last executing test programs: 10.321051051s ago: executing program 3 (id=772): socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x2, 0x300) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, 0x0, 0x0) sendmsg$tipc(r3, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x10) 8.533751694s ago: executing program 2 (id=776): r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_int(r0, 0x0, 0x31, &(0x7f0000000000)=0x6, 0x4) socket$packet(0x11, 0x2, 0x300) syz_genetlink_get_family_id$SEG6(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2}, 0x10) sendmsg$tipc(r4, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x10) 8.374620234s ago: executing program 0 (id=778): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000181100"/20, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df"], 0x0, 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8"], 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 8.277084559s ago: executing program 0 (id=780): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000480)={0x14, 0xa, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x44}, 0x20010094) 8.161032366s ago: executing program 0 (id=781): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) dup(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$hid(0x0, 0x3f, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000340)={0x3, 0x5, 0x0, 0x824a, 0x2}) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, 0x0, 0x400, 0x70bd27, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0x6, 0x1000, 0x400, 0x3ff}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8080}, 0x4004) openat$sequencer2(0xffffff9c, &(0x7f0000000040), 0x400, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7fff0000000000002800128009000100766c616e000000001800028006000100340200000c0002001f0000001e00000008000500", @ANYRES32], 0x50}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000001000008000500", @ANYRES32=r7], 0x50}}, 0x2) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r8}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) 8.120266138s ago: executing program 1 (id=782): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) execveat(0xffffffffffffff9c, &(0x7f0000000300)='./file2\x00', 0x0, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0xc0001, 0x0) ioctl$TIOCSETD(r2, 0x5423, 0x0) ioctl$TCSETS(r2, 0x40384708, &(0x7f0000000040)={0x8, 0x1, 0xd8, 0x3f, 0x6, "3e4cd25529e20900"}) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) ioctl$DRM_IOCTL_MODE_GETPLANE(r3, 0xc02064b6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r3, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240), &(0x7f0000000040), 0x0, r4}) ioctl$DRM_IOCTL_MODE_ATOMIC(r3, 0xc03864bc, &(0x7f0000000580)={0x201, 0x1, &(0x7f0000000180)=[r4], &(0x7f0000000400)=[0x3], &(0x7f0000000640)=[0x0, 0x0, 0x0], &(0x7f0000000340), 0x0, 0xffffffffffffffff}) r5 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@mpls_delroute={0x30, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_VIA={0x14, 0x12, {0xa, "a51b69ae9597407dc5518eada89d"}}]}, 0x30}}, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x20000023892) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000100000000000000004000050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e65740000000c00078008001240"], 0x5c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)={0x24, 0x4, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x11}, 0x28000080) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) sched_setscheduler(0x0, 0x6, &(0x7f0000000080)=0x6) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000c7ce360863078120abd001e402010902120001000000000904000000ff"], 0x0) 7.132183065s ago: executing program 0 (id=786): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) setgroups(0x0, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x4}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) syz_open_dev$tty1(0xc, 0x4, 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000004c0)={'syz0\x00', {0x87, 0x3, 0x1, 0x9}, 0xb, [0x4, 0x6, 0x802, 0xe9a2, 0x1, 0x0, 0xa9ba, 0xc1f, 0x1, 0x7f5b, 0x3, 0x4, 0x5, 0x10004, 0x2, 0x3, 0x8, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x0, 0x3, 0x9, 0xfff, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xfffffffc, 0x0, 0x9, 0xb, 0xcc, 0x4, 0x2, 0x401, 0x5, 0x5, 0xfffffffd, 0x8, 0xb, 0x3, 0xffff8001, 0x6, 0x3, 0x80000000, 0x1, 0xa, 0x3, 0x8, 0x5, 0xfff, 0x1, 0x7fe, 0x7fff, 0x10000, 0x2, 0x8], [0x2, 0x1, 0x10000, 0x7, 0x9, 0x6, 0x5, 0x4, 0x9, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x7, 0x8, 0x5, 0xcc, 0xbc1, 0x80000, 0x0, 0x5e81339d, 0xffffc256, 0xb, 0x80000001, 0x0, 0x0, 0x4, 0x4, 0x7, 0x8, 0x10d, 0x1, 0x5, 0x5, 0xfffffb66, 0xfb5, 0x2, 0x4, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x4, 0x6f, 0x80b, 0x1, 0x1, 0x525ba681, 0x4f74, 0x7, 0x1, 0x1, 0xfffffffd, 0x100, 0x6, 0x10000, 0x1306, 0x8b, 0x10000, 0xfe4, 0x3ff], [0x2, 0x40, 0x200, 0xfffffff9, 0x7aa, 0x10, 0x80, 0x8001, 0x5, 0x0, 0x9, 0x8, 0x7fffffff, 0x1, 0x1, 0x4, 0x8, 0xa9, 0x7, 0x49, 0x6, 0x4, 0x5, 0xa3, 0x40003, 0x2, 0x0, 0x3, 0x4c, 0x3, 0x5, 0x4, 0xd21e, 0x9, 0x12, 0x0, 0x2, 0xfff, 0x926, 0x800100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x81, 0x47, 0x7, 0x0, 0x11, 0x2, 0xffd, 0x7, 0x7, 0x7ffd, 0x7ff, 0x10, 0x9, 0x10001, 0x8000001, 0x10001, 0x6, 0x71c], [0x81, 0x6, 0x10, 0x4e26, 0x3, 0x7, 0xfffffff3, 0x497, 0x4, 0x1, 0x3, 0x5, 0x56, 0xc28, 0x9, 0x5, 0x5, 0xa, 0x79a, 0x4, 0x9, 0x6, 0xc41f, 0x5, 0x8b6, 0xffffffff, 0x0, 0x0, 0x6a, 0x9, 0x0, 0x0, 0x1000, 0x10, 0xd, 0x6, 0x8000, 0x53, 0x78d, 0x4, 0x1, 0x9, 0xfffffff8, 0x9, 0x7, 0x7, 0x101, 0x7, 0x7, 0x4, 0x0, 0xb, 0x400400, 0x8, 0x0, 0x8, 0x7, 0x9, 0x8, 0x0, 0x1, 0x8001, 0xfffffff7, 0x5]}, 0x45c) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000000314230c2dbd7000ffdbdf250900020073797a32000f00000800410072786500140033007767320000000000000000000000000066129cbdaaf92ea305126427a766b1c085924cd6ad57b03cfe9655f622d77d2aeea86454e08d702ca2d6392ca31ef21b722d78da5d90886bb0db32b0e33c89a5e901bb4e0379f25665d395238e6730ad37288567b268fe7f1586d588e526e7d727ec73b81279a75e879dd960e5107507609756ec582a8032a0ae41beb1"], 0x38}, 0x1, 0x0, 0x0, 0x400c080}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 6.87426905s ago: executing program 3 (id=787): socket$kcm(0x2b, 0x1, 0x0) socket$kcm(0x10, 0x2, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000140)={0x5, "2a1850a260a5545907acb5e083c9edcd03fbec80854ed2281ad1d75fc1362a42"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, 0x0) pipe2$watch_queue(&(0x7f0000001100), 0x80) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) bind$netrom(r3, 0x0, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000240), 0xc, 0x101301) ioctl$USBDEVFS_IOCTL(r5, 0xc0105500, &(0x7f0000000040)=@usbdevfs_connect={0x6a0}) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r7, 0x4048aecb, &(0x7f0000000180)={0x4, 0x0, [{0x0, 0x0, 0x0, 0x2, 0x0, 0x800}, {0x0, 0x6}, {0x5e2796afef1a2f31, 0xffffffff, 0x0, 0x9, 0x1, 0x80000001, 0x8}, {0x80000001, 0xffffffff, 0x7, 0x8, 0x5, 0x110, 0x3}]}) r8 = syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r8, 0xc0405602, &(0x7f0000000040)={0x0, 0x1, 0x0, "11010000001400000100b64c0000005c4b7c1500", 0x20303159}) listen(r3, 0x80) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000600)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_9p2000}]}}) 5.543155008s ago: executing program 4 (id=788): bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xb}}, 0x6}, 0x1c) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="e0000002ac1414aa0000000003"], 0x1c) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) 5.189087139s ago: executing program 4 (id=789): syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000500)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000700)}, 0x64) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000340)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getdents64(r2, &(0x7f0000000580)=""/174, 0xff56) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, 0x0, 0x40c1) 4.741274484s ago: executing program 4 (id=790): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000181100"/20, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df"], 0x0, 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8"], 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 4.718131205s ago: executing program 2 (id=791): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0xffffffffffffff23, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x63, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x4, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) socket$netlink(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 4.597022092s ago: executing program 4 (id=792): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}, @TCA_FQ_CODEL_DROP_BATCH_SIZE={0x8, 0x8, 0x5}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d88a8", 0x12, 0x40, &(0x7f00000001c0)={0x11, 0x88a8, r3, 0x1, 0xd7, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) 4.511982958s ago: executing program 4 (id=793): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) syz_usbip_server_init(0x6) 4.46756716s ago: executing program 2 (id=794): socket$alg(0x26, 0x5, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, 0x0, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x1, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r5, &(0x7f0000000140)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x40) connect$rose(r5, &(0x7f0000000100)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, [@null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default, @bcast, @default]}, 0x40) 4.219149625s ago: executing program 1 (id=795): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96d", 0xe}], 0x1}, 0x0) 3.993326268s ago: executing program 1 (id=796): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) recvfrom$ax25(r2, &(0x7f0000000280)=""/102, 0x66, 0x40001000, &(0x7f0000000300)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x4}, [@null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @default]}, 0x48) recvfrom$ax25(r2, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) 3.665026927s ago: executing program 3 (id=797): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x2002c810) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2000000000002) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x18d7, &(0x7f0000000040)={0x0, 0x0, 0x2, 0x0, 0x25b}, &(0x7f0000ffe000), &(0x7f0000ffe000)) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r3, 0x2, &(0x7f0000000180), 0xfe) 3.528860164s ago: executing program 2 (id=798): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a73a5aba55a87d2a2525295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507acd92c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd100962db9a83ad63a4e7e1ca17c1b6aac63fefa9bebe429d00"}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffffffffffcfe, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, &(0x7f0000001500), 0x4) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) io_uring_setup(0x1d34, &(0x7f0000000300)={0x0, 0x5779, 0x2, 0x0, 0xd4}) sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20024800}, 0x20008010) syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x7, &(0x7f0000000040)=ANY=[@ANYBLOB="18070000000000000000000000000000851000000300000018000000000000000008000000000000950000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') socket(0x23, 0x2, 0x1) 3.471598138s ago: executing program 1 (id=799): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x70bd2b, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x3d1, 0x3, 0x20000000, 0x6, 0x6}, 0x7b}}]}, {0x4}, {0x43, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}}, 0x2) close(r3) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r2, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200000314000e00002fb96dffff1144ee163cddcb00"/38, 0x26}, {&(0x7f00000004c0)="f058fe7dad777f8f", 0xdd86}], 0x2}, 0x4005) 2.862692863s ago: executing program 1 (id=800): r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) io_setup(0x800, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f000044c000/0x800000)=nil, 0x800000, 0x8, 0x10, r0, 0x0) io_submit(0x0, 0x1, &(0x7f00000004c0)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x3, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x2}]) 2.802780857s ago: executing program 2 (id=801): syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000500)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000700)}, 0x64) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000340)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getdents64(r2, &(0x7f0000000580)=""/174, 0xff56) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, 0x0, 0x40c1) 2.73693683s ago: executing program 1 (id=802): r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_int(r0, 0x0, 0x31, &(0x7f0000000000)=0x6, 0x4) socket$packet(0x11, 0x2, 0x300) syz_genetlink_get_family_id$SEG6(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2}, 0x10) sendmsg$tipc(r4, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x10) 2.684249104s ago: executing program 3 (id=803): gettid() openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x801, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8000000, 0x3, 0x2e4, 0x10c, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x21c, 0xffffffff, 0xffffffff, 0x21c, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private1, [0xff000000, 0xffffff00, 0x6dc8f3d6512d1aed, 0xffffffff], [0xff, 0xff000000, 0xff000000], 'veth0\x00', 'batadv0\x00', {}, {}, 0x84, 0x2, 0x3, 0xe}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x17}, @mcast1, [0x0, 0x0, 0x0, 0xff000000], [], 'veth1\x00', 'wlan1\x00'}, 0x0, 0xa4, 0x110}, @common=@unspec=@NFLOG={0x6c, 'NFLOG\x00', 0x0, {0x7fffffff, 0x9, 0xb3, 0x1, 0x0, "86d6b549c4bf723e1f33da7c11e5cee0b1adedc05fbfc6af15c3f8b75adf8819ec9d8cd0614114f5f1d3b7ba1d33f3750c2e3b8acf37107767e107dac4688212"}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x340) socket(0x2b, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000000c0)="6880a642beaf34317f0dd3122a90ad0d2b", 0x11}], 0x1}, 0x0) r2 = socket$kcm(0x10, 0x2, 0x4) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) sendmsg$inet(r2, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb97}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600) 2.675624504s ago: executing program 0 (id=804): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.731872099s ago: executing program 0 (id=805): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x63, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x4, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) writev(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x18) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x8, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x0, 0x1008}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_AGEING_TIME={0x8, 0x4, 0x9}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x34041043}, 0x20000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.700644471s ago: executing program 3 (id=806): r0 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) close(0x4) 1.620934395s ago: executing program 3 (id=807): socket$kcm(0x2b, 0x1, 0x0) socket$kcm(0x10, 0x2, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000140)={0x5, "2a1850a260a5545907acb5e083c9edcd03fbec80854ed2281ad1d75fc1362a42"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, 0x0) pipe2$watch_queue(&(0x7f0000001100), 0x80) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) bind$netrom(r3, 0x0, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000240), 0xc, 0x101301) ioctl$USBDEVFS_IOCTL(r5, 0xc0105500, &(0x7f0000000040)=@usbdevfs_connect={0x6a0}) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r7, 0x4048aecb, &(0x7f0000000180)={0x4, 0x0, [{0x0, 0x0, 0x0, 0x2, 0x0, 0x800}, {0x0, 0x6}, {0x5e2796afef1a2f31, 0xffffffff, 0x0, 0x9, 0x1, 0x80000001, 0x8}, {0x80000001, 0xffffffff, 0x7, 0x8, 0x5, 0x110, 0x3}]}) r8 = syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r8, 0xc0405602, &(0x7f0000000040)={0x0, 0x1, 0x0, "11010000001400000100b64c0000005c4b7c1500", 0x20303159}) listen(r3, 0x80) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000600)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_9p2000}]}}) 144.617091ms ago: executing program 4 (id=808): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x1fd, 0x0, 0xdddd1000, 0x1000, &(0x7f0000394000/0x1000)=nil}) userfaultfd(0x80001) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000001340)) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = openat$ttyS3(0xffffff9c, &(0x7f00000001c0), 0x800, 0x0) ioctl$TIOCSWINSZ(r2, 0x5414, 0x0) write$dsp(r1, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f3", 0xf) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) openat$sysfs(0xffffff9c, 0x0, 0x482000, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r3, 0xffffffffffffffff, 0x0) setrlimit(0xb, &(0x7f0000000140)={0x8, 0xa}) setsockopt$MRT_ADD_MFC(0xffffffffffffffff, 0x0, 0xcc, &(0x7f0000000180)={@private=0xa010102, @multicast2, 0x0, "941621a61c5815f4678d8fd403f2f30229a88d74d71fd55708016d20fd419884", 0x0, 0x1}, 0x3c) 0s ago: executing program 2 (id=809): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96d", 0xe}], 0x1}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.118' (ED25519) to the list of known hosts. [ 62.682309][ T4171] cgroup: Unknown subsys name 'net' [ 62.785916][ T4171] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 64.079968][ T4171] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 65.845076][ T4193] chnl_net:caif_netlink_parms(): no params data found [ 65.889091][ T4188] chnl_net:caif_netlink_parms(): no params data found [ 65.917151][ T4184] chnl_net:caif_netlink_parms(): no params data found [ 65.977928][ T4192] chnl_net:caif_netlink_parms(): no params data found [ 66.013073][ T4195] chnl_net:caif_netlink_parms(): no params data found [ 66.059514][ T4188] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.067388][ T4188] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.075384][ T4188] device bridge_slave_0 entered promiscuous mode [ 66.097407][ T4193] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.104489][ T4193] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.112623][ T4193] device bridge_slave_0 entered promiscuous mode [ 66.125397][ T4193] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.132744][ T4193] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.140497][ T4193] device bridge_slave_1 entered promiscuous mode [ 66.148713][ T4188] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.155789][ T4188] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.163623][ T4188] device bridge_slave_1 entered promiscuous mode [ 66.212992][ T4184] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.220722][ T4184] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.228568][ T4184] device bridge_slave_0 entered promiscuous mode [ 66.240203][ T4192] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.247464][ T4192] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.255137][ T4192] device bridge_slave_0 entered promiscuous mode [ 66.270710][ T4188] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.283052][ T4188] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.292858][ T4184] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.300578][ T4184] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.308412][ T4184] device bridge_slave_1 entered promiscuous mode [ 66.319901][ T4192] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.326970][ T4192] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.334946][ T4192] device bridge_slave_1 entered promiscuous mode [ 66.344327][ T4193] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.355920][ T4193] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.405348][ T4188] team0: Port device team_slave_0 added [ 66.420435][ T4184] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.443345][ T4192] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.455083][ T4193] team0: Port device team_slave_0 added [ 66.462537][ T4188] team0: Port device team_slave_1 added [ 66.469817][ T4184] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.486875][ T4192] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.498270][ T4193] team0: Port device team_slave_1 added [ 66.533741][ T4195] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.540941][ T4195] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.549267][ T4195] device bridge_slave_0 entered promiscuous mode [ 66.563382][ T4188] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.570527][ T4188] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.596856][ T4188] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.617185][ T4188] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.624307][ T4188] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.650572][ T4188] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.664068][ T4192] team0: Port device team_slave_0 added [ 66.670264][ T4195] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.677436][ T4195] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.685173][ T4195] device bridge_slave_1 entered promiscuous mode [ 66.700716][ T4184] team0: Port device team_slave_0 added [ 66.706951][ T4193] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.714301][ T4193] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.740369][ T4193] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.756339][ T4192] team0: Port device team_slave_1 added [ 66.769816][ T4184] team0: Port device team_slave_1 added [ 66.782641][ T4193] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.789916][ T4193] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.815970][ T4193] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.855191][ T4195] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.876472][ T4192] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.883697][ T4192] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.910018][ T4192] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.928102][ T4195] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.965668][ T4193] device hsr_slave_0 entered promiscuous mode [ 66.972599][ T4193] device hsr_slave_1 entered promiscuous mode [ 66.980481][ T4192] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.987668][ T4192] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.013874][ T4192] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.025540][ T4184] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.032919][ T4184] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.059171][ T4184] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.076773][ T4184] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.083789][ T4184] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.109695][ T4184] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.124636][ T4188] device hsr_slave_0 entered promiscuous mode [ 67.131611][ T4188] device hsr_slave_1 entered promiscuous mode [ 67.139420][ T4188] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.147184][ T4188] Cannot create hsr debugfs directory [ 67.159072][ T4195] team0: Port device team_slave_0 added [ 67.177312][ T4195] team0: Port device team_slave_1 added [ 67.264450][ T4192] device hsr_slave_0 entered promiscuous mode [ 67.271244][ T4192] device hsr_slave_1 entered promiscuous mode [ 67.277893][ T4192] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.285594][ T4192] Cannot create hsr debugfs directory [ 67.291988][ T4195] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.298970][ T4195] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.326129][ T4195] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.341338][ T4184] device hsr_slave_0 entered promiscuous mode [ 67.348500][ T4184] device hsr_slave_1 entered promiscuous mode [ 67.355150][ T4184] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.362751][ T4184] Cannot create hsr debugfs directory [ 67.387777][ T4195] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.394744][ T4195] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.420776][ T4195] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.538281][ T1108] Bluetooth: hci1: command 0x0409 tx timeout [ 67.546808][ T4195] device hsr_slave_0 entered promiscuous mode [ 67.553110][ T1326] Bluetooth: hci0: command 0x0409 tx timeout [ 67.559494][ T4195] device hsr_slave_1 entered promiscuous mode [ 67.566058][ T4195] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.574140][ T4195] Cannot create hsr debugfs directory [ 67.617914][ T1108] Bluetooth: hci3: command 0x0409 tx timeout [ 67.622392][ T1110] Bluetooth: hci4: command 0x0409 tx timeout [ 67.630190][ T1110] Bluetooth: hci2: command 0x0409 tx timeout [ 67.763205][ T4193] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 67.774879][ T4193] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 67.785365][ T4193] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 67.795335][ T4193] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 67.872545][ T4188] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 67.884205][ T4188] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 67.893250][ T4188] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 67.907924][ T4188] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 67.950728][ T4184] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 67.963533][ T4184] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 67.988120][ T4184] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 67.998388][ T4184] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.020333][ T4193] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.059417][ T4195] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 68.084405][ T4193] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.093633][ T4195] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 68.103445][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 68.112975][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 68.138793][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 68.148257][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 68.157300][ T157] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.164537][ T157] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.173704][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 68.183053][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 68.192044][ T157] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.199137][ T157] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.208480][ T4195] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 68.218445][ T4195] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 68.235507][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 68.246566][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 68.281757][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 68.299508][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 68.309572][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 68.319158][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 68.334006][ T4192] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 68.346903][ T4192] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 68.357604][ T4192] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 68.367935][ T4192] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 68.378897][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 68.389277][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 68.413117][ T4188] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.430437][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 68.441547][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 68.464491][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 68.476224][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 68.491975][ T4188] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.503708][ T4193] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 68.515350][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 68.524309][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 68.551531][ T4184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.558809][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 68.569527][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 68.578616][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.585788][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.620279][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 68.628724][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 68.639855][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 68.649207][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.656251][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.664784][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 68.676242][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 68.686032][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 68.695028][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 68.703435][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 68.712268][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 68.722154][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 68.730683][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 68.765240][ T4188] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 68.777127][ T4188] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 68.792875][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 68.802204][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 68.811061][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 68.820743][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 68.829422][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 68.840179][ T4195] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.852518][ T4184] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.894636][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 68.904977][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 68.936136][ T4193] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.949368][ T4192] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.958183][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 68.965716][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 68.980713][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 68.994351][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 69.004314][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.011413][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.020545][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 69.031081][ T4195] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.052921][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 69.063107][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 69.073503][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.080618][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.089962][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 69.098722][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 69.107026][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.114103][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.121992][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 69.131145][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 69.139886][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.146936][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.154640][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 69.164810][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 69.192066][ T4188] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.214785][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 69.223391][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 69.234291][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 69.243201][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 69.252187][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 69.261852][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 69.269571][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 69.277081][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 69.285985][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 69.294653][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 69.303891][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 69.312786][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 69.321858][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 69.330749][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 69.339616][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 69.348653][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 69.361757][ T4184] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 69.373602][ T4184] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 69.395837][ T4192] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.403538][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 69.414393][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 69.423198][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 69.433035][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 69.443133][ T1230] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 69.453686][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 69.463172][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 69.495180][ T4195] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 69.506511][ T4195] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 69.538368][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 69.547072][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 69.557935][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.565011][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.573033][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 69.582747][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 69.591774][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 69.602427][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 69.611109][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 69.619888][ T4230] Bluetooth: hci0: command 0x041b tx timeout [ 69.620422][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 69.626042][ T4230] Bluetooth: hci1: command 0x041b tx timeout [ 69.640521][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.647633][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.657591][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 69.666000][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 69.675015][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 69.683574][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 69.692206][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 69.697830][ T4230] Bluetooth: hci2: command 0x041b tx timeout [ 69.701268][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 69.705869][ T4230] Bluetooth: hci4: command 0x041b tx timeout [ 69.713478][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 69.724714][ T4230] Bluetooth: hci3: command 0x041b tx timeout [ 69.727419][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 69.743653][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 69.768752][ T4193] device veth0_vlan entered promiscuous mode [ 69.794089][ T4188] device veth0_vlan entered promiscuous mode [ 69.807994][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 69.816921][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 69.833989][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 69.850787][ T4193] device veth1_vlan entered promiscuous mode [ 69.869439][ T4188] device veth1_vlan entered promiscuous mode [ 69.879692][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 69.892732][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 69.901669][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 69.916662][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 69.924908][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 69.933852][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 69.942804][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 69.953582][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 69.991824][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 70.002960][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 70.011805][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 70.021113][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 70.029814][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 70.038225][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 70.045612][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 70.053364][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 70.062148][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 70.076152][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 70.085152][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 70.101325][ T4195] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.120120][ T4192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 70.130487][ T4193] device veth0_macvtap entered promiscuous mode [ 70.139140][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 70.148265][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 70.155732][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 70.174195][ T4184] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.221231][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 70.231034][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 70.240455][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 70.249819][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 70.262979][ T4193] device veth1_macvtap entered promiscuous mode [ 70.279273][ T4188] device veth0_macvtap entered promiscuous mode [ 70.313632][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 70.324217][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 70.334796][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 70.344850][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 70.354262][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 70.363338][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 70.373089][ T4188] device veth1_macvtap entered promiscuous mode [ 70.383492][ T4195] device veth0_vlan entered promiscuous mode [ 70.398203][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 70.406430][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 70.415133][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 70.425573][ T4193] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.444426][ T4193] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.455941][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 70.465029][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 70.474773][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 70.484572][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 70.495964][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.506943][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.518882][ T4188] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.530330][ T4195] device veth1_vlan entered promiscuous mode [ 70.555013][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 70.563667][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 70.572144][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 70.584062][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 70.593008][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 70.601005][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 70.610584][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.621987][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.633368][ T4188] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.646112][ T4192] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.655316][ T4193] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.669917][ T4193] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.679104][ T4193] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.688481][ T4193] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.719950][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 70.729685][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 70.739732][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 70.748929][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 70.760101][ T4188] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.769061][ T4188] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.778164][ T4188] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.786867][ T4188] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.804355][ T4184] device veth0_vlan entered promiscuous mode [ 70.816306][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 70.827376][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 70.836699][ T4195] device veth0_macvtap entered promiscuous mode [ 70.875813][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 70.884267][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 70.892659][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 70.906564][ T4195] device veth1_macvtap entered promiscuous mode [ 70.944367][ T4184] device veth1_vlan entered promiscuous mode [ 70.985783][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.009177][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.019463][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.030029][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.041585][ T4195] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.056104][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 71.065862][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 71.074393][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 71.083512][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 71.103432][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.115303][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.125422][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.136183][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.149133][ T4195] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.178826][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 71.190061][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 71.202633][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 71.212311][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.224472][ T4195] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.235565][ T4195] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.244566][ T4195] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.253550][ T4195] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.292927][ T4192] device veth0_vlan entered promiscuous mode [ 71.311049][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 71.319550][ T1230] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.327811][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.332452][ T4184] device veth0_macvtap entered promiscuous mode [ 71.341237][ T1230] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.352105][ T4184] device veth1_macvtap entered promiscuous mode [ 71.376565][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.386300][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.394750][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 71.403420][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 71.412270][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 71.422447][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 71.433012][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 71.451905][ T4192] device veth1_vlan entered promiscuous mode [ 71.466401][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.481418][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.501241][ T4287] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.519389][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 71.528562][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 71.531881][ T4287] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.543786][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.554619][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.565776][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.576619][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.587753][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.599619][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.610806][ T4184] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.635045][ T4287] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 71.647739][ T4287] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 71.655493][ T4287] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 71.664723][ T4287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 71.687134][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.698244][ T23] Bluetooth: hci1: command 0x040f tx timeout [ 71.699090][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.704375][ T23] Bluetooth: hci0: command 0x040f tx timeout [ 71.720863][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.731588][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.742277][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.752982][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.765357][ T4184] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.778036][ T23] Bluetooth: hci3: command 0x040f tx timeout [ 71.795078][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 71.804433][ T23] Bluetooth: hci4: command 0x040f tx timeout [ 71.812039][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 71.820768][ T23] Bluetooth: hci2: command 0x040f tx timeout [ 71.826151][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.845089][ T4184] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.862904][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.864428][ T4184] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.879298][ T4184] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.888176][ T4184] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.898933][ T4287] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 71.907075][ T4287] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 71.916135][ T4287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 71.928412][ T4192] device veth0_macvtap entered promiscuous mode [ 71.940677][ T4192] device veth1_macvtap entered promiscuous mode [ 71.962207][ T4287] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.006001][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.026302][ T4287] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.034547][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.046352][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.052461][ T4289] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 72.061668][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.090733][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.106003][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.118270][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.133465][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.161578][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.207011][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.207792][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 72.220994][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.236866][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 72.248929][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.256976][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 72.266540][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.276564][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 72.288650][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.301415][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.328119][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.350025][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.361173][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.371973][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.384252][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.395686][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.453944][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.487321][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 72.577690][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 72.588123][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 72.597276][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 72.606382][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 72.615600][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 72.624754][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 72.633903][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 72.643002][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 72.652098][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 74.153757][ T1108] Bluetooth: hci0: command 0x0419 tx timeout [ 74.164889][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 74.181533][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 74.198514][ T1108] Bluetooth: hci1: command 0x0419 tx timeout [ 74.204747][ T1108] Bluetooth: hci2: command 0x0419 tx timeout [ 74.213702][ T1108] Bluetooth: hci4: command 0x0419 tx timeout [ 74.216298][ T4192] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.247454][ T1108] Bluetooth: hci3: command 0x0419 tx timeout [ 74.257489][ T4192] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.276548][ T4192] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.900218][ T4192] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.141027][ T1433] ieee802154 phy0 wpan0: encryption failed: -22 [ 75.147626][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 75.345973][ T157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.378441][ T157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.444150][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 75.447698][ T4287] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.466095][ T4287] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.517775][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 75.668508][ T4287] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.722485][ T4287] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.934094][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 76.949152][ T4315] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9'. [ 77.048298][ T4315] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9'. [ 77.088757][ T157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.112624][ T4330] device syzkaller0 entered promiscuous mode [ 77.138351][ T157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.164147][ T4299] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 78.835223][ T4346] sctp: failed to load transform for md5: -2 [ 80.427412][ T26] audit: type=1326 audit(1769533676.040:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4369 comm="syz.0.15" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3be665eeb9 code=0x7ffc0000 [ 80.882555][ T26] audit: type=1326 audit(1769533676.040:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4369 comm="syz.0.15" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3be665eeb9 code=0x7ffc0000 [ 80.980989][ T4376] ======================================================= [ 80.980989][ T4376] WARNING: The mand mount option has been deprecated and [ 80.980989][ T4376] and is ignored by this kernel. Remove the mand [ 80.980989][ T4376] option from the mount to silence this warning. [ 80.980989][ T4376] ======================================================= [ 81.015985][ C1] vkms_vblank_simulate: vblank timer overrun [ 81.074898][ T4376] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 81.985050][ T26] audit: type=1326 audit(1769533676.050:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4369 comm="syz.0.15" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f3be6658cd7 code=0x7ffc0000 [ 82.016526][ T26] audit: type=1326 audit(1769533676.050:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4369 comm="syz.0.15" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f3be66002d9 code=0x7ffc0000 [ 82.107268][ T26] audit: type=1326 audit(1769533676.050:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4369 comm="syz.0.15" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3be665eeb9 code=0x7ffc0000 [ 83.103105][ T26] audit: type=1326 audit(1769533676.060:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4369 comm="syz.0.15" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f3be6658cd7 code=0x7ffc0000 [ 83.129296][ T26] audit: type=1326 audit(1769533676.060:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4369 comm="syz.0.15" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f3be66002d9 code=0x7ffc0000 [ 83.155752][ T26] audit: type=1326 audit(1769533676.060:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4369 comm="syz.0.15" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3be665eeb9 code=0x7ffc0000 [ 83.180877][ T26] audit: type=1326 audit(1769533676.070:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4369 comm="syz.0.15" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f3be6658cd7 code=0x7ffc0000 [ 83.207431][ T26] audit: type=1326 audit(1769533676.070:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4369 comm="syz.0.15" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f3be66002d9 code=0x7ffc0000 [ 83.394247][ T4392] 9pnet_virtio: no channels available for device syz [ 85.004371][ T4402] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 85.011798][ T4402] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 85.036118][ T4402] vhci_hcd vhci_hcd.0: Device attached [ 85.237883][ T1326] vhci_hcd: vhci_device speed not set [ 85.319213][ T1326] usb 41-1: new full-speed USB device number 2 using vhci_hcd [ 85.554833][ T4397] binder: Binderfs stats mode cannot be changed during a remount [ 85.585924][ T4409] vhci_hcd: connection reset by peer [ 85.604418][ T157] vhci_hcd: stop threads [ 85.612470][ T157] vhci_hcd: release socket [ 85.723610][ T157] vhci_hcd: disconnect device [ 85.730689][ T1108] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 85.815170][ T4431] process 'syz.2.31' launched './file2' with NULL argv: empty string added [ 86.677779][ T4261] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 86.750937][ T1108] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 86.757394][ T1110] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 86.776783][ T1108] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 86.795768][ T1108] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 86.967398][ T4261] usb 3-1: Using ep0 maxpacket: 8 [ 87.787341][ T1110] usb 2-1: Using ep0 maxpacket: 8 [ 87.847829][ T4261] usb 3-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 89.228265][ T1108] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 89.298558][ T4261] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 89.399139][ T1108] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.418678][ T1110] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 89.449506][ T1110] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 89.456271][ T4261] usb 3-1: Product: syz [ 89.471100][ T1110] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 89.473634][ T4261] usb 3-1: Manufacturer: syz [ 89.482987][ T1110] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 89.502245][ T1110] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 89.512467][ T1110] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.526125][ T1108] usb 1-1: config 0 descriptor?? [ 89.538953][ T1110] usb 2-1: can't set config #16, error -71 [ 89.555663][ T1110] usb 2-1: USB disconnect, device number 2 [ 89.576953][ T4261] usb 3-1: SerialNumber: syz [ 89.587628][ T1108] usb 1-1: can't set config #0, error -71 [ 89.818900][ T1108] usb 1-1: USB disconnect, device number 2 [ 89.848775][ T4261] usb 3-1: config 0 descriptor?? [ 89.856995][ T4452] 9pnet_virtio: no channels available for device syz [ 89.879035][ T4261] usb 3-1: can't set config #0, error -71 [ 89.903975][ T4261] usb 3-1: USB disconnect, device number 2 [ 90.186848][ T4456] netlink: 4 bytes leftover after parsing attributes in process `syz.3.41'. [ 90.306914][ T4456] device hsr_slave_1 left promiscuous mode [ 90.350423][ T4458] tipc: Enabling of bearer rejected, failed to enable media [ 90.500980][ T13] cfg80211: failed to load regulatory.db [ 90.508240][ T1326] vhci_hcd: vhci_device speed not set [ 91.379697][ T4471] sched: RT throttling activated [ 93.437355][ T4308] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 93.897319][ T4308] usb 1-1: Using ep0 maxpacket: 8 [ 94.183673][ T4308] usb 1-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 94.216529][ T4308] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 94.226206][ T4308] usb 1-1: Product: syz [ 94.231128][ T4308] usb 1-1: Manufacturer: syz [ 94.236182][ T4308] usb 1-1: SerialNumber: syz [ 94.246038][ T4308] usb 1-1: config 0 descriptor?? [ 95.296834][ T4514] 9pnet_virtio: no channels available for device syz [ 95.867578][ T4308] usb 1-1: USB disconnect, device number 3 [ 96.230934][ T4178] udevd[4178]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 98.398609][ T4542] netlink: 4 bytes leftover after parsing attributes in process `syz.0.62'. [ 98.724524][ T4542] device hsr_slave_1 left promiscuous mode [ 98.757385][ T4551] netlink: 4 bytes leftover after parsing attributes in process `syz.3.63'. [ 98.953767][ T4554] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 99.096796][ T4554] pit: kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 100.429089][ T4582] 9pnet_virtio: no channels available for device syz [ 103.727512][ T4453] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 104.317359][ T4453] usb 2-1: Using ep0 maxpacket: 8 [ 105.257967][ T4453] usb 2-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 105.315921][ T4453] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 105.326171][ T4453] usb 2-1: Product: syz [ 105.346583][ T4453] usb 2-1: Manufacturer: syz [ 105.366983][ T4453] usb 2-1: SerialNumber: syz [ 105.625147][ T4453] usb 2-1: config 0 descriptor?? [ 107.727529][ T4453] usb 2-1: USB disconnect, device number 3 [ 109.243999][ T4657] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 110.446709][ T4708] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 110.638876][ T4708] pit: kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 111.033005][ T4292] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 111.377458][ T4292] usb 3-1: Using ep0 maxpacket: 8 [ 111.434339][ T4725] Zero length message leads to an empty skb [ 111.667984][ T4292] usb 3-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 111.720830][ T4292] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 111.812529][ T4292] usb 3-1: Product: syz [ 111.862612][ T4292] usb 3-1: Manufacturer: syz [ 111.918115][ T4292] usb 3-1: SerialNumber: syz [ 112.070879][ T4292] usb 3-1: config 0 descriptor?? [ 112.528475][ T4739] 9pnet_virtio: no channels available for device syz [ 113.026636][ T4743] device syzkaller0 entered promiscuous mode [ 115.387638][ T4292] usb 3-1: USB disconnect, device number 3 [ 115.572637][ T4766] IPVS: length: 528 != 8 [ 115.585545][ T4766] 9pnet_virtio: no channels available for device syz [ 116.638842][ T4178] udevd[4178]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 116.877119][ T4780] device syzkaller0 entered promiscuous mode [ 116.999964][ T4786] 9pnet_virtio: no channels available for device syz [ 117.452515][ T4791] device syzkaller0 entered promiscuous mode [ 120.249389][ T4817] 9pnet_virtio: no channels available for device syz [ 120.563939][ T4822] capability: warning: `syz.0.137' uses deprecated v2 capabilities in a way that may be insecure [ 120.780632][ T4828] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 120.997452][ T4840] loop4: detected capacity change from 0 to 128 [ 124.860504][ T4856] qnx6: unable to read the first superblock [ 125.201911][ T4185] Bluetooth: Wrong link type (-22) [ 126.007527][ T4885] 9pnet_virtio: no channels available for device syz [ 132.622974][ T4185] Bluetooth: Wrong link type (-22) [ 135.380720][ T4953] netlink: 4 bytes leftover after parsing attributes in process `syz.3.174'. [ 136.580710][ T1433] ieee802154 phy0 wpan0: encryption failed: -22 [ 136.587764][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 140.590969][ T5001] netlink: 4 bytes leftover after parsing attributes in process `syz.2.188'. [ 141.650066][ T5010] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 141.678231][ T5010] pit: kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 141.703897][ T5001] device hsr_slave_1 left promiscuous mode [ 141.727459][ T5010] pit: kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 141.770466][ T5010] pit: kvm: requested 53638 ns i8254 timer period limited to 200000 ns [ 142.564690][ T4185] Bluetooth: Wrong link type (-22) [ 144.430410][ T5045] binder: 5043:5045 ioctl 0 200000000040 returned -22 [ 145.698304][ T5078] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 145.781700][ T5070] pit: kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 145.809885][ T5070] pit: kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 145.916502][ T5082] netlink: 4 bytes leftover after parsing attributes in process `syz.3.208'. [ 146.463026][ T5089] IPVS: length: 528 != 8 [ 146.471691][ T5089] 9pnet_virtio: no channels available for device syz [ 150.511698][ T5112] binder: 5108:5112 ioctl 0 200000000040 returned -22 [ 150.528226][ T4185] Bluetooth: Wrong link type (-22) [ 150.760727][ T5132] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 152.130350][ T5146] IPVS: length: 528 != 8 [ 152.141804][ T5146] 9pnet_virtio: no channels available for device syz [ 156.111066][ T5205] IPVS: length: 528 != 8 [ 156.118738][ T5205] 9pnet_virtio: no channels available for device syz [ 157.265066][ T5220] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 159.019106][ T4185] Bluetooth: Wrong link type (-22) [ 160.051868][ T5244] device syzkaller0 entered promiscuous mode [ 160.189329][ T5249] IPVS: length: 528 != 8 [ 160.198646][ T5249] 9pnet_virtio: no channels available for device syz [ 162.309084][ T5251] binder: 5250:5251 ioctl 0 200000000040 returned -22 [ 164.484143][ T5286] device syzkaller0 entered promiscuous mode [ 164.509129][ T5293] IPVS: length: 528 != 8 [ 164.581325][ T5295] 9pnet_virtio: no channels available for device syz [ 164.677163][ T5293] 9pnet_virtio: no channels available for device syz [ 165.396811][ T4185] Bluetooth: Wrong link type (-22) [ 165.403050][ T4185] Bluetooth: hci3: link tx timeout [ 165.408934][ T4185] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 167.529941][ T4453] Bluetooth: hci3: command 0x0406 tx timeout [ 167.601130][ T5314] binder: 5313:5314 ioctl 0 200000000040 returned -22 [ 168.042380][ T5335] device syzkaller0 entered promiscuous mode [ 168.075073][ T5333] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 168.188397][ T5333] pit: kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 170.134015][ T5375] IPVS: length: 528 != 8 [ 170.149480][ T5375] 9pnet_virtio: no channels available for device syz [ 170.817173][ T5377] binder: 5376:5377 ioctl 0 200000000040 returned -22 [ 172.343465][ T5405] netlink: 8 bytes leftover after parsing attributes in process `syz.4.303'. [ 172.416118][ T5405] netlink: 8 bytes leftover after parsing attributes in process `syz.4.303'. [ 172.434247][ T5405] netlink: 8 bytes leftover after parsing attributes in process `syz.4.303'. [ 172.451159][ T5405] netlink: 8 bytes leftover after parsing attributes in process `syz.4.303'. [ 172.465631][ T5405] netlink: 8 bytes leftover after parsing attributes in process `syz.4.303'. [ 172.554082][ T5414] netlink: 4 bytes leftover after parsing attributes in process `syz.3.306'. [ 173.239804][ T4185] Bluetooth: Wrong link type (-22) [ 173.284125][ T5428] IPVS: length: 528 != 8 [ 173.293886][ T5428] 9pnet_virtio: no channels available for device syz [ 176.334625][ T4453] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 176.334698][ T4453] Bluetooth: hci2: Injecting HCI hardware error event [ 176.336279][ T4191] Bluetooth: hci2: hardware error 0x00 [ 176.618695][ T5452] binder: 5445:5452 ioctl 0 200000000040 returned -22 [ 180.384108][ T5466] netlink: 8 bytes leftover after parsing attributes in process `syz.2.320'. [ 180.477563][ T5466] netlink: 8 bytes leftover after parsing attributes in process `syz.2.320'. [ 180.488322][ T5466] netlink: 8 bytes leftover after parsing attributes in process `syz.2.320'. [ 180.498906][ T5466] netlink: 8 bytes leftover after parsing attributes in process `syz.2.320'. [ 180.510169][ T5466] netlink: 8 bytes leftover after parsing attributes in process `syz.2.320'. [ 181.555223][ T5483] IPVS: length: 528 != 8 [ 181.562715][ T5483] 9pnet_virtio: no channels available for device syz [ 181.747508][ T4223] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 181.997497][ T4223] usb 5-1: Using ep0 maxpacket: 8 [ 182.277674][ T4223] usb 5-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 182.343709][ T4223] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 182.354414][ T4223] usb 5-1: Product: syz [ 182.359350][ T4223] usb 5-1: Manufacturer: syz [ 182.364472][ T4223] usb 5-1: SerialNumber: syz [ 182.491669][ T4223] usb 5-1: config 0 descriptor?? [ 183.997605][ T4223] usb 5-1: USB disconnect, device number 2 [ 184.253549][ T5522] netlink: 4 bytes leftover after parsing attributes in process `syz.3.337'. [ 184.339029][ T1108] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 184.618906][ T1108] Bluetooth: hci3: Injecting HCI hardware error event [ 184.715418][ T4185] Bluetooth: hci3: hardware error 0x00 [ 184.885518][ T5538] IPVS: length: 528 != 8 [ 184.930800][ T5538] 9pnet_virtio: no channels available for device syz [ 185.161776][ T5543] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 186.634771][ T5559] device syzkaller0 entered promiscuous mode [ 186.747379][ T1110] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 187.227500][ T1110] usb 5-1: Using ep0 maxpacket: 8 [ 187.527953][ T1110] usb 5-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 188.140727][ T5576] netlink: 4 bytes leftover after parsing attributes in process `syz.1.353'. [ 188.150827][ T1110] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 188.232484][ T1110] usb 5-1: Product: syz [ 188.237964][ T1110] usb 5-1: Manufacturer: syz [ 188.243136][ T1110] usb 5-1: SerialNumber: syz [ 188.250309][ T1110] usb 5-1: config 0 descriptor?? [ 189.260610][ T5576] device hsr_slave_1 left promiscuous mode [ 189.378133][ T4191] Bluetooth: Wrong link type (-22) [ 189.384528][ T4191] Bluetooth: hci4: link tx timeout [ 189.390555][ T4191] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 189.662733][ T1110] usb 5-1: USB disconnect, device number 3 [ 189.751212][ T4178] udevd[4178]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: Permission denied [ 189.860804][ T1108] Bluetooth: hci1: command 0x0406 tx timeout [ 189.861975][ T4292] Bluetooth: hci4: command 0x0406 tx timeout [ 190.261080][ T5613] netlink: 8 bytes leftover after parsing attributes in process `syz.4.364'. [ 190.545502][ T5619] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 192.723394][ T4191] Bluetooth: Wrong link type (-22) [ 192.731297][ T4191] Bluetooth: hci4: link tx timeout [ 192.737006][ T4191] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 194.254739][ T5690] netlink: 8 bytes leftover after parsing attributes in process `syz.4.383'. [ 194.301386][ T5690] netlink: 8 bytes leftover after parsing attributes in process `syz.4.383'. [ 194.315871][ T5690] netlink: 8 bytes leftover after parsing attributes in process `syz.4.383'. [ 194.327660][ T5690] netlink: 8 bytes leftover after parsing attributes in process `syz.4.383'. [ 194.339397][ T5690] netlink: 8 bytes leftover after parsing attributes in process `syz.4.383'. [ 197.669653][ T5759] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 197.689922][ T5759] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 197.716760][ T5759] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 197.732581][ T5759] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 197.800234][ T5759] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 198.026878][ T1433] ieee802154 phy0 wpan0: encryption failed: -22 [ 198.026958][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 201.617420][ T4308] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 201.632999][ T4308] Bluetooth: hci1: Injecting HCI hardware error event [ 201.654744][ T4191] Bluetooth: hci1: hardware error 0x00 [ 201.775792][ T5799] IPVS: length: 528 != 8 [ 201.963783][ T5802] 9pnet_virtio: no channels available for device syz [ 203.512289][ T5830] 9pnet_virtio: no channels available for device syz [ 206.292769][ T5852] netlink: 8 bytes leftover after parsing attributes in process `syz.3.429'. [ 206.334262][ T5852] netlink: 8 bytes leftover after parsing attributes in process `syz.3.429'. [ 206.361418][ T5852] netlink: 8 bytes leftover after parsing attributes in process `syz.3.429'. [ 206.373809][ T5852] netlink: 8 bytes leftover after parsing attributes in process `syz.3.429'. [ 206.384043][ T5852] netlink: 8 bytes leftover after parsing attributes in process `syz.3.429'. [ 206.523981][ T5853] IPVS: length: 528 != 8 [ 206.545821][ T5853] 9pnet_virtio: no channels available for device syz [ 209.899133][ T5877] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 210.189962][ T1108] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 210.275940][ T5893] 9pnet_virtio: no channels available for device syz [ 210.668019][ T1108] Bluetooth: hci4: Injecting HCI hardware error event [ 210.676977][ T146] Bluetooth: hci4: hardware error 0x00 [ 211.121607][ T5902] netlink: 4 bytes leftover after parsing attributes in process `syz.4.442'. [ 211.455886][ T5902] device hsr_slave_1 left promiscuous mode [ 212.495117][ T5898] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 212.972433][ T5918] IPVS: length: 528 != 8 [ 213.019257][ T5918] 9pnet_virtio: no channels available for device syz [ 215.001054][ T5943] netlink: 8 bytes leftover after parsing attributes in process `syz.4.455'. [ 218.677958][ T5980] IPVS: length: 528 != 8 [ 218.683505][ T5980] 9pnet_virtio: no channels available for device syz [ 220.004222][ T5992] netlink: 24 bytes leftover after parsing attributes in process `syz.2.471'. [ 220.048470][ T5992] netlink: 24 bytes leftover after parsing attributes in process `syz.2.471'. [ 220.113386][ T6004] 9pnet_virtio: no channels available for device syz [ 220.398956][ T5992] device syzkaller0 entered promiscuous mode [ 220.582911][ T6000] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 220.766090][ T6008] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 220.805376][ T6008] pit: kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 222.661891][ T6031] IPVS: length: 528 != 8 [ 224.002889][ T6030] 9pnet_virtio: no channels available for device syz [ 226.236982][ T6034] device syzkaller0 entered promiscuous mode [ 227.371231][ T6054] 9pnet_virtio: no channels available for device syz [ 231.055814][ T6063] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 231.225746][ T6104] 9pnet_virtio: no channels available for device syz [ 231.775847][ T6110] IPVS: length: 528 != 8 [ 231.785587][ T6110] 9pnet_virtio: no channels available for device syz [ 232.934518][ T6113] qnx6: unable to read the first superblock [ 234.907676][ T1108] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 235.217382][ T1108] usb 3-1: Using ep0 maxpacket: 8 [ 235.368946][ T6143] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 235.392274][ T6143] pit: kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 235.425717][ T6143] pit: kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 235.463677][ T6150] IPVS: length: 528 != 8 [ 235.474730][ T6150] 9pnet_virtio: no channels available for device syz [ 235.547553][ T1108] usb 3-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 235.557469][ T6143] pit: kvm: requested 53638 ns i8254 timer period limited to 200000 ns [ 235.557543][ T6143] pit: kvm: requested 41904 ns i8254 timer period limited to 200000 ns [ 235.557918][ T6143] pit: kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 236.257445][ T1108] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 236.266539][ T1108] usb 3-1: Product: syz [ 236.271202][ T1108] usb 3-1: Manufacturer: syz [ 236.276258][ T1108] usb 3-1: SerialNumber: syz [ 236.305021][ T1108] usb 3-1: config 0 descriptor?? [ 238.441524][ T1108] usb 3-1: USB disconnect, device number 4 [ 239.828473][ T4178] udevd[4178]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 241.836136][ T6195] device syzkaller0 entered promiscuous mode [ 242.051443][ T6203] IPVS: length: 528 != 8 [ 242.072635][ T6203] 9pnet_virtio: no channels available for device syz [ 242.387567][ T4245] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 243.077360][ T4245] usb 5-1: Using ep0 maxpacket: 8 [ 243.251907][ T6218] netlink: 24 bytes leftover after parsing attributes in process `syz.0.532'. [ 243.263100][ T6218] netlink: 24 bytes leftover after parsing attributes in process `syz.0.532'. [ 243.360277][ T4245] usb 5-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 243.384179][ T4245] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 243.416661][ T4245] usb 5-1: Product: syz [ 243.422248][ T4245] usb 5-1: Manufacturer: syz [ 243.428884][ T4245] usb 5-1: SerialNumber: syz [ 243.455024][ T4245] usb 5-1: config 0 descriptor?? [ 245.746339][ T6243] netlink: 68 bytes leftover after parsing attributes in process `syz.0.539'. [ 246.262426][ T4245] usb 5-1: USB disconnect, device number 4 [ 246.373969][ T6253] netlink: 24 bytes leftover after parsing attributes in process `syz.3.543'. [ 246.434596][ T6253] netlink: 24 bytes leftover after parsing attributes in process `syz.3.543'. [ 246.461366][ T6260] netlink: 8 bytes leftover after parsing attributes in process `syz.1.545'. [ 246.495010][ T6260] netlink: 8 bytes leftover after parsing attributes in process `syz.1.545'. [ 246.534778][ T4178] udevd[4178]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 246.554308][ T6260] netlink: 8 bytes leftover after parsing attributes in process `syz.1.545'. [ 246.615079][ T6260] netlink: 8 bytes leftover after parsing attributes in process `syz.1.545'. [ 247.449761][ T6260] netlink: 8 bytes leftover after parsing attributes in process `syz.1.545'. [ 248.147527][ T13] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 248.407398][ T13] usb 3-1: Using ep0 maxpacket: 8 [ 248.659887][ T6287] tipc: Started in network mode [ 248.665444][ T6287] tipc: Node identity dab1bcec9945, cluster identity 4711 [ 248.674738][ T6287] tipc: Enabled bearer , priority 0 [ 248.685806][ T6287] device syzkaller0 entered promiscuous mode [ 248.698361][ T13] usb 3-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 248.736237][ T13] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 248.763768][ T13] usb 3-1: Product: syz [ 248.773205][ T13] usb 3-1: Manufacturer: syz [ 248.783054][ T13] usb 3-1: SerialNumber: syz [ 248.792459][ T13] usb 3-1: config 0 descriptor?? [ 248.831040][ T6287] tipc: Resetting bearer [ 248.894736][ T6283] tipc: Resetting bearer [ 248.916741][ T6283] tipc: Disabling bearer [ 249.789023][ T6300] netlink: 24 bytes leftover after parsing attributes in process `syz.1.558'. [ 249.813416][ T6300] netlink: 24 bytes leftover after parsing attributes in process `syz.1.558'. [ 251.753639][ T13] usb 3-1: USB disconnect, device number 5 [ 252.178385][ T4178] udevd[4178]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 254.667333][ T4308] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 256.056581][ T6348] binder: 6344:6348 ioctl 4018620d 0 returned -22 [ 256.538060][ T4308] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 256.818657][ T4308] usb 4-1: Using ep0 maxpacket: 8 [ 256.937553][ T23] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 257.107627][ T4308] usb 4-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 257.146739][ T4308] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 257.223129][ T4308] usb 4-1: Product: syz [ 257.259772][ T4308] usb 4-1: Manufacturer: syz [ 257.302847][ T4308] usb 4-1: SerialNumber: syz [ 257.327513][ T23] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 257.400366][ T4308] usb 4-1: config 0 descriptor?? [ 257.409618][ T23] usb 5-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 257.539146][ T23] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 257.612639][ T23] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.187550][ T6365] binder: 6345:6365 ioctl 0 200000000040 returned -22 [ 259.460268][ T1433] ieee802154 phy0 wpan0: encryption failed: -22 [ 259.467502][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 259.862490][ T23] usb 5-1: invalid MIDI out EP 0 [ 259.878291][ T4308] usb 4-1: USB disconnect, device number 2 [ 259.916201][ T23] snd-usb-audio: probe of 5-1:27.0 failed with error -22 [ 259.935988][ T23] usb 5-1: USB disconnect, device number 5 [ 260.148050][ T4178] udevd[4178]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 260.169478][ T4498] udevd[4498]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:27.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 261.227388][ T4308] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 261.497392][ T4308] usb 4-1: Using ep0 maxpacket: 32 [ 261.617630][ T4308] usb 4-1: config index 0 descriptor too short (expected 156, got 27) [ 261.647468][ T4308] usb 4-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 261.692074][ T4308] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 261.716993][ T4308] usb 4-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 261.743039][ T4308] usb 4-1: config 0 interface 0 has no altsetting 0 [ 262.797642][ T4308] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 262.987182][ T6405] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 263.014628][ T4308] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 263.060082][ T4308] usb 4-1: Product: syz [ 263.070218][ T4308] usb 4-1: Manufacturer: syz [ 263.076149][ T4308] usb 4-1: SerialNumber: syz [ 263.202542][ T6411] netlink: 68 bytes leftover after parsing attributes in process `syz.1.587'. [ 263.453707][ T4308] usb 4-1: config 0 descriptor?? [ 263.620360][ T4308] ldusb 4-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 263.731314][ T4308] ldusb 4-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 263.740330][ T23] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 264.047415][ T23] usb 5-1: Using ep0 maxpacket: 8 [ 264.267466][ T6425] 9pnet_virtio: no channels available for device syz [ 265.057801][ T23] usb 5-1: device descriptor read/all, error -71 [ 265.365378][ T4223] usb 4-1: USB disconnect, device number 3 [ 265.411534][ T4223] ldusb 4-1:0.0: LD USB Device #0 now disconnected [ 265.827523][ T4223] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 266.487112][ T6448] netlink: 24 bytes leftover after parsing attributes in process `syz.4.600'. [ 266.516226][ T6448] netlink: 24 bytes leftover after parsing attributes in process `syz.4.600'. [ 266.552640][ T6451] IPVS: length: 528 != 8 [ 266.562134][ T6451] 9pnet_virtio: no channels available for device syz [ 266.717447][ T4223] usb 4-1: Using ep0 maxpacket: 8 [ 266.947428][ T4223] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 266.947455][ T4223] usb 4-1: config 0 has no interface number 0 [ 266.947480][ T4223] usb 4-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 266.947500][ T4223] usb 4-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0xAB, skipping [ 266.947516][ T4223] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 266.947550][ T4223] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 266.947571][ T4223] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.054559][ T4223] usb 4-1: config 0 descriptor?? [ 267.188216][ T4223] ldusb 4-1:0.55: Interrupt in endpoint not found [ 267.487312][ T6466] 9pnet_virtio: no channels available for device syz [ 267.915253][ T4223] usb 4-1: USB disconnect, device number 4 [ 268.167375][ T1110] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 268.301895][ T6476] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 268.427357][ T1110] usb 5-1: Using ep0 maxpacket: 8 [ 268.857575][ T1110] usb 5-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 269.598983][ T1110] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 269.609658][ T1110] usb 5-1: Product: syz [ 269.617685][ T1110] usb 5-1: Manufacturer: syz [ 269.622752][ T1110] usb 5-1: SerialNumber: syz [ 269.638309][ T1110] usb 5-1: config 0 descriptor?? [ 269.990099][ T6499] netlink: 24 bytes leftover after parsing attributes in process `syz.0.614'. [ 270.002319][ T6499] netlink: 24 bytes leftover after parsing attributes in process `syz.0.614'. [ 270.165570][ T6506] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 270.312146][ T6504] 9pnet_virtio: no channels available for device syz [ 270.357938][ T6510] device syzkaller0 entered promiscuous mode [ 271.173115][ T1110] usb 5-1: USB disconnect, device number 8 [ 271.732234][ T4178] udevd[4178]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 272.001355][ T6535] device syzkaller0 entered promiscuous mode [ 272.095930][ T6540] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 272.223647][ T6529] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 272.326078][ T6546] device syzkaller0 entered promiscuous mode [ 272.619127][ T6561] netlink: 4 bytes leftover after parsing attributes in process `syz.4.635'. [ 274.627565][ T13] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 275.497365][ T13] usb 1-1: Using ep0 maxpacket: 8 [ 276.297598][ T13] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 276.308490][ T13] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 276.319610][ T13] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 276.356174][ T13] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 276.392971][ T6596] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 276.441972][ T13] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 276.485974][ T13] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.501238][ T6601] device syzkaller0 entered promiscuous mode [ 276.787543][ T13] usb 1-1: GET_CAPABILITIES returned 0 [ 276.799869][ T13] usbtmc 1-1:16.0: can't read capabilities [ 276.906348][ T6606] 8021q: VLANs not supported on gre0 [ 277.025801][ T6611] 9pnet_virtio: no channels available for device syz [ 277.905655][ T21] usb 1-1: USB disconnect, device number 4 [ 277.920074][ T6614] 9pnet_virtio: no channels available for device syz [ 278.232949][ T6625] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 279.556217][ T6643] device syzkaller0 entered promiscuous mode [ 279.685296][ T6647] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 279.685963][ T6649] tipc: Started in network mode [ 279.719668][ T6649] tipc: Node identity 3e3d2cf3663b, cluster identity 4711 [ 279.757842][ T6649] tipc: Enabled bearer , priority 0 [ 279.786343][ T6653] 8021q: VLANs not supported on gre0 [ 279.793573][ T6651] device syzkaller0 entered promiscuous mode [ 279.882465][ T6649] tipc: Resetting bearer [ 279.925488][ T6646] tipc: Resetting bearer [ 279.936476][ T6657] 9pnet_virtio: no channels available for device syz [ 279.990982][ T6646] tipc: Disabling bearer [ 280.036437][ T6662] device syzkaller0 entered promiscuous mode [ 280.269323][ T6670] binder: 6666:6670 ioctl c0306201 0 returned -14 [ 281.075887][ T6678] device syzkaller0 entered promiscuous mode [ 281.266312][ T6686] 8021q: VLANs not supported on gre0 [ 281.284605][ T6683] pit: kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 281.340179][ T6689] 9pnet_virtio: no channels available for device syz [ 281.449791][ T6694] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 281.502874][ T6693] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 281.533127][ T6700] netlink: 4 bytes leftover after parsing attributes in process `syz.2.678'. [ 282.462604][ T6711] mkiss: ax0: crc mode is auto. [ 284.001159][ T6716] device syzkaller0 entered promiscuous mode [ 284.811710][ T6731] device syzkaller0 entered promiscuous mode [ 285.020615][ T6734] 9pnet_virtio: no channels available for device syz [ 285.570096][ T6759] netlink: 4 bytes leftover after parsing attributes in process `syz.0.695'. [ 285.806705][ T6766] device syzkaller0 entered promiscuous mode [ 286.267516][ T4223] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 286.668000][ T4223] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 286.715961][ T4223] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 286.937465][ T4223] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 287.008451][ T4223] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 287.038721][ T4223] usb 2-1: Manufacturer: syz [ 287.083007][ T6776] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 287.090558][ T4223] usb 2-1: config 0 descriptor?? [ 287.297494][ T4223] rc_core: IR keymap rc-hauppauge not found [ 287.307337][ T4223] Registered IR keymap rc-empty [ 287.339210][ T4223] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 287.384937][ T4223] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input5 [ 287.433940][ T4223] usb 2-1: USB disconnect, device number 5 [ 287.827444][ T4230] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 288.227820][ T4230] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 288.825550][ T4230] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 288.881322][ T4230] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 288.943699][ T4230] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.677510][ T4230] usb 3-1: can't set config #27, error -71 [ 290.700398][ T4230] usb 3-1: USB disconnect, device number 6 [ 291.367453][ T4230] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 291.591561][ T6844] netlink: 8 bytes leftover after parsing attributes in process `syz.4.721'. [ 291.647453][ T4230] usb 3-1: Using ep0 maxpacket: 32 [ 291.660618][ T6847] netlink: 8 bytes leftover after parsing attributes in process `syz.4.721'. [ 291.757350][ T6847] netlink: 8 bytes leftover after parsing attributes in process `syz.4.721'. [ 291.777772][ T4230] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 291.795427][ T4230] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 291.795563][ T6847] netlink: 8 bytes leftover after parsing attributes in process `syz.4.721'. [ 291.843072][ T4230] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 291.843693][ T6847] netlink: 8 bytes leftover after parsing attributes in process `syz.4.721'. [ 291.894072][ T4230] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 291.931608][ T4230] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 291.974610][ T4230] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 291.997321][ T4230] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 292.007932][ T4230] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.023718][ T4230] usb 3-1: config 0 descriptor?? [ 292.042263][ T6854] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 292.299842][ T4230] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 7 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 292.321157][ T4230] usb 3-1: USB disconnect, device number 7 [ 292.349528][ T4230] usblp0: removed [ 294.407420][ T13] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 296.697626][ T6878] 9pnet_virtio: no channels available for device syz [ 299.082430][ T6934] 9pnet_virtio: no channels available for device syz [ 300.652858][ T6926] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 302.848215][ T6974] device syzkaller0 entered promiscuous mode [ 302.980161][ T6977] tipc: Enabled bearer , priority 0 [ 302.997842][ T6972] tipc: Resetting bearer [ 303.026213][ T6972] tipc: Disabling bearer [ 303.787429][ T6999] tipc: Started in network mode [ 303.793414][ T6999] tipc: Node identity 62f73eaaef51, cluster identity 4711 [ 303.825687][ T6997] overlayfs: overlapping lowerdir path [ 303.845273][ T6999] tipc: Enabled bearer , priority 0 [ 303.885596][ T7002] overlayfs: overlapping lowerdir path [ 303.897410][ T21] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 303.986313][ T7004] device syzkaller0 entered promiscuous mode [ 304.033383][ T6998] tipc: Resetting bearer [ 304.167397][ T21] usb 1-1: Using ep0 maxpacket: 8 [ 304.216943][ T6998] tipc: Disabling bearer [ 304.477603][ T21] usb 1-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 304.538435][ T21] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 304.577556][ T21] usb 1-1: Product: syz [ 304.607334][ T21] usb 1-1: Manufacturer: syz [ 304.636529][ T21] usb 1-1: SerialNumber: syz [ 304.671644][ T21] usb 1-1: config 0 descriptor?? [ 304.691011][ T7023] netlink: 4 bytes leftover after parsing attributes in process `syz.2.765'. [ 305.038009][ T21] usb 1-1: USB disconnect, device number 5 [ 305.164867][ T7024] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 305.298893][ T7030] device syzkaller0 entered promiscuous mode [ 305.311441][ T7030] tipc: Started in network mode [ 305.316843][ T7030] tipc: Node identity , cluster identity 4711 [ 305.360399][ T7030] tipc: Failed to obtain node identity [ 305.375763][ T7030] tipc: Enabling of bearer rejected, failed to enable media [ 305.591331][ T7039] device syzkaller0 entered promiscuous mode [ 306.779298][ T7060] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 307.520503][ T7064] netlink: 20 bytes leftover after parsing attributes in process `syz.4.777'. [ 307.675194][ T7069] netlink: 'syz.4.779': attribute type 1 has an invalid length. [ 307.721906][ T7069] 8021q: adding VLAN 0 to HW filter on device bond1 [ 307.795915][ T7073] bond1: (slave ip6erspan0): making interface the new active one [ 307.820878][ T7073] bond1: (slave ip6erspan0): Enslaving as an active interface with an up link [ 307.842773][ T4299] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 307.958695][ T7080] netlink: 4 bytes leftover after parsing attributes in process `syz.0.781'. [ 308.557487][ T21] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 308.837418][ T21] usb 2-1: Using ep0 maxpacket: 8 [ 309.147569][ T21] usb 2-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 309.199227][ T21] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 310.558390][ T21] usb 2-1: Product: syz [ 310.563010][ T21] usb 2-1: Manufacturer: syz [ 310.625825][ T21] usb 2-1: SerialNumber: syz [ 310.676465][ T21] usb 2-1: config 0 descriptor?? [ 311.091730][ T7110] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 311.336215][ T7117] device syzkaller0 entered promiscuous mode [ 311.391586][ T7118] netlink: 'syz.2.791': attribute type 7 has an invalid length. [ 311.414758][ T7118] netlink: 'syz.2.791': attribute type 7 has an invalid length. [ 311.543963][ T7123] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 311.574939][ T7122] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 311.835337][ T7125] device syzkaller0 entered promiscuous mode [ 311.853340][ T21] usb 2-1: USB disconnect, device number 6 [ 312.075925][ T7127] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 312.555409][ T7141] device syzkaller0 entered promiscuous mode [ 312.652724][ T7142] 9pnet_virtio: no channels available for device syz [ 315.824733][ T7158] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 315.825024][ T7164] netlink: 12 bytes leftover after parsing attributes in process `syz.0.805'. [ 315.864318][ T7164] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 315.874631][ T7164] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 315.884855][ T7164] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 315.894766][ T7164] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 315.923496][ T7164] netlink: 12 bytes leftover after parsing attributes in process `syz.0.805'. [ 316.658677][ C0] ================================================================== [ 316.667755][ C0] BUG: KASAN: use-after-free in ax25_heartbeat_expiry+0x10c/0x130 [ 316.676755][ C0] Read of size 4 at addr ffff88802aab4850 by task syz.4.808/7166 [ 316.685247][ C0] [ 316.687804][ C0] CPU: 0 PID: 7166 Comm: syz.4.808 Not tainted syzkaller #0 [ 316.695819][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 316.706878][ C0] Call Trace: [ 316.710478][ C0] [ 316.713597][ C0] dump_stack_lvl+0x188/0x250 [ 316.718761][ C0] ? show_regs_print_info+0x20/0x20 [ 316.724459][ C0] ? _printk+0xda/0x130 [ 316.729011][ C0] ? ax25_heartbeat_expiry+0x10c/0x130 [ 316.734992][ C0] ? load_image+0x400/0x400 [ 316.739925][ C0] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 316.745911][ C0] print_address_description+0x60/0x2d0 [ 316.752003][ C0] ? ax25_heartbeat_expiry+0x10c/0x130 [ 316.758011][ C0] kasan_report+0xdf/0x130 [ 316.762856][ C0] ? ax25_heartbeat_expiry+0x10c/0x130 [ 316.768829][ C0] ? ax25_setup_timers+0xc0/0xc0 [ 316.774773][ C0] ax25_heartbeat_expiry+0x10c/0x130 [ 316.780588][ C0] call_timer_fn+0x17b/0x540 [ 316.785637][ C0] ? ax25_setup_timers+0xc0/0xc0 [ 316.791047][ C0] ? __run_timers+0x7f0/0x7f0 [ 316.796175][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 316.801877][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 316.807569][ C0] ? ax25_setup_timers+0xc0/0xc0 [ 316.813073][ C0] __run_timers+0x53a/0x7f0 [ 316.818006][ C0] ? detach_timer+0x2b0/0x2b0 [ 316.823121][ C0] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 316.829690][ C0] ? sched_clock_cpu+0x15/0x3c0 [ 316.835015][ C0] ? ktime_get_real_ts64+0x440/0x440 [ 316.840809][ C0] run_timer_softirq+0x63/0xf0 [ 316.846027][ C0] handle_softirqs+0x339/0x830 [ 316.851294][ C0] ? __irq_exit_rcu+0x13b/0x230 [ 316.856602][ C0] ? do_softirq+0x210/0x210 [ 316.861529][ C0] __irq_exit_rcu+0x13b/0x230 [ 316.866720][ C0] ? irq_exit_rcu+0x20/0x20 [ 316.871647][ C0] irq_exit_rcu+0x5/0x20 [ 316.876284][ C0] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 316.882457][ C0] [ 316.885661][ C0] [ 316.888872][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 316.895422][ C0] RIP: 0010:__sanitizer_cov_trace_cmp8+0x7a/0x80 [ 316.902455][ C0] Code: c1 e0 05 4d 8d 50 28 4d 39 ca 77 1e 4a c7 44 02 08 06 00 00 00 4a 89 7c 02 10 4a 89 74 02 18 4a 89 44 02 20 48 ff c1 48 89 0a 0f 1f 44 00 00 48 8b 04 24 65 48 8b 0d b4 4d 89 7e 65 8b 15 b5 [ 316.924025][ C0] RSP: 0018:ffffc900033ff9b0 EFLAGS: 00000297 [ 316.930681][ C0] RAX: ffffffff81c6be4b RBX: 0000000000000001 RCX: ffff8880285ad940 [ 316.939423][ C0] RDX: 0000000000000002 RSI: ffffffff81000000 RDI: ffff888074614952 [ 316.948161][ C0] RBP: ffffea0001d18400 R08: 0000000000000001 R09: 0000000000000951 [ 316.956900][ C0] R10: dffffc0000000000 R11: fffff940003a3081 R12: ffffffff81000000 [ 316.965638][ C0] R13: 0000000000000000 R14: ffff888074614951 R15: ffff888074614952 [ 316.974767][ C0] ? 0xffffffff81000000 [ 316.979338][ C0] ? __check_object_size+0x27b/0x410 [ 316.985144][ C0] ? 0xffffffff81000000 [ 316.989696][ C0] __check_object_size+0x27b/0x410 [ 316.995304][ C0] snd_rawmidi_kernel_write1+0x345/0x590 [ 317.001504][ C0] snd_rawmidi_write+0x5c2/0xc10 [ 317.006945][ C0] ? snd_rawmidi_read+0xac0/0xac0 [ 317.012446][ C0] ? sched_dynamic_update+0x210/0x210 [ 317.018350][ C0] ? _copy_from_user+0x111/0x170 [ 317.023788][ C0] ? end_current_label_crit_section+0x14b/0x170 [ 317.030623][ C0] ? common_file_perm+0x171/0x1c0 [ 317.036123][ C0] ? fsnotify_perm+0x5d/0x560 [ 317.041239][ C0] ? security_file_permission+0x75/0xa0 [ 317.047311][ C0] do_iter_write+0x3e4/0x7b0 [ 317.052337][ C0] do_writev+0x281/0x480 [ 317.056972][ C0] ? do_readv+0x460/0x460 [ 317.061710][ C0] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 317.068337][ C0] ? lock_chain_count+0x20/0x20 [ 317.073668][ C0] ? vtime_user_exit+0x2c8/0x3e0 [ 317.079094][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 317.084795][ C0] do_syscall_64+0x4c/0xa0 [ 317.089633][ C0] ? clear_bhb_loop+0x30/0x80 [ 317.094752][ C0] ? clear_bhb_loop+0x30/0x80 [ 317.099885][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 317.106355][ C0] RIP: 0033:0x7fd17df24eb9 [ 317.111216][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 317.132855][ C0] RSP: 002b:00007fd17c180028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 317.142342][ C0] RAX: ffffffffffffffda RBX: 00007fd17e19ffa0 RCX: 00007fd17df24eb9 [ 317.151086][ C0] RDX: 0000000000000002 RSI: 0000200000000840 RDI: 0000000000000005 [ 317.159831][ C0] RBP: 00007fd17df92c1f R08: 0000000000000000 R09: 0000000000000000 [ 317.168594][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 317.177339][ C0] R13: 00007fd17e1a0038 R14: 00007fd17e19ffa0 R15: 00007fff465161b8 [ 317.186107][ C0] [ 317.189403][ C0] [ 317.191933][ C0] Allocated by task 7122: [ 317.196672][ C0] __kasan_kmalloc+0xb5/0xf0 [ 317.201713][ C0] ax25_dev_device_up+0x50/0x580 [ 317.207184][ C0] ax25_device_event+0x483/0x4f0 [ 317.212590][ C0] raw_notifier_call_chain+0xcb/0x160 [ 317.218475][ C0] __dev_notify_flags+0x194/0x300 [ 317.223975][ C0] dev_change_flags+0xe3/0x1a0 [ 317.229187][ C0] dev_ifsioc+0x130/0xd50 [ 317.233917][ C0] dev_ioctl+0x545/0xe30 [ 317.238549][ C0] sock_do_ioctl+0x245/0x320 [ 317.243571][ C0] sock_ioctl+0x4d2/0x710 [ 317.248312][ C0] __se_sys_ioctl+0xfa/0x170 [ 317.253344][ C0] do_syscall_64+0x4c/0xa0 [ 317.258170][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 317.264679][ C0] [ 317.267218][ C0] Freed by task 7160: [ 317.271962][ C0] kasan_set_track+0x4b/0x70 [ 317.276998][ C0] kasan_set_free_info+0x1f/0x40 [ 317.282403][ C0] ____kasan_slab_free+0xd5/0x110 [ 317.287901][ C0] slab_free_freelist_hook+0xea/0x170 [ 317.293783][ C0] kfree+0xef/0x2a0 [ 317.297955][ C0] ax25_release+0x661/0x870 [ 317.302878][ C0] sock_close+0xd5/0x240 [ 317.307516][ C0] __fput+0x234/0x930 [ 317.311867][ C0] task_work_run+0x125/0x1a0 [ 317.316883][ C0] exit_to_user_mode_loop+0x10f/0x130 [ 317.322765][ C0] exit_to_user_mode_prepare+0xee/0x180 [ 317.328854][ C0] syscall_exit_to_user_mode+0x16/0x40 [ 317.334844][ C0] do_syscall_64+0x58/0xa0 [ 317.339679][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 317.346211][ C0] [ 317.348746][ C0] Last potentially related work creation: [ 317.355094][ C0] kasan_save_stack+0x35/0x60 [ 317.360212][ C0] kasan_record_aux_stack+0xb8/0x100 [ 317.366011][ C0] insert_work+0x54/0x3d0 [ 317.370757][ C0] __queue_work+0x9c5/0xd50 [ 317.375685][ C0] queue_work_on+0x124/0x1f0 [ 317.380703][ C0] netdevice_event+0x803/0x900 [ 317.385917][ C0] raw_notifier_call_chain+0xcb/0x160 [ 317.391799][ C0] __dev_notify_flags+0x194/0x300 [ 317.397299][ C0] dev_change_flags+0xe3/0x1a0 [ 317.402518][ C0] do_setlink+0xcdb/0x3d60 [ 317.407351][ C0] rtnl_newlink+0x1658/0x1a50 [ 317.412462][ C0] rtnetlink_rcv_msg+0x844/0xf30 [ 317.417864][ C0] netlink_rcv_skb+0x1f5/0x440 [ 317.423070][ C0] netlink_unicast+0x774/0x920 [ 317.428282][ C0] netlink_sendmsg+0x8ba/0xbe0 [ 317.433500][ C0] __sys_sendto+0x46d/0x620 [ 317.438421][ C0] __x64_sys_sendto+0xda/0xf0 [ 317.443534][ C0] do_syscall_64+0x4c/0xa0 [ 317.448358][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 317.454807][ C0] [ 317.457334][ C0] Second to last potentially related work creation: [ 317.464541][ C0] kasan_save_stack+0x35/0x60 [ 317.469655][ C0] kasan_record_aux_stack+0xb8/0x100 [ 317.475464][ C0] insert_work+0x54/0x3d0 [ 317.480205][ C0] __queue_work+0x9c5/0xd50 [ 317.485129][ C0] queue_work_on+0x124/0x1f0 [ 317.490142][ C0] call_usermodehelper_exec+0x2e3/0x520 [ 317.496426][ C0] kobject_uevent_env+0x681/0x890 [ 317.501937][ C0] device_add+0x91c/0xfb0 [ 317.506692][ C0] iscsi_register_transport+0x284/0x5a0 [ 317.512765][ C0] iser_init+0xec/0x190 [ 317.517313][ C0] do_one_initcall+0x272/0x730 [ 317.522526][ C0] do_initcall_level+0x137/0x1f0 [ 317.527925][ C0] do_initcalls+0x4b/0x90 [ 317.532655][ C0] kernel_init_freeable+0x3e9/0x570 [ 317.538342][ C0] kernel_init+0x19/0x1b0 [ 317.543072][ C0] ret_from_fork+0x1f/0x30 [ 317.547896][ C0] [ 317.550419][ C0] The buggy address belongs to the object at ffff88802aab4800 [ 317.550419][ C0] which belongs to the cache kmalloc-192 of size 192 [ 317.565848][ C0] The buggy address is located 80 bytes inside of [ 317.565848][ C0] 192-byte region [ffff88802aab4800, ffff88802aab48c0) [ 317.580347][ C0] The buggy address belongs to the page: [ 317.586518][ C0] page:ffffea0000aaad00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2aab4 [ 317.597756][ C0] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 317.606035][ C0] raw: 00fff00000000200 ffffea0001c88040 0000000800000005 ffff888016c41a00 [ 317.615478][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 317.624884][ C0] page dumped because: kasan: bad access detected [ 317.631908][ C0] page_owner tracks the page as allocated [ 317.638160][ C0] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 24157440681, free_ts 0 [ 317.654625][ C0] get_page_from_freelist+0x1bbd/0x1ca0 [ 317.660726][ C0] __alloc_pages+0x1ee/0x480 [ 317.665744][ C0] alloc_page_interleave+0x24/0x1e0 [ 317.671428][ C0] new_slab+0xc0/0x4b0 [ 317.675868][ C0] ___slab_alloc+0x80a/0xdd0 [ 317.680879][ C0] kmem_cache_alloc_trace+0x1a5/0x2a0 [ 317.686760][ C0] call_usermodehelper_setup+0x8a/0x260 [ 317.692827][ C0] kobject_uevent_env+0x65e/0x890 [ 317.698326][ C0] kset_register+0x188/0x1f0 [ 317.703340][ C0] bus_register+0x21c/0x6c0 [ 317.708264][ C0] memstick_init+0x3c/0xb0 [ 317.713093][ C0] do_one_initcall+0x272/0x730 [ 317.718310][ C0] do_initcall_level+0x137/0x1f0 [ 317.723727][ C0] do_initcalls+0x4b/0x90 [ 317.728477][ C0] kernel_init_freeable+0x3e9/0x570 [ 317.734173][ C0] kernel_init+0x19/0x1b0 [ 317.738916][ C0] page_owner free stack trace missing [ 317.744804][ C0] [ 317.747332][ C0] Memory state around the buggy address: [ 317.753494][ C0] ffff88802aab4700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 317.762329][ C0] ffff88802aab4780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 317.771173][ C0] >ffff88802aab4800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 317.780006][ C0] ^ [ 317.787320][ C0] ffff88802aab4880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 317.796158][ C0] ffff88802aab4900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 317.804991][ C0] ================================================================== [ 317.813831][ C0] Disabling lock debugging due to kernel taint [ 317.820605][ C0] vkms_vblank_simulate: vblank timer overrun [ 317.827198][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 317.835170][ C0] CPU: 0 PID: 7166 Comm: syz.4.808 Tainted: G B syzkaller #0 [ 317.844675][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 317.855713][ C0] Call Trace: [ 317.859301][ C0] [ 317.862406][ C0] dump_stack_lvl+0x188/0x250 [ 317.867573][ C0] ? show_regs_print_info+0x20/0x20 [ 317.873283][ C0] ? load_image+0x400/0x400 [ 317.878228][ C0] panic+0x2e5/0x810 [ 317.882502][ C0] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 317.889247][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 317.894228][ C0] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 317.900681][ C0] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 317.907129][ C0] ? _raw_spin_unlock+0x40/0x40 [ 317.912445][ C0] ? ax25_heartbeat_expiry+0x10c/0x130 [ 317.918417][ C0] check_panic_on_warn+0x80/0xa0 [ 317.923824][ C0] ? ax25_heartbeat_expiry+0x10c/0x130 [ 317.929791][ C0] end_report+0x6d/0xf0 [ 317.934330][ C0] kasan_report+0x102/0x130 [ 317.939269][ C0] ? ax25_heartbeat_expiry+0x10c/0x130 [ 317.945274][ C0] ? ax25_setup_timers+0xc0/0xc0 [ 317.950676][ C0] ax25_heartbeat_expiry+0x10c/0x130 [ 317.956463][ C0] call_timer_fn+0x17b/0x540 [ 317.961584][ C0] ? ax25_setup_timers+0xc0/0xc0 [ 317.966983][ C0] ? __run_timers+0x7f0/0x7f0 [ 317.972095][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 317.977782][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 317.983463][ C0] ? ax25_setup_timers+0xc0/0xc0 [ 317.988856][ C0] __run_timers+0x53a/0x7f0 [ 317.993778][ C0] ? detach_timer+0x2b0/0x2b0 [ 317.998884][ C0] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 318.005431][ C0] ? sched_clock_cpu+0x15/0x3c0 [ 318.010750][ C0] ? ktime_get_real_ts64+0x440/0x440 [ 318.016528][ C0] run_timer_softirq+0x63/0xf0 [ 318.021734][ C0] handle_softirqs+0x339/0x830 [ 318.026938][ C0] ? __irq_exit_rcu+0x13b/0x230 [ 318.032235][ C0] ? do_softirq+0x210/0x210 [ 318.037154][ C0] __irq_exit_rcu+0x13b/0x230 [ 318.042261][ C0] ? irq_exit_rcu+0x20/0x20 [ 318.047181][ C0] irq_exit_rcu+0x5/0x20 [ 318.051822][ C0] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 318.057996][ C0] [ 318.061207][ C0] [ 318.064413][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 318.070968][ C0] RIP: 0010:__sanitizer_cov_trace_cmp8+0x7a/0x80 [ 318.077904][ C0] Code: c1 e0 05 4d 8d 50 28 4d 39 ca 77 1e 4a c7 44 02 08 06 00 00 00 4a 89 7c 02 10 4a 89 74 02 18 4a 89 44 02 20 48 ff c1 48 89 0a 0f 1f 44 00 00 48 8b 04 24 65 48 8b 0d b4 4d 89 7e 65 8b 15 b5 [ 318.099446][ C0] RSP: 0018:ffffc900033ff9b0 EFLAGS: 00000297 [ 318.106212][ C0] RAX: ffffffff81c6be4b RBX: 0000000000000001 RCX: ffff8880285ad940 [ 318.114946][ C0] RDX: 0000000000000002 RSI: ffffffff81000000 RDI: ffff888074614952 [ 318.123679][ C0] RBP: ffffea0001d18400 R08: 0000000000000001 R09: 0000000000000951 [ 318.132412][ C0] R10: dffffc0000000000 R11: fffff940003a3081 R12: ffffffff81000000 [ 318.141146][ C0] R13: 0000000000000000 R14: ffff888074614951 R15: ffff888074614952 [ 318.149882][ C0] ? 0xffffffff81000000 [ 318.154421][ C0] ? __check_object_size+0x27b/0x410 [ 318.160202][ C0] ? 0xffffffff81000000 [ 318.164740][ C0] __check_object_size+0x27b/0x410 [ 318.170328][ C0] snd_rawmidi_kernel_write1+0x345/0x590 [ 318.176494][ C0] snd_rawmidi_write+0x5c2/0xc10 [ 318.181891][ C0] ? snd_rawmidi_read+0xac0/0xac0 [ 318.187379][ C0] ? sched_dynamic_update+0x210/0x210 [ 318.193254][ C0] ? _copy_from_user+0x111/0x170 [ 318.198664][ C0] ? end_current_label_crit_section+0x14b/0x170 [ 318.205493][ C0] ? common_file_perm+0x171/0x1c0 [ 318.210980][ C0] ? fsnotify_perm+0x5d/0x560 [ 318.216088][ C0] ? security_file_permission+0x75/0xa0 [ 318.222155][ C0] do_iter_write+0x3e4/0x7b0 [ 318.227171][ C0] do_writev+0x281/0x480 [ 318.231801][ C0] ? do_readv+0x460/0x460 [ 318.236528][ C0] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 318.243070][ C0] ? lock_chain_count+0x20/0x20 [ 318.248369][ C0] ? vtime_user_exit+0x2c8/0x3e0 [ 318.253766][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 318.259453][ C0] do_syscall_64+0x4c/0xa0 [ 318.264278][ C0] ? clear_bhb_loop+0x30/0x80 [ 318.269385][ C0] ? clear_bhb_loop+0x30/0x80 [ 318.274500][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 318.280947][ C0] RIP: 0033:0x7fd17df24eb9 [ 318.285872][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 318.307415][ C0] RSP: 002b:00007fd17c180028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 318.317020][ C0] RAX: ffffffffffffffda RBX: 00007fd17e19ffa0 RCX: 00007fd17df24eb9 [ 318.325819][ C0] RDX: 0000000000000002 RSI: 0000200000000840 RDI: 0000000000000005 [ 318.334558][ C0] RBP: 00007fd17df92c1f R08: 0000000000000000 R09: 0000000000000000 [ 318.343292][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 318.352027][ C0] R13: 00007fd17e1a0038 R14: 00007fd17e19ffa0 R15: 00007fff465161b8 [ 318.360768][ C0] [ 318.364390][ C0] Kernel Offset: disabled [ 318.369136][ C0] Rebooting in 86400 seconds..