last executing test programs: 9.598812668s ago: executing program 3 (id=4): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000980)="91f8a9849519def28691bbc4173c3d6f357d0272b7e95a136b3ffec75b73e6937b7b22a1319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000f2ffffff2e3591ceb1757de97fb25500620d0d30506e7429fa5337b74945da657f794d5b5bf89588e07b14a17f069912dc0c3f201bff8b9a687b85baa11244632642a9be7b42b6b5882b738f05eba73221490e2d5c17cf406be2796eec488a5b5268f507ee8d6f3dd1d64abc785708eb9bd24e352a984b2b", 0xc5}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 9.019187416s ago: executing program 3 (id=7): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "fc0300", 0x10, 0x2c, 0xff, @local, @mcast2, {[@fragment={0x3c, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}], @ndisc_rs}}}}, 0x46) write$tun(r0, &(0x7f0000000240)=ANY=[], 0xfdef) 7.116189956s ago: executing program 3 (id=11): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'team_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="5400000010000104000000000200000000000000", @ANYRES32=r1, @ANYBLOB="0000faffffff000034001280110001006272696467655f736c617665000000001c0005"], 0x54}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040}, 0x0) 6.914243813s ago: executing program 4 (id=5): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x8, 0xffffffffd24b2432, 0x83, 0xffff, 0x0, 0xabe6, 0x0, 0x0, 0x80, 0x8001}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x7ff0000, {0x0, 0x36}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c41, 0x0) close(r2) 6.371171956s ago: executing program 3 (id=14): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000780)=ANY=[@ANYBLOB="e8000000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="cc00330080000000ffffffffffff080211000000f70b87594b3f00000000000001000100dd068b7668a21729dd5cd8a062cc132f8c370f255947985b88cb9f22e02d96f87d9c0a6796487053adb1a2d1f8ed33d6ef7faf4ba99f81c72edefbc742d2d897c0fb6eb2289c22b03871ec6ddb7398d4b5509078903c634145233d8a7a9a2fc09946289eba75dd06420000000000dd388554a53b4220be2da96b5e5aa2c5a314922e0370b1ad33958137"], 0xe8}, 0x1, 0x0, 0x0, 0x44800}, 0x0) 5.722749762s ago: executing program 4 (id=16): syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a0003010000000904000000010100000a24010000000201020c24020000000000000800000524050000082407000000009e0c240700000000a3e82f07070d2407010604000000000000e90924030000000001"], 0x0) 4.74347568s ago: executing program 3 (id=17): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) madvise(&(0x7f000004d000/0x2000)=nil, 0x2000, 0xb) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0xffffc000) msync(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) 4.740708463s ago: executing program 2 (id=18): r0 = syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r0, 0xc2604110, 0x0) 4.472360467s ago: executing program 1 (id=20): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000000c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000005c0)={0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000680)=""/151}, 0x20) r3 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0x4a, {0x2, 0x0, @dev}}) socket$inet(0x2, 0x3, 0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001440), r4) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r5, 0x0, 0x2e, &(0x7f0000000480)={0x5, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @multicast2}}}, 0x108) 4.285879939s ago: executing program 2 (id=21): r0 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000640)={{0x2, 0x0, @dev}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}}, 0x4a, {0x2, 0x0, @broadcast}, 'syz_tun\x00'}) 3.918363938s ago: executing program 0 (id=22): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000180), 0x4) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, 0x0}) close_range(r1, 0xffffffffffffffff, 0x0) 2.990890727s ago: executing program 1 (id=23): r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000000000008"], 0x24}}, 0x0) 2.827549211s ago: executing program 2 (id=24): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000008c0)=@newtfilter={0x88c, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r1, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x85c, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_POLICE={0x848, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0xfffff53e, 0x9, 0x4, 0x7, 0x6, 0xfffffff9, 0x3f, 0xf2b, 0x6, 0x9, 0x7, 0x7, 0x2, 0x75, 0x0, 0xc7a, 0x8ec, 0x6, 0x3, 0x8, 0xfffffff7, 0x2, 0x7, 0x1, 0x4, 0x5, 0x1, 0x7, 0x3, 0x9, 0x10000, 0x1, 0x4, 0x6, 0x1, 0x97, 0x7, 0xbf0, 0x8, 0x6, 0xffff, 0xf, 0x2, 0x3, 0x8, 0x76fb, 0x6, 0x7, 0x4, 0x5, 0x1, 0x6, 0x4, 0xfffffffd, 0x1, 0x7, 0x7, 0x9, 0xd01, 0x7, 0x6, 0x3, 0xffffff0b, 0x1, 0x1, 0x8, 0xdd, 0x0, 0x9e, 0x2, 0x10001, 0xb, 0xb845, 0x2, 0x768, 0x8e31, 0x2, 0x20000, 0x8, 0xa9f7, 0x0, 0x7, 0x921a, 0x10, 0xac, 0x3, 0x7, 0xffffffb0, 0x9, 0x4, 0x8, 0x7, 0x8, 0x6, 0x80000000, 0xea, 0x401, 0x6, 0x6, 0x0, 0x6, 0x6, 0x34f, 0x2, 0x9, 0x9, 0x1, 0x3, 0x6, 0xf, 0x4, 0x80000000, 0x2, 0x332, 0x2, 0x7, 0x0, 0x2, 0x65, 0xd, 0x4, 0x0, 0x6, 0x9, 0xffffffff, 0xa, 0x6000000, 0x10000, 0x3, 0x4, 0x28b, 0x0, 0x2, 0x4, 0x6, 0x7, 0x5, 0x8001, 0x7, 0x100, 0x10, 0x8, 0x7, 0x9, 0x881e, 0x8, 0x4, 0x5, 0x81, 0x1b, 0xa6, 0x6, 0x0, 0xc84, 0x80, 0xfffffffb, 0x4, 0x2, 0xb21c, 0x7, 0x5, 0x0, 0x1ff, 0x100, 0x80000001, 0x40, 0x4, 0x1, 0x9, 0x3, 0xd7d, 0x4, 0x4a5, 0x54, 0x8, 0x5, 0xff, 0x7, 0x1, 0x81, 0x2b, 0x0, 0xe, 0x887, 0xfffffff8, 0x5, 0x1, 0x4, 0x800, 0x3, 0x1403, 0x991, 0x1, 0x4, 0x3a1d, 0xffff, 0x1134, 0x8, 0x3, 0x10001, 0x1, 0x5, 0xb, 0x6c, 0x10000, 0x3, 0x0, 0x6, 0x6, 0x69, 0xf, 0x10, 0x5, 0x0, 0x7, 0x3, 0x0, 0x5, 0x0, 0x2f, 0x9, 0x8, 0x9, 0x9, 0x6, 0x168, 0x800, 0x800000, 0xabeb, 0x7, 0x7, 0x8, 0x8, 0x6, 0x7, 0x80, 0x1, 0x4, 0x3, 0x0, 0x3, 0x3ff, 0x101, 0x6, 0x4, 0x3, 0x4, 0x2fc5, 0x3, 0x80, 0x6, 0x5, 0xffffffff, 0x0, 0x3, 0xf0a]}, @TCA_POLICE_RATE={0x404, 0x2, [0x3, 0x5, 0x1, 0x8000, 0x70, 0x8, 0x0, 0x4, 0xcd, 0x0, 0x400, 0x5, 0x354, 0xd31, 0x3a, 0x87, 0x4, 0x5, 0x5, 0x1, 0x2, 0x1, 0x0, 0x5, 0x9, 0xe44, 0x100, 0x3, 0x1, 0x0, 0xa4, 0x30c, 0x5, 0xfffff338, 0x20000000, 0xb3, 0x80000001, 0x40, 0x0, 0x400, 0x7, 0x7, 0xf41, 0xb920, 0x2, 0x6, 0x3, 0xbbbc, 0x8, 0x6, 0x1, 0x4, 0x41, 0x11, 0x3, 0x1, 0xf42e, 0x9, 0x9, 0x0, 0xa, 0x50, 0x5, 0x2, 0x3, 0x6, 0x2, 0x9, 0x0, 0x6, 0xfffffffa, 0xffffffff, 0x4, 0x7, 0x7, 0xa1, 0xfff, 0x3, 0x8001, 0x6, 0x3, 0x2, 0x100, 0x401, 0xb, 0x5, 0x9, 0x4, 0x7, 0x5, 0x2, 0x5, 0x7fffffff, 0x7, 0xff, 0x0, 0x4, 0x71, 0x1200, 0x7042, 0x7, 0x3, 0x1, 0x0, 0x80, 0x6, 0x3, 0xfff, 0x0, 0x4, 0xa6bc, 0x5, 0xfffffe00, 0x4, 0xffffff81, 0x0, 0x5, 0xed, 0xc87a, 0x1, 0x0, 0xa5c, 0x7, 0x6, 0x3, 0x6, 0x6, 0x3, 0x100, 0x9, 0x3, 0x8, 0x3, 0x8, 0x10000, 0x1000, 0x5, 0x5, 0x2, 0x6, 0x6, 0x2, 0x0, 0x9, 0x8, 0xb38, 0x0, 0x8ab, 0x7, 0xffff0001, 0x6, 0x5, 0x3, 0x80, 0x4, 0xfe6, 0x3d, 0x41, 0x8001, 0x8, 0x8, 0xd8, 0xdd0, 0x8, 0x8103, 0x43, 0x4, 0x2, 0x2, 0x29, 0x8, 0x716, 0x1, 0xfffffc00, 0xd, 0x6, 0x7, 0x5, 0x4, 0x2, 0x4, 0x6, 0x0, 0xfffffffe, 0x4, 0x1, 0x9, 0xbc, 0x1, 0x9, 0xfffffe01, 0xf63, 0x9, 0xb, 0x8c60, 0x1000, 0x1, 0x4, 0x6, 0xfffffff8, 0x5, 0x3ff, 0x1000, 0x7, 0x1000, 0x2, 0x2, 0x5, 0x200, 0xc, 0x7, 0x40000000, 0x4, 0x4c4, 0x9, 0xda1, 0x58000000, 0xfffffffb, 0x80000001, 0x66, 0x9, 0x7ff, 0x8, 0x4, 0xf, 0x100, 0x5, 0x4, 0x3, 0xfffffbff, 0x9, 0x3ff, 0x1, 0x7c5, 0xbe, 0x200, 0x3, 0x5, 0xfff, 0x6, 0x4, 0x1, 0xffffffae, 0xe882, 0xf, 0x0, 0x40, 0xfffffffe, 0x5, 0x10, 0x8001, 0xe5a, 0x1, 0x9]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x9, 0x8, 0x2, 0xf9c, 0x8, {0x9, 0x0, 0xfffe, 0x5, 0x2, 0xdfd}, {0xb, 0x0, 0x8c62, 0xff7f, 0x8000, 0x4}, 0x2c000, 0x10, 0x6}}]}]}}]}, 0x88c}, 0x1, 0x0, 0x0, 0x884}, 0x6) 2.543102259s ago: executing program 0 (id=25): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) mount$overlay(0x0, 0x0, 0x0, 0x10000, &(0x7f00000002c0)={[], [], 0x2c}) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) openat$dma_heap(0xffffffffffffff9c, 0x0, 0x103000, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x6a, @dev={0xfe, 0x80, '\x00', 0xf}, 0x8}}}, &(0x7f0000000040)=0x84) getsockopt$bt_hci(r0, 0x84, 0x80, &(0x7f00000010c0)=""/4111, &(0x7f0000000000)=0x100f) 2.482413599s ago: executing program 1 (id=26): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000440)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f00000004c0)={0x2, 0x32}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000540)={0x2, 0x2}, 0x2) 1.684204047s ago: executing program 0 (id=27): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000780)=ANY=[@ANYBLOB="e8000000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="cc00330080000000ffffffffffff080211000000f70b87594b3f00000000000001000100dd068b7668a21729dd5cd8a062cc132f8c370f255947985b88cb9f22e02d96f87d9c0a6796487053adb1a2d1f8ed33d6ef7faf4ba99f81c72edefbc742d2d897c0fb6eb2289c22b03871ec6ddb7398d4b5509078903c634145233d8a7a9a2fc09946289eba75dd06420000000000dd388554a53b4220be2da96b5e5aa2c5a314922e0370b1ad33958137"], 0xe8}, 0x1, 0x0, 0x0, 0x44800}, 0x0) 1.651621396s ago: executing program 2 (id=28): r0 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd00ac6700000000000000000000c2888e7d52164ec480e79200000100", [0x0, 0x2000000000001]}}) ioctl$XFS_IOC_SCRUBV_METADATA(0xffffffffffffffff, 0xc0285840, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) 1.648373445s ago: executing program 1 (id=29): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000004c0)={'veth0_vlan\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=@setlink={0x2c, 0x13, 0x1, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, 0x800, 0x80}, [@IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x3404c045}, 0x10) 1.294133208s ago: executing program 4 (id=30): sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x80042, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) write$binfmt_aout(r1, 0x0, 0xfce1) 1.112864201s ago: executing program 0 (id=31): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x80000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000380)={0x0, 0x2, 0xbe}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x32b, @time={0x6, 0x7}, 0xff, {0x0, 0x7f}, 0x0, 0x2}) 1.02888365s ago: executing program 1 (id=32): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000480)={0x5, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @multicast2}}}, 0x108) getsockopt$inet_buf(r0, 0x0, 0x30, 0x0, &(0x7f0000000180)) 788.179644ms ago: executing program 2 (id=33): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1}, 0x18) connect$can_j1939(r0, &(0x7f0000000080)={0x1d, r1, 0x0, {0x1, 0xf0, 0x4}, 0x2}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f00000003c0)=0x5, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$can_j1939(r0, &(0x7f0000001440)={0x0, 0x0, &(0x7f0000001400)={&(0x7f0000000400)="ef4afaf6287cee80906cfed4d5a1bc530b5ed5ccbf7f998efccc705e30fb1bf7a8bf321c2dc5428b96fc5defd593e93ce59b0fd4c71f7016dec92800a4d2cd0338310d51c0c524211e7910521920ca6c5bd27a28c6cc51a3c7b776a5", 0x5c}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x34, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'vxcan1\x00'}]}, 0x34}}, 0x0) 699.151418ms ago: executing program 0 (id=34): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB], &(0x7f0000000140)='GPL\x00'}, 0x94) socket$inet6_sctp(0xa, 0x801, 0x84) socket$l2tp(0x2, 0x2, 0x73) socket$kcm(0x29, 0x2, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x0, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000080)=[0x2], &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x1}) 510.773608ms ago: executing program 4 (id=35): recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x8040) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001"], 0x74}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 510.567459ms ago: executing program 1 (id=36): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmget(0x1, 0x4000, 0xa20, &(0x7f0000ffb000/0x4000)=nil) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r3, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) accept(r3, &(0x7f0000000280)=@can, 0x0) 507.113595ms ago: executing program 3 (id=37): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000014c0)=@base={0xf, 0x4, 0x8, 0x1}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0xe, 0xe, &(0x7f0000001440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000001800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x6, 0x1000, &(0x7f0000000240)=""/4096}, 0x94) 2.555361ms ago: executing program 0 (id=38): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000008c0)=@newtfilter={0x88c, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x85c, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_POLICE={0x848, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0xfffff53e, 0x9, 0x4, 0x7, 0x6, 0xfffffff9, 0x3f, 0xf2b, 0x6, 0x9, 0x7, 0x7, 0x2, 0x75, 0x0, 0xc7a, 0x8ec, 0x6, 0x3, 0x8, 0xfffffff7, 0x2, 0x7, 0x1, 0x4, 0x5, 0x1, 0x7, 0x3, 0x9, 0x10000, 0x1, 0x4, 0x6, 0x1, 0x97, 0x7, 0xbf0, 0x8, 0x6, 0xffff, 0xf, 0x2, 0x3, 0x8, 0x76fb, 0x6, 0x7, 0x4, 0x5, 0x1, 0x6, 0x4, 0xfffffffd, 0x1, 0x7, 0x7, 0x9, 0xd01, 0x7, 0x6, 0x3, 0xffffff0b, 0x1, 0x1, 0x8, 0xdd, 0x0, 0x9e, 0x2, 0x10001, 0xb, 0xb845, 0x2, 0x768, 0x8e31, 0x2, 0x20000, 0x8, 0xa9f7, 0x0, 0x7, 0x921a, 0x10, 0xac, 0x3, 0x7, 0xffffffb0, 0x9, 0x4, 0x8, 0x7, 0x8, 0x6, 0x80000000, 0xea, 0x401, 0x6, 0x6, 0x0, 0x6, 0x6, 0x34f, 0x2, 0x9, 0x9, 0x1, 0x3, 0x6, 0xf, 0x4, 0x80000000, 0x2, 0x332, 0x2, 0x7, 0x0, 0x2, 0x65, 0xd, 0x4, 0x0, 0x6, 0x9, 0xffffffff, 0xa, 0x6000000, 0x10000, 0x3, 0x4, 0x28b, 0x0, 0x2, 0x4, 0x6, 0x7, 0x5, 0x8001, 0x7, 0x100, 0x10, 0x8, 0x7, 0x9, 0x881e, 0x8, 0x4, 0x5, 0x81, 0x1b, 0xa6, 0x6, 0x0, 0xc84, 0x80, 0xfffffffb, 0x4, 0x2, 0xb21c, 0x7, 0x5, 0x0, 0x1ff, 0x100, 0x80000001, 0x40, 0x4, 0x1, 0x9, 0x3, 0xd7d, 0x4, 0x4a5, 0x54, 0x8, 0x5, 0xff, 0x7, 0x1, 0x81, 0x2b, 0x0, 0xe, 0x887, 0xfffffff8, 0x5, 0x1, 0x4, 0x800, 0x3, 0x1403, 0x991, 0x1, 0x4, 0x3a1d, 0xffff, 0x1134, 0x8, 0x3, 0x10001, 0x1, 0x5, 0xb, 0x6c, 0x10000, 0x3, 0x0, 0x6, 0x6, 0x69, 0xf, 0x10, 0x5, 0x0, 0x7, 0x3, 0x0, 0x5, 0x0, 0x2f, 0x9, 0x8, 0x9, 0x9, 0x6, 0x168, 0x800, 0x800000, 0xabeb, 0x7, 0x7, 0x8, 0x8, 0x6, 0x7, 0x80, 0x1, 0x4, 0x3, 0x0, 0x3, 0x3ff, 0x101, 0x6, 0x4, 0x3, 0x4, 0x2fc5, 0x3, 0x80, 0x6, 0x5, 0xffffffff, 0x0, 0x3, 0xf0a]}, @TCA_POLICE_RATE={0x404, 0x2, [0x3, 0x5, 0x1, 0x8000, 0x70, 0x8, 0x0, 0x4, 0xcd, 0x0, 0x400, 0x5, 0x354, 0xd31, 0x3a, 0x87, 0x4, 0x5, 0x5, 0x1, 0x2, 0x1, 0x0, 0x5, 0x9, 0xe44, 0x100, 0x3, 0x1, 0x0, 0xa4, 0x30c, 0x5, 0xfffff338, 0x20000000, 0xb3, 0x80000001, 0x40, 0x0, 0x400, 0x7, 0x7, 0xf41, 0xb920, 0x2, 0x6, 0x3, 0xbbbc, 0x8, 0x6, 0x1, 0x4, 0x41, 0x11, 0x3, 0x1, 0xf42e, 0x9, 0x9, 0x0, 0xa, 0x50, 0x5, 0x2, 0x3, 0x6, 0x2, 0x9, 0x0, 0x6, 0xfffffffa, 0xffffffff, 0x4, 0x7, 0x7, 0xa1, 0xfff, 0x3, 0x8001, 0x6, 0x3, 0x2, 0x100, 0x401, 0xb, 0x5, 0x9, 0x4, 0x7, 0x5, 0x2, 0x5, 0x7fffffff, 0x7, 0xff, 0x0, 0x4, 0x71, 0x1200, 0x7042, 0x7, 0x3, 0x1, 0x0, 0x80, 0x6, 0x3, 0xfff, 0x0, 0x4, 0xa6bc, 0x5, 0xfffffe00, 0x4, 0xffffff81, 0x0, 0x5, 0xed, 0xc87a, 0x1, 0x0, 0xa5c, 0x7, 0x6, 0x3, 0x6, 0x6, 0x3, 0x100, 0x9, 0x3, 0x8, 0x3, 0x8, 0x10000, 0x1000, 0x5, 0x5, 0x2, 0x6, 0x6, 0x2, 0x0, 0x9, 0x8, 0xb38, 0x0, 0x8ab, 0x7, 0xffff0001, 0x6, 0x5, 0x3, 0x80, 0x4, 0xfe6, 0x3d, 0x41, 0x8001, 0x8, 0x8, 0xd8, 0xdd0, 0x8, 0x8103, 0x43, 0x4, 0x2, 0x2, 0x29, 0x8, 0x716, 0x1, 0xfffffc00, 0xd, 0x6, 0x7, 0x5, 0x4, 0x2, 0x4, 0x6, 0x0, 0xfffffffe, 0x4, 0x1, 0x9, 0xbc, 0x1, 0x9, 0xfffffe01, 0xf63, 0x9, 0xb, 0x8c60, 0x1000, 0x1, 0x4, 0x6, 0xfffffff8, 0x5, 0x3ff, 0x1000, 0x7, 0x1000, 0x2, 0x2, 0x5, 0x200, 0xc, 0x7, 0x40000000, 0x4, 0x4c4, 0x9, 0xda1, 0x58000000, 0xfffffffb, 0x80000001, 0x66, 0x9, 0x7ff, 0x8, 0x4, 0xf, 0x100, 0x5, 0x4, 0x3, 0xfffffbff, 0x9, 0x3ff, 0x1, 0x7c5, 0xbe, 0x200, 0x3, 0x5, 0xfff, 0x6, 0x4, 0x1, 0xffffffae, 0xe882, 0xf, 0x0, 0x40, 0xfffffffe, 0x5, 0x10, 0x8001, 0xe5a, 0x1, 0x9]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x9, 0x8, 0x2, 0xf9c, 0x8, {0x9, 0x0, 0xfffe, 0x5, 0x2, 0xdfd}, {0xb, 0x0, 0x8c62, 0xff7f, 0x8000, 0x4}, 0x2c000, 0x10, 0x6}}]}]}}]}, 0x88c}, 0x1, 0x0, 0x0, 0x884}, 0x6) 0s ago: executing program 2 (id=39): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24008080) setsockopt$sock_int(r3, 0x1, 0x9, &(0x7f0000000200)=0x6, 0x4) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.151' (ED25519) to the list of known hosts. [ 73.555977][ T5589] cgroup: Unknown subsys name 'net' [ 73.777817][ T5589] cgroup: Unknown subsys name 'cpuset' [ 73.852327][ T5589] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.515584][ T5589] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.987026][ T5614] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.999427][ T5614] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 78.020644][ T5614] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 78.045415][ T5614] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 78.047128][ T5614] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 78.048862][ T5614] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 78.052571][ T5619] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 78.054846][ T5619] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 78.057340][ T5619] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 78.058397][ T5619] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 78.059556][ T5617] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 78.064837][ T5609] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 78.066969][ T5609] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 78.069486][ T5609] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 78.073200][ T59] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 78.076648][ T59] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 78.077091][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 78.128418][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 78.149373][ T4918] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 78.150276][ T4918] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 78.183885][ T4918] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 78.208588][ T59] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 78.212854][ T4918] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 78.255269][ T4918] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 78.257592][ T4918] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.104200][ T5616] Bluetooth: hci1: command tx timeout [ 80.181888][ T5616] Bluetooth: hci4: command tx timeout [ 80.261673][ T5616] Bluetooth: hci0: command tx timeout [ 80.261689][ T4918] Bluetooth: hci2: command tx timeout [ 80.341727][ T4918] Bluetooth: hci3: command tx timeout [ 80.455132][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.455218][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.455516][ T5605] bridge_slave_0: entered allmulticast mode [ 80.457744][ T5605] bridge_slave_0: entered promiscuous mode [ 80.530122][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.530225][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.530398][ T5605] bridge_slave_1: entered allmulticast mode [ 80.532714][ T5605] bridge_slave_1: entered promiscuous mode [ 80.558228][ T5601] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.558337][ T5601] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.558435][ T5601] bridge_slave_0: entered allmulticast mode [ 80.559843][ T5601] bridge_slave_0: entered promiscuous mode [ 80.624518][ T5601] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.624660][ T5601] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.624822][ T5601] bridge_slave_1: entered allmulticast mode [ 80.626640][ T5601] bridge_slave_1: entered promiscuous mode [ 80.649128][ T5602] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.649243][ T5602] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.649418][ T5602] bridge_slave_0: entered allmulticast mode [ 80.652625][ T5602] bridge_slave_0: entered promiscuous mode [ 80.681202][ T5604] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.681313][ T5604] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.681453][ T5604] bridge_slave_0: entered allmulticast mode [ 80.687092][ T5604] bridge_slave_0: entered promiscuous mode [ 80.724352][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.724461][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.724621][ T5602] bridge_slave_1: entered allmulticast mode [ 80.726300][ T5602] bridge_slave_1: entered promiscuous mode [ 80.730433][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.730674][ T5604] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.730813][ T5604] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.730961][ T5604] bridge_slave_1: entered allmulticast mode [ 80.735367][ T5604] bridge_slave_1: entered promiscuous mode [ 80.776548][ T5603] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.776664][ T5603] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.777107][ T5603] bridge_slave_0: entered allmulticast mode [ 80.779521][ T5603] bridge_slave_0: entered promiscuous mode [ 80.809742][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.834955][ T5601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.835276][ T5603] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.835375][ T5603] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.835491][ T5603] bridge_slave_1: entered allmulticast mode [ 80.837514][ T5603] bridge_slave_1: entered promiscuous mode [ 80.988566][ T5601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.008945][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.030076][ T5604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.057811][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.059503][ T5605] team0: Port device team_slave_0 added [ 81.062820][ T5604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.090405][ T5603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.115123][ T5605] team0: Port device team_slave_1 added [ 81.132955][ T5601] team0: Port device team_slave_0 added [ 81.135596][ T5603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.177938][ T5601] team0: Port device team_slave_1 added [ 81.196583][ T5602] team0: Port device team_slave_0 added [ 81.215569][ T5604] team0: Port device team_slave_0 added [ 81.242428][ T5602] team0: Port device team_slave_1 added [ 81.243339][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.243349][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.243361][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.246613][ T5604] team0: Port device team_slave_1 added [ 81.270906][ T5603] team0: Port device team_slave_0 added [ 81.293122][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.293137][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.293159][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.333747][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.333762][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.333785][ T5601] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.346337][ T5603] team0: Port device team_slave_1 added [ 81.412594][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.412609][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.412630][ T5601] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.425826][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.425842][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.425871][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.446723][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.446738][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.446761][ T5604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.472054][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.472070][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.472093][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.484096][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.484112][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.484135][ T5604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.485319][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.485329][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.485351][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.537395][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.537412][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.537433][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.612529][ T5605] hsr_slave_0: entered promiscuous mode [ 81.614214][ T5605] hsr_slave_1: entered promiscuous mode [ 81.699414][ T5601] hsr_slave_0: entered promiscuous mode [ 81.700636][ T5601] hsr_slave_1: entered promiscuous mode [ 81.706748][ T5601] debugfs: 'hsr0' already exists in 'hsr' [ 81.706877][ T5601] Cannot create hsr debugfs directory [ 81.843942][ T5602] hsr_slave_0: entered promiscuous mode [ 81.845323][ T5602] hsr_slave_1: entered promiscuous mode [ 81.846253][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 81.846275][ T5602] Cannot create hsr debugfs directory [ 81.906412][ T5604] hsr_slave_0: entered promiscuous mode [ 81.907786][ T5604] hsr_slave_1: entered promiscuous mode [ 81.908867][ T5604] debugfs: 'hsr0' already exists in 'hsr' [ 81.908889][ T5604] Cannot create hsr debugfs directory [ 81.965353][ T5603] hsr_slave_0: entered promiscuous mode [ 81.967067][ T5603] hsr_slave_1: entered promiscuous mode [ 81.968049][ T5603] debugfs: 'hsr0' already exists in 'hsr' [ 81.968071][ T5603] Cannot create hsr debugfs directory [ 82.181760][ T4918] Bluetooth: hci1: command tx timeout [ 82.261803][ T4918] Bluetooth: hci4: command tx timeout [ 82.341774][ T4918] Bluetooth: hci2: command tx timeout [ 82.341806][ T4918] Bluetooth: hci0: command tx timeout [ 82.431316][ T5616] Bluetooth: hci3: command tx timeout [ 83.046612][ T5605] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 83.097303][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.101058][ T5605] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 83.126502][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.129540][ T5605] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 83.164855][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.188168][ T5605] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 83.226383][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.345761][ T5601] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 83.386518][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.392145][ T5601] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 83.426982][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.430601][ T5601] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 83.474527][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.499387][ T5601] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 83.527022][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.635628][ T5602] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 83.667844][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.678629][ T5602] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 83.715504][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.720549][ T5602] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 83.758883][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.785212][ T5602] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 83.816970][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.959734][ T5603] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 83.984925][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.989209][ T5603] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 84.025203][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.038392][ T5603] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 84.065887][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.093932][ T5603] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 84.137175][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.162983][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.272776][ T5616] Bluetooth: hci1: command tx timeout [ 84.274076][ T5604] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 84.315586][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.323850][ T5604] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 84.351947][ T5616] Bluetooth: hci4: command tx timeout [ 84.366427][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.378853][ T5604] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 84.405936][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.418823][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.419847][ T5604] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 84.422078][ T5616] Bluetooth: hci0: command tx timeout [ 84.422105][ T5616] Bluetooth: hci2: command tx timeout [ 84.449995][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.502588][ T4918] Bluetooth: hci3: command tx timeout [ 84.503496][ T1417] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.503951][ T1417] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.593235][ T5601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.604883][ T1417] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.605007][ T1417] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.727365][ T5601] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.767884][ T1442] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.768018][ T1442] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.793054][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.828615][ T1417] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.828748][ T1417] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.928540][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.999822][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.000164][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.010816][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.079865][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.079989][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.217960][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.259645][ T5604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.308665][ T1442] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.313701][ T1442] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.404690][ T1442] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.404790][ T1442] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.483572][ T5604] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.567851][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.568084][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.649910][ T3195] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.650037][ T3195] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.215901][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.341867][ T4918] Bluetooth: hci1: command tx timeout [ 86.421761][ T4918] Bluetooth: hci4: command tx timeout [ 86.468881][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.501757][ T5616] Bluetooth: hci0: command tx timeout [ 86.501799][ T4918] Bluetooth: hci2: command tx timeout [ 86.581819][ T4918] Bluetooth: hci3: command tx timeout [ 86.771064][ T5605] veth0_vlan: entered promiscuous mode [ 86.814619][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.893510][ T5605] veth1_vlan: entered promiscuous mode [ 86.959772][ T820] cfg80211: failed to load regulatory.db [ 87.063423][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.064550][ T5601] veth0_vlan: entered promiscuous mode [ 87.140729][ T5601] veth1_vlan: entered promiscuous mode [ 87.222470][ T5605] veth0_macvtap: entered promiscuous mode [ 87.252200][ T5605] veth1_macvtap: entered promiscuous mode [ 87.407256][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.419722][ T5603] veth0_vlan: entered promiscuous mode [ 87.429604][ T5604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.431068][ T5601] veth0_macvtap: entered promiscuous mode [ 87.457375][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.480985][ T5601] veth1_macvtap: entered promiscuous mode [ 87.508934][ T5603] veth1_vlan: entered promiscuous mode [ 87.520910][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.540034][ T1145] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.568596][ T1145] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.583776][ T1145] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.660591][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.738344][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.883697][ T2262] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.887486][ T2262] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.890114][ T5602] veth0_vlan: entered promiscuous mode [ 87.890567][ T2262] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.927035][ T157] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.967537][ T5603] veth0_macvtap: entered promiscuous mode [ 87.999426][ T5604] veth0_vlan: entered promiscuous mode [ 88.071614][ T5603] veth1_macvtap: entered promiscuous mode [ 88.085175][ T5602] veth1_vlan: entered promiscuous mode [ 88.164150][ T5604] veth1_vlan: entered promiscuous mode [ 88.194819][ T1145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.194843][ T1145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.357000][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.431024][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.474338][ T1537] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.474356][ T1537] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.514433][ T157] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.533399][ T157] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.596708][ T157] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.625902][ T157] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.646297][ T5602] veth0_macvtap: entered promiscuous mode [ 88.648231][ T1145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.648246][ T1145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.732237][ T5604] veth0_macvtap: entered promiscuous mode [ 88.737832][ T5602] veth1_macvtap: entered promiscuous mode [ 88.889395][ T5604] veth1_macvtap: entered promiscuous mode [ 89.039053][ T1417] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.039075][ T1417] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.129937][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.339267][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.353418][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.434493][ T1417] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.434513][ T1417] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.517761][ T3195] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.539469][ T3195] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.555330][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.579797][ T3195] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.618248][ T3195] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.396391][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.449081][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.464876][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.493248][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.493280][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.573973][ T2262] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.361741][ T3195] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.361760][ T3195] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.651297][ T1417] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.651317][ T1417] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.665647][ T5813] syz.3.7 uses obsolete (PF_INET,SOCK_PACKET) [ 92.540438][ T1511] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.540456][ T1511] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.698233][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.698254][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.947115][ T5839] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12'. [ 95.508118][ T5849] netlink: 44 bytes leftover after parsing attributes in process `syz.1.15'. [ 97.079997][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 97.303339][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 97.331400][ T9] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 97.331424][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 97.331448][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 97.369035][ T9] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 97.369064][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.369080][ T9] usb 5-1: Product: syz [ 97.369094][ T9] usb 5-1: Manufacturer: syz [ 97.369107][ T9] usb 5-1: SerialNumber: syz [ 97.490132][ T5873] netlink: 16 bytes leftover after parsing attributes in process `syz.1.23'. [ 97.578280][ T9] usb 5-1: 0:2 : does not exist [ 97.917041][ T9] usb 5-1: 1:0: failed to get current value for ch 0 (-22) [ 98.670123][ T9] usb 5-1: USB disconnect, device number 2 [ 99.515785][ T5799] udevd[5799]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 99.676599][ T5906] vxcan1: entered promiscuous mode [ 100.068374][ T5915] Zero length message leads to an empty skb [ 100.369682][ T4918] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 100.369788][ T4918] CPU: 0 UID: 0 PID: 4918 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 100.369812][ T4918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 100.369825][ T4918] Workqueue: hci4 hci_rx_work [ 100.369867][ T4918] Call Trace: [ 100.369876][ T4918] [ 100.369886][ T4918] dump_stack_lvl+0xe8/0x150 [ 100.369912][ T4918] sysfs_create_dir_ns+0x271/0x2a0 [ 100.369939][ T4918] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 100.369961][ T4918] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 100.369998][ T4918] ? rt_spin_unlock+0x160/0x200 [ 100.370021][ T4918] kobject_add_internal+0x631/0xd10 [ 100.370056][ T4918] kobject_add+0x163/0x240 [ 100.370079][ T4918] ? irqentry_exit+0x218/0x760 [ 100.370108][ T4918] ? __pfx_kobject_add+0x10/0x10 [ 100.370149][ T4918] device_add+0x408/0xbb0 [ 100.370175][ T4918] hci_conn_add_sysfs+0xd5/0x210 [ 100.370201][ T4918] le_conn_complete_evt+0x10e6/0x16b0 [ 100.370236][ T4918] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 100.370260][ T4918] ? lockdep_hardirqs_on+0x7a/0x110 [ 100.370282][ T4918] ? irqentry_exit+0x218/0x760 [ 100.370302][ T4918] ? rcu_is_watching+0x15/0xb0 [ 100.370335][ T4918] ? skb_pull_data+0xfb/0x200 [ 100.370365][ T4918] hci_le_conn_complete_evt+0x187/0x470 [ 100.370399][ T4918] hci_event_packet+0x659/0xef0 [ 100.370399][ T4918] hci_event_packet+0x659/0xef0 [ 100.370428][ T4918] ? __pfx____migrate_enable+0x10/0x10 [ 100.370450][ T4918] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 100.370477][ T4918] ? __pfx_hci_event_packet+0x10/0x10 [ 100.370499][ T4918] ? preempt_schedule_common+0x82/0xd0 [ 100.370522][ T4918] ? preempt_schedule_thunk+0x16/0x30 [ 100.370552][ T4918] ? hci_send_to_monitor+0xe2/0x590 [ 100.370574][ T4918] hci_rx_work+0x3ee/0x1040 [ 100.370598][ T4918] ? preempt_schedule_thunk+0x16/0x30 [ 100.370626][ T4918] ? process_scheduled_works+0xa70/0x1860 [ 100.370647][ T4918] process_scheduled_works+0xb5d/0x1860 [ 100.370699][ T4918] ? __pfx_process_scheduled_works+0x10/0x10 [ 100.370726][ T4918] ? assign_work+0x3d5/0x5e0 [ 100.370751][ T4918] worker_thread+0xa53/0xfc0 [ 100.370800][ T4918] kthread+0x388/0x470 [ 100.370823][ T4918] ? __pfx_worker_thread+0x10/0x10 [ 100.370841][ T4918] ? __pfx_kthread+0x10/0x10 [ 100.370865][ T4918] ret_from_fork+0x514/0xb70 [ 100.370889][ T4918] ? __pfx_ret_from_fork+0x10/0x10 [ 100.370909][ T4918] ? __switch_to+0xc79/0x1410 [ 100.370938][ T4918] ? __pfx_kthread+0x10/0x10 [ 100.370962][ T4918] ret_from_fork_asm+0x1a/0x30 [ 100.371006][ T4918] [ 100.371420][ T4918] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 100.381435][ T4918] Bluetooth: hci4: failed to register connection device [ 100.671720][ T4918] ================================================================== [ 100.671738][ T4918] BUG: KASAN: slab-use-after-free in l2cap_sock_new_connection_cb+0x208/0x2f0 [ 100.671770][ T4918] Read of size 8 at addr ffff8880604ba7b0 by task kworker/u9:1/4918 [ 100.671786][ T4918] [ 100.671797][ T4918] CPU: 0 UID: 0 PID: 4918 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 100.671819][ T4918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 100.671832][ T4918] Workqueue: hci4 hci_rx_work [ 100.671856][ T4918] Call Trace: [ 100.671863][ T4918] [ 100.671872][ T4918] dump_stack_lvl+0xe8/0x150 [ 100.671894][ T4918] print_address_description+0x55/0x1e0 [ 100.671914][ T4918] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 100.671934][ T4918] print_report+0x58/0x70 [ 100.671951][ T4918] kasan_report+0x117/0x150 [ 100.671973][ T4918] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 100.671999][ T4918] l2cap_sock_new_connection_cb+0x208/0x2f0 [ 100.672020][ T4918] l2cap_connect_cfm+0x368/0x1560 [ 100.672042][ T4918] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 100.672062][ T4918] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 100.672086][ T4918] ? mutex_lock_nested+0x152/0x1d0 [ 100.672104][ T4918] ? hci_connect_cfm+0x2c/0x140 [ 100.672128][ T4918] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 100.672147][ T4918] hci_connect_cfm+0x95/0x140 [ 100.672172][ T4918] le_conn_complete_evt+0x1134/0x16b0 [ 100.672212][ T4918] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 100.672237][ T4918] ? lockdep_hardirqs_on+0x7a/0x110 [ 100.672259][ T4918] ? irqentry_exit+0x218/0x760 [ 100.672279][ T4918] ? rcu_is_watching+0x15/0xb0 [ 100.672306][ T4918] ? skb_pull_data+0xfb/0x200 [ 100.672332][ T4918] hci_le_conn_complete_evt+0x187/0x470 [ 100.672359][ T4918] hci_event_packet+0x659/0xef0 [ 100.672382][ T4918] ? __pfx____migrate_enable+0x10/0x10 [ 100.672403][ T4918] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 100.672425][ T4918] ? __pfx_hci_event_packet+0x10/0x10 [ 100.672445][ T4918] ? preempt_schedule_common+0x82/0xd0 [ 100.672466][ T4918] ? preempt_schedule_thunk+0x16/0x30 [ 100.672492][ T4918] ? hci_send_to_monitor+0xe2/0x590 [ 100.672511][ T4918] hci_rx_work+0x3ee/0x1040 [ 100.672532][ T4918] ? preempt_schedule_thunk+0x16/0x30 [ 100.672557][ T4918] ? process_scheduled_works+0xa70/0x1860 [ 100.672576][ T4918] process_scheduled_works+0xb5d/0x1860 [ 100.672607][ T4918] ? __pfx_process_scheduled_works+0x10/0x10 [ 100.672629][ T4918] ? assign_work+0x3d5/0x5e0 [ 100.672648][ T4918] worker_thread+0xa53/0xfc0 [ 100.672683][ T4918] kthread+0x388/0x470 [ 100.672705][ T4918] ? __pfx_worker_thread+0x10/0x10 [ 100.672722][ T4918] ? __pfx_kthread+0x10/0x10 [ 100.672744][ T4918] ret_from_fork+0x514/0xb70 [ 100.672765][ T4918] ? __pfx_ret_from_fork+0x10/0x10 [ 100.672784][ T4918] ? __switch_to+0xc79/0x1410 [ 100.672811][ T4918] ? __pfx_kthread+0x10/0x10 [ 100.672833][ T4918] ret_from_fork_asm+0x1a/0x30 [ 100.672862][ T4918] [ 100.672869][ T4918] [ 100.672879][ T4918] Allocated by task 4918: [ 100.672889][ T4918] kasan_save_track+0x3e/0x80 [ 100.672906][ T4918] __kasan_kmalloc+0x93/0xb0 [ 100.672922][ T4918] __kmalloc_noprof+0x3e7/0x7b0 [ 100.672938][ T4918] sk_prot_alloc+0xe7/0x210 [ 100.672957][ T4918] sk_alloc+0x3a/0x390 [ 100.672976][ T4918] bt_sock_alloc+0x3b/0x310 [ 100.672996][ T4918] l2cap_sock_new_connection_cb+0xf1/0x2f0 [ 100.673015][ T4918] l2cap_connect_cfm+0x368/0x1560 [ 100.673030][ T4918] hci_connect_cfm+0x95/0x140 [ 100.673051][ T4918] le_conn_complete_evt+0x1134/0x16b0 [ 100.673074][ T4918] hci_le_conn_complete_evt+0x187/0x470 [ 100.673096][ T4918] hci_event_packet+0x659/0xef0 [ 100.673114][ T4918] hci_rx_work+0x3ee/0x1040 [ 100.673131][ T4918] process_scheduled_works+0xb5d/0x1860 [ 100.673147][ T4918] worker_thread+0xa53/0xfc0 [ 100.673163][ T4918] kthread+0x388/0x470 [ 100.673181][ T4918] ret_from_fork+0x514/0xb70 [ 100.673236][ T4918] ret_from_fork_asm+0x1a/0x30 [ 100.673255][ T4918] [ 100.673260][ T4918] Freed by task 5918: [ 100.673268][ T4918] kasan_save_track+0x3e/0x80 [ 100.673283][ T4918] kasan_save_free_info+0x46/0x50 [ 100.673304][ T4918] __kasan_slab_free+0x5c/0x80 [ 100.673319][ T4918] kfree+0x1c5/0x6c0 [ 100.673334][ T4918] __sk_destruct+0x74b/0x9d0 [ 100.673353][ T4918] l2cap_sock_cleanup_listen+0xe0/0x440 [ 100.673370][ T4918] l2cap_sock_release+0x6e/0x270 [ 100.673386][ T4918] sock_close+0xc3/0x240 [ 100.673408][ T4918] __fput+0x461/0xa70 [ 100.673429][ T4918] task_work_run+0x1d9/0x270 [ 100.673450][ T4918] get_signal+0x11eb/0x1330 [ 100.673465][ T4918] arch_do_signal_or_restart+0xbc/0x840 [ 100.673488][ T4918] exit_to_user_mode_loop+0x8c/0x4d0 [ 100.673507][ T4918] do_syscall_64+0x33e/0xf80 [ 100.673526][ T4918] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.673543][ T4918] [ 100.673547][ T4918] The buggy address belongs to the object at ffff8880604ba000 [ 100.673547][ T4918] which belongs to the cache kmalloc-2k of size 2048 [ 100.673562][ T4918] The buggy address is located 1968 bytes inside of [ 100.673562][ T4918] freed 2048-byte region [ffff8880604ba000, ffff8880604ba800) [ 100.673581][ T4918] [ 100.673585][ T4918] The buggy address belongs to the physical page: [ 100.673604][ T4918] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880604bb000 pfn:0x604b8 [ 100.673623][ T4918] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 100.673639][ T4918] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 100.673661][ T4918] page_type: f5(slab) [ 100.673678][ T4918] raw: 0080000000000240 ffff88801a011000 ffff88801a00bc88 ffffea000184ea10 [ 100.673694][ T4918] raw: ffff8880604bb000 0000000800080006 00000000f5000000 0000000000000000 [ 100.673711][ T4918] head: 0080000000000240 ffff88801a011000 ffff88801a00bc88 ffffea000184ea10 [ 100.673727][ T4918] head: ffff8880604bb000 0000000800080006 00000000f5000000 0000000000000000 [ 100.673742][ T4918] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 100.673757][ T4918] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 100.673766][ T4918] page dumped because: kasan: bad access detected [ 100.673779][ T4918] page_owner tracks the page as allocated [ 100.673785][ T4918] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5601, tgid 5601 (syz-executor), ts 80711849399, free_ts 0 [ 100.673815][ T4918] post_alloc_hook+0x231/0x280 [ 100.673832][ T4918] get_page_from_freelist+0x27c8/0x2840 [ 100.673852][ T4918] __alloc_frozen_pages_noprof+0x18d/0x380 [ 100.673872][ T4918] allocate_slab+0x77/0x660 [ 100.673893][ T4918] refill_objects+0x33c/0x3d0 [ 100.673913][ T4918] __pcs_replace_empty_main+0x373/0x720 [ 100.673935][ T4918] __kmalloc_cache_noprof+0x44e/0x690 [ 100.673950][ T4918] rtnl_newlink+0x136/0x1bb0 [ 100.673967][ T4918] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 100.673984][ T4918] netlink_rcv_skb+0x232/0x4b0 [ 100.674002][ T4918] netlink_unicast+0x780/0x920 [ 100.674018][ T4918] netlink_sendmsg+0x813/0xb40 [ 100.674037][ T4918] __sys_sendto+0x67f/0x710 [ 100.674054][ T4918] __x64_sys_sendto+0xde/0x100 [ 100.674071][ T4918] do_syscall_64+0x15f/0xf80 [ 100.674090][ T4918] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.674106][ T4918] page_owner free stack trace missing [ 100.674112][ T4918] [ 100.674116][ T4918] Memory state around the buggy address: [ 100.674125][ T4918] ffff8880604ba680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 100.674137][ T4918] ffff8880604ba700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 100.674149][ T4918] >ffff8880604ba780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 100.674157][ T4918] ^ [ 100.674167][ T4918] ffff8880604ba800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 100.674178][ T4918] ffff8880604ba880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 100.674194][ T4918] ================================================================== [ 100.674210][ T4918] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 100.674225][ T4918] CPU: 0 UID: 0 PID: 4918 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 100.674246][ T4918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 100.674258][ T4918] Workqueue: hci4 hci_rx_work [ 100.674281][ T4918] Call Trace: [ 100.674289][ T4918] [ 100.674296][ T4918] vpanic+0x56c/0xa60 [ 100.674319][ T4918] ? __pfx_vpanic+0x10/0x10 [ 100.674343][ T4918] panic+0xc5/0xd0 [ 100.674362][ T4918] ? __pfx_panic+0x10/0x10 [ 100.674382][ T4918] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 100.674403][ T4918] ? rcu_is_watching+0x15/0xb0 [ 100.674431][ T4918] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 100.674451][ T4918] check_panic_on_warn+0x89/0xb0 [ 100.674475][ T4918] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 100.674495][ T4918] end_report+0x73/0x170 [ 100.674513][ T4918] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 100.674533][ T4918] kasan_report+0x128/0x150 [ 100.674553][ T4918] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 100.674576][ T4918] l2cap_sock_new_connection_cb+0x208/0x2f0 [ 100.674599][ T4918] l2cap_connect_cfm+0x368/0x1560 [ 100.674620][ T4918] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 100.674645][ T4918] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 100.674668][ T4918] ? mutex_lock_nested+0x152/0x1d0 [ 100.674684][ T4918] ? hci_connect_cfm+0x2c/0x140 [ 100.674707][ T4918] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 100.674726][ T4918] hci_connect_cfm+0x95/0x140 [ 100.674751][ T4918] le_conn_complete_evt+0x1134/0x16b0 [ 100.674781][ T4918] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 100.674805][ T4918] ? lockdep_hardirqs_on+0x7a/0x110 [ 100.674826][ T4918] ? irqentry_exit+0x218/0x760 [ 100.674846][ T4918] ? rcu_is_watching+0x15/0xb0 [ 100.674870][ T4918] ? skb_pull_data+0xfb/0x200 [ 100.674896][ T4918] hci_le_conn_complete_evt+0x187/0x470 [ 100.674923][ T4918] hci_event_packet+0x659/0xef0 [ 100.674945][ T4918] ? __pfx____migrate_enable+0x10/0x10 [ 100.674965][ T4918] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 100.674988][ T4918] ? __pfx_hci_event_packet+0x10/0x10 [ 100.675008][ T4918] ? preempt_schedule_common+0x82/0xd0 [ 100.675028][ T4918] ? preempt_schedule_thunk+0x16/0x30 [ 100.675054][ T4918] ? hci_send_to_monitor+0xe2/0x590 [ 100.675072][ T4918] hci_rx_work+0x3ee/0x1040 [ 100.675093][ T4918] ? preempt_schedule_thunk+0x16/0x30 [ 100.675118][ T4918] ? process_scheduled_works+0xa70/0x1860 [ 100.675137][ T4918] process_scheduled_works+0xb5d/0x1860 [ 100.675168][ T4918] ? __pfx_process_scheduled_works+0x10/0x10 [ 100.675199][ T4918] ? assign_work+0x3d5/0x5e0 [ 100.675219][ T4918] worker_thread+0xa53/0xfc0 [ 100.675250][ T4918] kthread+0x388/0x470 [ 100.675272][ T4918] ? __pfx_worker_thread+0x10/0x10 [ 100.675290][ T4918] ? __pfx_kthread+0x10/0x10 [ 100.675313][ T4918] ret_from_fork+0x514/0xb70 [ 100.675333][ T4918] ? __pfx_ret_from_fork+0x10/0x10 [ 100.675352][ T4918] ? __switch_to+0xc79/0x1410 [ 100.675380][ T4918] ? __pfx_kthread+0x10/0x10 [ 100.675402][ T4918] ret_from_fork_asm+0x1a/0x30 [ 100.675430][ T4918] [ 100.676299][ T4918] Kernel Offset: disabled