927][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.301978][ T4182] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.310839][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.330874][ T4182] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.339826][ T4182] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.354465][ T4182] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.379595][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.387660][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.395799][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.407604][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.477400][ T155] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.486777][ T155] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.504909][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.525768][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 74.534849][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 74.556367][ T4186] device veth0_macvtap entered promiscuous mode [ 74.582247][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.594417][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.606568][ T4294] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 74.615949][ T4294] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.660264][ T4186] device veth1_macvtap entered promiscuous mode [ 74.693251][ T4294] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.753847][ T4294] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.807914][ T4299] process 'syz.4.5' launched '/dev/fd/6' with NULL argv: empty string added [ 75.243284][ T4298] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 75.477118][ T4298] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 75.541737][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.556646][ T4300] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.610987][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.622479][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.633193][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.638457][ T4300] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.643652][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.661928][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.672068][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.690910][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.704289][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.724212][ T4298] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 75.734542][ T4298] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 75.744990][ T4298] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 75.835127][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.857102][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.949498][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.952190][ T4250] Bluetooth: hci0: command 0x0419 tx timeout [ 75.969549][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #0a!!! [ 75.981832][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 75.991976][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 76.002134][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 76.012292][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 76.022471][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 76.032608][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 76.098620][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.109691][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 76.118636][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #0a!!! [ 76.127992][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #0a!!! [ 76.246220][ T4250] Bluetooth: hci3: command 0x0419 tx timeout [ 76.252728][ T4250] Bluetooth: hci4: command 0x0419 tx timeout [ 76.259236][ T4250] Bluetooth: hci1: command 0x0419 tx timeout [ 76.265394][ T4250] Bluetooth: hci2: command 0x0419 tx timeout [ 76.368214][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.406042][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.438081][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.452759][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.587548][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.700109][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 76.716897][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 76.740783][ T4186] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.769155][ T4186] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.779411][ T4186] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.793158][ T4186] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.971678][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.998807][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.446497][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 79.227189][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.275493][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.285371][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.335960][ T1482] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 79.343973][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.533096][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 82.894448][ T4364] netlink: 'syz.4.16': attribute type 21 has an invalid length. [ 82.903577][ T4364] netlink: 156 bytes leftover after parsing attributes in process `syz.4.16'. [ 83.674837][ T4368] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.683773][ T4368] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.199845][ T4322] Bluetooth: hci5: command 0x1003 tx timeout [ 85.236587][ T4196] Bluetooth: hci5: sending frame failed (-49) [ 87.291895][ T23] cfg80211: failed to load regulatory.db [ 87.359060][ T23] Bluetooth: hci5: command 0x1001 tx timeout [ 87.421664][ T4196] Bluetooth: hci5: sending frame failed (-49) [ 87.977201][ T4396] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 89.534112][ T23] Bluetooth: hci5: command 0x1009 tx timeout [ 91.607957][ C0] sched: RT throttling activated [ 91.896960][ T4435] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.904508][ T4435] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.511121][ T4456] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 94.518072][ T4456] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 94.530670][ T4456] vhci_hcd vhci_hcd.0: Device attached [ 95.248288][ T4228] usb 39-1: new low-speed USB device number 2 using vhci_hcd [ 95.276691][ T4461] vhci_hcd: connection closed [ 95.293138][ T4354] vhci_hcd: stop threads [ 95.349362][ T4354] vhci_hcd: release socket [ 95.412013][ T4354] vhci_hcd: disconnect device [ 98.145509][ T4486] ODEBUG: Out of memory. ODEBUG disabled [ 100.679274][ T4228] vhci_hcd: vhci_device speed not set [ 105.638177][ T4557] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.645718][ T4557] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.434314][ T4561] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 106.440903][ T4561] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 106.450741][ T4561] vhci_hcd vhci_hcd.0: Device attached [ 106.728068][ T13] usb 33-1: new low-speed USB device number 2 using vhci_hcd [ 106.866051][ T4562] vhci_hcd: connection closed [ 106.867547][ T144] vhci_hcd: stop threads [ 107.334890][ C0] vxcan0: j1939_tp_rxtimer: 0xffff8880615b4000: rx timeout, send abort [ 107.345190][ C0] vxcan0: j1939_xtp_rx_abort_one: 0xffff8880615b4000: 0x0f001: (3) A timeout occurred and this is the connection abort to close the session. [ 107.414731][ T144] vhci_hcd: release socket [ 107.478579][ T144] vhci_hcd: disconnect device [ 112.908153][ T13] vhci_hcd: vhci_device speed not set [ 114.734209][ C0] vxcan0: j1939_tp_rxtimer: 0xffff88805e195800: rx timeout, send abort [ 114.742799][ C0] vxcan0: j1939_xtp_rx_abort_one: 0xffff88805e195800: 0x0f001: (3) A timeout occurred and this is the connection abort to close the session. [ 120.858329][ T4197] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 120.868189][ T4197] CPU: 1 PID: 4197 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 120.875752][ T4197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 120.885903][ T4197] Workqueue: hci4 hci_rx_work [ 120.890605][ T4197] Call Trace: [ 120.893888][ T4197] [ 120.896822][ T4197] dump_stack_lvl+0x168/0x230 [ 120.901523][ T4197] ? show_regs_print_info+0x20/0x20 [ 120.906728][ T4197] ? load_image+0x3b0/0x3b0 [ 120.911258][ T4197] sysfs_create_dir_ns+0x252/0x280 [ 120.916379][ T4197] ? __lock_acquire+0x7c60/0x7c60 [ 120.921421][ T4197] ? sysfs_warn_dup+0xa0/0xa0 [ 120.926097][ T4197] ? le_conn_complete_evt+0xcbc/0x1590 [ 120.931562][ T4197] ? hci_event_packet+0xe05/0x12f0 [ 120.936703][ T4197] ? process_one_work+0x863/0x1000 [ 120.941819][ T4197] ? do_raw_spin_unlock+0x11d/0x230 [ 120.947018][ T4197] kobject_add_internal+0x662/0xd00 [ 120.952223][ T4197] kobject_add+0x152/0x210 [ 120.956643][ T4197] ? kobject_init+0x1d0/0x1d0 [ 120.961334][ T4197] ? klist_children_get+0x50/0x50 [ 120.966359][ T4197] ? get_device_parent+0x121/0x3f0 [ 120.971473][ T4197] device_add+0x483/0xfb0 [ 120.975808][ T4197] hci_conn_add_sysfs+0xd1/0x1e0 [ 120.980750][ T4197] le_conn_complete_evt+0xcbc/0x1590 [ 120.986050][ T4197] ? cs_le_create_conn+0x5e0/0x5e0 [ 120.991172][ T4197] ? __mutex_trylock_common+0x14f/0x250 [ 120.996724][ T4197] hci_le_meta_evt+0x289/0x3b80 [ 121.001600][ T4197] ? hci_event_packet+0x36d/0x12f0 [ 121.006711][ T4197] ? hci_event_packet+0x2e2/0x12f0 [ 121.011825][ T4197] ? __lock_acquire+0x7c60/0x7c60 [ 121.016857][ T4197] ? hci_remote_host_features_evt+0x280/0x280 [ 121.022936][ T4197] ? __mutex_unlock_slowpath+0x19e/0x6a0 [ 121.028579][ T4197] ? mark_lock+0x94/0x320 [ 121.032922][ T4197] ? mutex_unlock+0x10/0x10 [ 121.037461][ T4197] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 121.043548][ T4197] ? lock_chain_count+0x20/0x20 [ 121.048406][ T4197] ? __rwlock_init+0x140/0x140 [ 121.053179][ T4197] hci_event_packet+0xe05/0x12f0 [ 121.058122][ T4197] ? lockdep_hardirqs_on+0x94/0x140 [ 121.063326][ T4197] ? rcu_lock_release+0x20/0x20 [ 121.068183][ T4197] ? hci_send_to_monitor+0x9c/0x4a0 [ 121.073384][ T4197] hci_rx_work+0x255/0xa10 [ 121.077809][ T4197] process_one_work+0x863/0x1000 [ 121.082755][ T4197] ? worker_detach_from_pool+0x240/0x240 [ 121.088414][ T4197] ? lockdep_hardirqs_off+0x70/0x100 [ 121.093727][ T4197] ? _raw_spin_lock_irq+0xab/0xe0 [ 121.098753][ T4197] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 121.104129][ T4197] ? wq_worker_running+0x97/0x170 [ 121.109168][ T4197] worker_thread+0xaa8/0x12a0 [ 121.113915][ T4197] ? _raw_spin_unlock_irqrestore+0x82/0x100 [ 121.119842][ T4197] ? lockdep_hardirqs_on+0x94/0x140 [ 121.125060][ T4197] ? lockdep_hardirqs_on+0x94/0x140 [ 121.130264][ T4197] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 121.136208][ T4197] kthread+0x436/0x520 [ 121.140288][ T4197] ? rcu_lock_release+0x20/0x20 [ 121.145146][ T4197] ? kthread_blkcg+0xd0/0xd0 [ 121.149759][ T4197] ret_from_fork+0x1f/0x30 [ 121.154197][ T4197] [ 121.165586][ T4197] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 121.179532][ T4197] Bluetooth: hci4: failed to register connection device [ 121.187667][ T4197] ================================================================== [ 121.196038][ T4197] BUG: KASAN: use-after-free in l2cap_sock_ready_cb+0xca/0x120 [ 121.203624][ T4197] Read of size 8 at addr ffff888016a484c8 by task kworker/u5:7/4197 [ 121.211636][ T4197] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 121.213989][ T4197] CPU: 1 PID: 4197 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 121.221563][ T4197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 121.231652][ T4197] Workqueue: hci4 hci_rx_work [ 121.236374][ T4197] Call Trace: [ 121.239679][ T4197] [ 121.242639][ T4197] dump_stack_lvl+0x168/0x230 [ 121.247354][ T4197] ? show_regs_print_info+0x20/0x20 [ 121.252592][ T4197] ? load_image+0x3b0/0x3b0 [ 121.257131][ T4197] ? _raw_spin_lock_irqsave+0xb0/0xf0 [ 121.262547][ T4197] ? rcu_lock_release+0x5/0x20 [ 121.267352][ T4197] print_address_description+0x60/0x2d0 [ 121.272934][ T4197] ? l2cap_sock_ready_cb+0xca/0x120 [ 121.278169][ T4197] kasan_report+0xdf/0x130 [ 121.282621][ T4197] ? l2cap_sock_ready_cb+0xca/0x120 [ 121.287858][ T4197] l2cap_sock_ready_cb+0xca/0x120 [ 121.292920][ T4197] l2cap_le_start+0x6c0/0x16a0 [ 121.297721][ T4197] ? lockdep_hardirqs_on+0x94/0x140 [ 121.302953][ T4197] ? l2cap_start_connection+0x5a0/0x5a0 [ 121.308541][ T4197] ? l2cap_conn_del+0x6a0/0x6a0 [ 121.313421][ T4197] ? __l2cap_chan_add+0x4a3/0x930 [ 121.318480][ T4197] l2cap_connect_cfm+0x6d7/0x10d0 [ 121.323555][ T4197] ? l2cap_ertm_resend+0x1070/0x1070 [ 121.328885][ T4197] ? l2cap_ertm_resend+0x1070/0x1070 [ 121.334213][ T4197] le_conn_complete_evt+0xdaf/0x1590 [ 121.339549][ T4197] ? cs_le_create_conn+0x5e0/0x5e0 [ 121.344698][ T4197] ? __mutex_trylock_common+0x14f/0x250 [ 121.350281][ T4197] hci_le_meta_evt+0x289/0x3b80 [ 121.355167][ T4197] ? hci_event_packet+0x36d/0x12f0 [ 121.360360][ T4197] ? hci_event_packet+0x2e2/0x12f0 [ 121.365511][ T4197] ? __lock_acquire+0x7c60/0x7c60 [ 121.370579][ T4197] ? hci_remote_host_features_evt+0x280/0x280 [ 121.376680][ T4197] ? __mutex_unlock_slowpath+0x19e/0x6a0 [ 121.382349][ T4197] ? mark_lock+0x94/0x320 [ 121.386715][ T4197] ? mutex_unlock+0x10/0x10 [ 121.391252][ T4197] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 121.397271][ T4197] ? lock_chain_count+0x20/0x20 [ 121.402158][ T4197] ? __rwlock_init+0x140/0x140 [ 121.406961][ T4197] hci_event_packet+0xe05/0x12f0 [ 121.411931][ T4197] ? lockdep_hardirqs_on+0x94/0x140 [ 121.417218][ T4197] ? rcu_lock_release+0x20/0x20 [ 121.422115][ T4197] ? hci_send_to_monitor+0x9c/0x4a0 [ 121.427357][ T4197] hci_rx_work+0x255/0xa10 [ 121.431818][ T4197] process_one_work+0x863/0x1000 [ 121.436803][ T4197] ? worker_detach_from_pool+0x240/0x240 [ 121.442465][ T4197] ? lockdep_hardirqs_off+0x70/0x100 [ 121.447787][ T4197] ? _raw_spin_lock_irq+0xab/0xe0 [ 121.452851][ T4197] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 121.458252][ T4197] ? wq_worker_running+0x97/0x170 [ 121.463297][ T4197] worker_thread+0xaa8/0x12a0 [ 121.467985][ T4197] ? _raw_spin_unlock_irqrestore+0x82/0x100 [ 121.473891][ T4197] ? lockdep_hardirqs_on+0x94/0x140 [ 121.479115][ T4197] ? lockdep_hardirqs_on+0x94/0x140 [ 121.484365][ T4197] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 121.490277][ T4197] kthread+0x436/0x520 [ 121.494354][ T4197] ? rcu_lock_release+0x20/0x20 [ 121.499217][ T4197] ? kthread_blkcg+0xd0/0xd0 [ 121.503819][ T4197] ret_from_fork+0x1f/0x30 [ 121.508297][ T4197] [ 121.511334][ T4197] [ 121.513742][ T4197] Allocated by task 4669: [ 121.518197][ T4197] __kasan_kmalloc+0xb5/0xf0 [ 121.522791][ T4197] sk_prot_alloc+0xe7/0x210 [ 121.527451][ T4197] sk_alloc+0x2f/0x310 [ 121.531542][ T4197] l2cap_sock_alloc+0x33/0x200 [ 121.536336][ T4197] l2cap_sock_create+0x118/0x1d0 [ 121.541289][ T4197] bt_sock_create+0x155/0x220 [ 121.545987][ T4197] __sock_create+0x47b/0x900 [ 121.550581][ T4197] __sys_socket+0xe2/0x170 [ 121.554997][ T4197] __x64_sys_socket+0x76/0x80 [ 121.559676][ T4197] do_syscall_64+0x4c/0xa0 [ 121.564091][ T4197] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 121.569985][ T4197] [ 121.572307][ T4197] Freed by task 4668: [ 121.576279][ T4197] kasan_set_track+0x4b/0x70 [ 121.580872][ T4197] kasan_set_free_info+0x1f/0x40 [ 121.585817][ T4197] ____kasan_slab_free+0xd5/0x110 [ 121.590844][ T4197] slab_free_freelist_hook+0xea/0x170 [ 121.596222][ T4197] kfree+0xef/0x2a0 [ 121.600041][ T4197] __sk_destruct+0x578/0x840 [ 121.604634][ T4197] l2cap_sock_release+0x169/0x1e0 [ 121.609664][ T4197] sock_close+0xd5/0x240 [ 121.613913][ T4197] __fput+0x234/0x930 [ 121.617987][ T4197] task_work_run+0x125/0x1a0 [ 121.622609][ T4197] exit_to_user_mode_loop+0x10f/0x130 [ 121.628007][ T4197] exit_to_user_mode_prepare+0xee/0x180 [ 121.633571][ T4197] syscall_exit_to_user_mode+0x16/0x40 [ 121.639043][ T4197] do_syscall_64+0x58/0xa0 [ 121.643468][ T4197] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 121.649371][ T4197] [ 121.651702][ T4197] The buggy address belongs to the object at ffff888016a48000 [ 121.651702][ T4197] which belongs to the cache kmalloc-2k of size 2048 [ 121.665781][ T4197] The buggy address is located 1224 bytes inside of [ 121.665781][ T4197] 2048-byte region [ffff888016a48000, ffff888016a48800) [ 121.679260][ T4197] The buggy address belongs to the page: [ 121.684924][ T4197] page:ffffea00005a9200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16a48 [ 121.695082][ T4197] head:ffffea00005a9200 order:3 compound_mapcount:0 compound_pincount:0 [ 121.703415][ T4197] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 121.711414][ T4197] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888016842000 [ 121.720035][ T4197] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 121.728634][ T4197] page dumped because: kasan: bad access detected [ 121.735066][ T4197] page_owner tracks the page as allocated [ 121.740785][ T4197] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4186, ts 67870525192, free_ts 67839001604 [ 121.760853][ T4197] get_page_from_freelist+0x1b77/0x1c60 [ 121.766509][ T4197] __alloc_pages+0x1e1/0x470 [ 121.771112][ T4197] new_slab+0xc0/0x4b0 [ 121.775197][ T4197] ___slab_alloc+0x81e/0xdf0 [ 121.779789][ T4197] __kmalloc_node_track_caller+0x1fc/0x3a0 [ 121.785603][ T4197] pskb_expand_head+0x127/0x10f0 [ 121.790553][ T4197] netlink_trim+0x180/0x220 [ 121.795066][ T4197] netlink_broadcast_filtered+0x7c/0x1170 [ 121.800792][ T4197] nlmsg_notify+0xec/0x1a0 [ 121.805236][ T4197] register_netdevice+0x1370/0x16b0 [ 121.810441][ T4197] register_netdev+0x37/0x50 [ 121.815037][ T4197] ip6_tnl_init_net+0x234/0x2e0 [ 121.819889][ T4197] ops_init+0x357/0x600 [ 121.824049][ T4197] setup_net+0x38d/0x9f0 [ 121.828298][ T4197] copy_net_ns+0x348/0x5b0 [ 121.832719][ T4197] create_new_namespaces+0x3d3/0x6f0 [ 121.838008][ T4197] page last free stack trace: [ 121.842678][ T4197] free_unref_page_prepare+0x637/0x6c0 [ 121.848139][ T4197] free_unref_page+0x94/0x280 [ 121.852827][ T4197] qlist_free_all+0x35/0x90 [ 121.857336][ T4197] kasan_quarantine_reduce+0x150/0x160 [ 121.862801][ T4197] __kasan_slab_alloc+0x2f/0xd0 [ 121.867662][ T4197] slab_post_alloc_hook+0x4c/0x380 [ 121.872775][ T4197] kmem_cache_alloc_node+0x12d/0x2d0 [ 121.878060][ T4197] __alloc_skb+0xf4/0x750 [ 121.882401][ T4197] rtmsg_ifinfo_build_skb+0x80/0x180 [ 121.887690][ T4197] rtmsg_ifinfo+0x71/0x120 [ 121.892122][ T4197] register_netdevice+0x1370/0x16b0 [ 121.897334][ T4197] tun_set_iff+0x82a/0xda0 [ 121.901753][ T4197] __tun_chr_ioctl+0x722/0x1e70 [ 121.906612][ T4197] __se_sys_ioctl+0xfa/0x170 [ 121.911209][ T4197] do_syscall_64+0x4c/0xa0 [ 121.915629][ T4197] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 121.921542][ T4197] [ 121.923867][ T4197] Memory state around the buggy address: [ 121.929497][ T4197] ffff888016a48380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 121.937562][ T4197] ffff888016a48400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 121.945628][ T4197] >ffff888016a48480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 121.953686][ T4197] ^ [ 121.960098][ T4197] ffff888016a48500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 121.968165][ T4197] ffff888016a48580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 121.976227][ T4197] ================================================================== [ 121.984291][ T4197] Disabling lock debugging due to kernel taint [ 122.002381][ T4270] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 122.038037][ T4197] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 122.045294][ T4197] CPU: 0 PID: 4197 Comm: kworker/u5:7 Tainted: G B syzkaller #0 [ 122.054295][ T4197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 122.064502][ T4197] Workqueue: hci4 hci_rx_work [ 122.069218][ T4197] Call Trace: [ 122.072585][ T4197] [ 122.075524][ T4197] dump_stack_lvl+0x168/0x230 [ 122.080213][ T4197] ? show_regs_print_info+0x20/0x20 [ 122.085432][ T4197] ? load_image+0x3b0/0x3b0 [ 122.089945][ T4197] panic+0x2c9/0x7f0 [ 122.093849][ T4197] ? bpf_jit_dump+0xd0/0xd0 [ 122.098355][ T4197] ? _raw_spin_unlock_irqrestore+0xf6/0x100 [ 122.104253][ T4197] ? _raw_spin_unlock+0x40/0x40 [ 122.109106][ T4197] ? l2cap_sock_ready_cb+0xca/0x120 [ 122.114316][ T4197] check_panic_on_warn+0x80/0xa0 [ 122.119266][ T4197] ? l2cap_sock_ready_cb+0xca/0x120 [ 122.124470][ T4197] end_report+0x6d/0xf0 [ 122.128626][ T4197] kasan_report+0x102/0x130 [ 122.133136][ T4197] ? l2cap_sock_ready_cb+0xca/0x120 [ 122.138339][ T4197] l2cap_sock_ready_cb+0xca/0x120 [ 122.143389][ T4197] l2cap_le_start+0x6c0/0x16a0 [ 122.148161][ T4197] ? lockdep_hardirqs_on+0x94/0x140 [ 122.153374][ T4197] ? l2cap_start_connection+0x5a0/0x5a0 [ 122.158928][ T4197] ? l2cap_conn_del+0x6a0/0x6a0 [ 122.163867][ T4197] ? __l2cap_chan_add+0x4a3/0x930 [ 122.168898][ T4197] l2cap_connect_cfm+0x6d7/0x10d0 [ 122.173930][ T4197] ? l2cap_ertm_resend+0x1070/0x1070 [ 122.179222][ T4197] ? l2cap_ertm_resend+0x1070/0x1070 [ 122.184512][ T4197] le_conn_complete_evt+0xdaf/0x1590 [ 122.189805][ T4197] ? cs_le_create_conn+0x5e0/0x5e0 [ 122.194920][ T4197] ? __mutex_trylock_common+0x14f/0x250 [ 122.200468][ T4197] hci_le_meta_evt+0x289/0x3b80 [ 122.205318][ T4197] ? hci_event_packet+0x36d/0x12f0 [ 122.210435][ T4197] ? hci_event_packet+0x2e2/0x12f0 [ 122.215643][ T4197] ? __lock_acquire+0x7c60/0x7c60 [ 122.221107][ T4197] ? hci_remote_host_features_evt+0x280/0x280 [ 122.227177][ T4197] ? __mutex_unlock_slowpath+0x19e/0x6a0 [ 122.232816][ T4197] ? mark_lock+0x94/0x320 [ 122.237154][ T4197] ? mutex_unlock+0x10/0x10 [ 122.241660][ T4197] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 122.247646][ T4197] ? lock_chain_count+0x20/0x20 [ 122.252500][ T4197] ? __rwlock_init+0x140/0x140 [ 122.257276][ T4197] hci_event_packet+0xe05/0x12f0 [ 122.262249][ T4197] ? lockdep_hardirqs_on+0x94/0x140 [ 122.267453][ T4197] ? rcu_lock_release+0x20/0x20 [ 122.272307][ T4197] ? hci_send_to_monitor+0x9c/0x4a0 [ 122.277523][ T4197] hci_rx_work+0x255/0xa10 [ 122.281945][ T4197] process_one_work+0x863/0x1000 [ 122.286893][ T4197] ? worker_detach_from_pool+0x240/0x240 [ 122.292526][ T4197] ? lockdep_hardirqs_off+0x70/0x100 [ 122.297812][ T4197] ? _raw_spin_lock_irq+0xab/0xe0 [ 122.302849][ T4197] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 122.308242][ T4197] ? wq_worker_running+0x97/0x170 [ 122.313305][ T4197] worker_thread+0xaa8/0x12a0 [ 122.317992][ T4197] ? _raw_spin_unlock_irqrestore+0x82/0x100 [ 122.323888][ T4197] ? lockdep_hardirqs_on+0x94/0x140 [ 122.329090][ T4197] ? lockdep_hardirqs_on+0x94/0x140 [ 122.334290][ T4197] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 122.340187][ T4197] kthread+0x436/0x520 [ 122.344260][ T4197] ? rcu_lock_release+0x20/0x20 [ 122.349202][ T4197] ? kthread_blkcg+0xd0/0xd0 [ 122.353793][ T4197] ret_from_fork+0x1f/0x30 [ 122.358214][ T4197] [ 122.361542][ T4197] Kernel Offset: disabled [ 122.365893][ T4197] Rebooting in 86400 seconds..