last executing test programs: 3.265674915s ago: executing program 3 (id=134): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r1}, 0x10) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) 3.15565486s ago: executing program 3 (id=136): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f0000000140)={&(0x7f0000000340)={0x2, 0x4005, @empty}, 0x10, 0x0}, 0x30006095) 2.871795606s ago: executing program 0 (id=140): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020a07b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x1e00, 0x6f, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000700)='kfree\x00', r0}, 0x18) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = syz_io_uring_setup(0x499, &(0x7f0000000f40)={0x0, 0xd144, 0x0, 0x40000000, 0x37f}, &(0x7f00000001c0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='0'], 0x30}}) io_uring_enter(r2, 0x3516, 0xddd6, 0x4, 0x0, 0x0) 2.431523013s ago: executing program 0 (id=147): bpf$MAP_CREATE(0x0, 0x0, 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x18) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000), 0xfffffecc) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/anycast6\x00') fchdir(r5) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000000)='./file0\x00', 0x80000006) splice(r2, 0x0, r4, 0x0, 0x4ffe6, 0x0) 2.267909888s ago: executing program 3 (id=150): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000500)='hybla', 0x5) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000001b00)="a6", 0x1, 0x20000045, &(0x7f0000000140)={0xa, 0x4001, 0xfffc, @loopback, 0x3}, 0x1c) 2.10085478s ago: executing program 3 (id=153): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003d00)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000b40)="8b5a", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000000240)=' ', 0x1}], 0x1}}], 0x2, 0x48800) recvmmsg(r0, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000002700)=""/4096, 0x1000}], 0x1}, 0x5}, {{0x0, 0x0, &(0x7f0000000380)}, 0x80}], 0x2, 0x10141, &(0x7f00000003c0)={0x0, 0x989680}) 1.640091325s ago: executing program 4 (id=164): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB], 0x0, 0x6, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000007c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x54}, 0x1, 0x0, 0x0, 0x40044}, 0x20008000) 1.506146382s ago: executing program 0 (id=167): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000007c0)={{r2}, &(0x7f0000000740), &(0x7f0000000780)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x22c7, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f00000002c0)='kfree\x00', r3, 0x0, 0x2}, 0x18) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x40006) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) 1.414950807s ago: executing program 4 (id=168): socket$pppoe(0x18, 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f00000000c0)=0x56e02a3) write$binfmt_aout(r1, &(0x7f00000000c0)=ANY=[], 0xfce1) 1.350407046s ago: executing program 0 (id=171): bind$l2tp(0xffffffffffffffff, &(0x7f00000000c0), 0x10) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000040)="e5786a0d000000000000c83b", 0xc, 0x0, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x10) recvmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x2000) 1.225652008s ago: executing program 1 (id=172): sendto$inet6(0xffffffffffffffff, 0x0, 0xf0, 0x20000080, &(0x7f0000006080)={0xa, 0x4e23, 0x4, @loopback, 0x4}, 0x1c) 1.223826755s ago: executing program 4 (id=174): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0xb, &(0x7f00000008c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x18) openat(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x100, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0), 0x2, 0x9}}, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000340)={0x1d, r3, 0x0, {0x0, 0x0, 0x6}}, 0x18) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000003c0)="964a6c5176e84b4d7a", 0x9}], 0x1}, 0x4048081) connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0xf0, 0x4}, 0xfe}, 0x18) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=@newtfilter={0x24, 0x11, 0x1, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x74, r3, {0xfff3, 0x10}, {0xfff1, 0x9}, {0x2, 0xa}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20048000) 1.166997868s ago: executing program 0 (id=175): r0 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./bus\x00', 0x101042, 0x0) pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) fallocate(r0, 0x0, 0x11, 0x9) 1.106444089s ago: executing program 3 (id=176): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x804}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000080)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x40) pwritev2(r2, 0x0, 0x0, 0x5405, 0x0, 0x0) 998.698459ms ago: executing program 1 (id=178): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000380)='kfree\x00', r1, 0x0, 0x3}, 0x18) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0x8c, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x8c}}, 0x0) 939.657357ms ago: executing program 2 (id=179): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@acquire={0x128, 0x17, 0x1, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x41}, 0x1, 0x32}, @in=@multicast2, {@in6=@private2, @in6=@local, 0x0, 0x40}, {{@in=@multicast1, @in=@private=0xa010100, 0x0, 0x0, 0x201, 0x3, 0x2, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfb1}, {0x1}, 0x80000001, 0x6e6bb8}, 0xfffffffe}}, 0x128}}, 0x4000) 879.139004ms ago: executing program 3 (id=180): ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x13108}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000000040)="5766b1b827f600333b09d3748ee7d700", 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f0000000240)=0x3, 0x4) 814.68206ms ago: executing program 2 (id=181): bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x6c, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={0x0, r0}, 0x18) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001600), 0x109344, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000019200)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3, 0x0, 0xfffffffffffffffe}, 0x18) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r1, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x1018}, './file0\x00'}) 814.369931ms ago: executing program 1 (id=182): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, &(0x7f00000000c0)}) get_mempolicy(0x0, 0x0, 0x203, &(0x7f0000394000/0x3000)=nil, 0x3) 807.611226ms ago: executing program 4 (id=183): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000008b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000080)='kfree\x00', r1, 0x0, 0x8}, 0x18) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf2531000000180001801400020064756d6d7930"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c890}, 0x2000c800) 695.192118ms ago: executing program 2 (id=184): socket$pppoe(0x18, 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, 0x0}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f00000000c0)=0x56e02a3) write$binfmt_aout(r1, &(0x7f00000000c0)=ANY=[], 0xfce1) 665.848277ms ago: executing program 1 (id=185): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r0}, 0x18) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1a3a700080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000010007b0000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 571.095559ms ago: executing program 4 (id=186): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xd, &(0x7f0000000780)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback=0x36e084fcb6392193, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kfree\x00', r1, 0x0, 0xfffffffffffffffd}, 0x18) r2 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400), 0x121201, 0x0) ioctl$IMADDTIMER(r2, 0x80044940, &(0x7f0000000600)=0x14) unshare(0x62040200) close(r2) 534.824709ms ago: executing program 2 (id=187): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0xd, 0x8f, 0xd, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0x3, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffe00, {0x0, 0x0, 0x0, r7, {0x8}, {0xffff}, {0xfff2, 0xffe1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x45, 0x1, {0xe, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x6, 0x1, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x5, 0x7fff, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x8000, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0x2, 0x5, 0x2, 0xfff5, 0x4, 0x8, 0x7, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0xfffffffffffffe8f, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffe00, {0x0, 0x0, 0x0, r10, {0x4}, {0xffff}, {0xb, 0xffe1}}}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x8020) 458.639451ms ago: executing program 1 (id=188): socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'ip6tnl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x2e, 0x100008, 0x0, 0x8, 0xf, 0x3, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x4000000, 0x0, 0xff, 0x0, 0xfffffeff}}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@empty, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x2, 0x6, 0x2, 0x0, 0x2, 0x0, 0x2}, 0x10}}, 0x0) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e20, 0xffffffff, @empty, 0x5}, 0x1c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x24, 0x29, 0xa19702d202eff97b, 0x4001, 0xfff7fdfc, {0x0, 0x0, 0x0, r4, {0xb}, {0xffff}, {0x4, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) 218.954817ms ago: executing program 4 (id=189): r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0x2) r1 = socket$key(0xf, 0x3, 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r2}, 0x18) r3 = dup3(r0, r1, 0x0) ioctl$SG_SET_RESERVED_SIZE(r3, 0x4004550c, 0x0) 218.61566ms ago: executing program 0 (id=190): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001500)=@newtfilter={0x47c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x2, 0xb}}]}}, @filter_kind_options=@f_flow={{0x9}, {0x428, 0x2, [@TCA_FLOW_ACT={0xb0, 0x9, 0x0, 0x1, [@m_gact={0xac, 0x17, 0x0, 0x0, {{0x9}, {0x70, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x7fffffff, 0x7, 0x3, 0x1ff, 0x10000}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0x128d, 0x6}}, @TCA_GACT_PARMS={0x18, 0x2, {0xf14, 0x400, 0x153e841be6a0b7be, 0xc, 0x6}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0x1330, 0xa235c90a424ce1d0}}, @TCA_GACT_PROB={0xc, 0x3, {0x0, 0x1db2, 0x8}}, @TCA_GACT_PROB={0x0, 0x3, {0x2, 0x1088}}]}, {0x12, 0x6, "dd484889c49a90f72be5bacdbff5"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_FLOW_ADDEND={0x8, 0x5, 0xffffffff}, @TCA_FLOW_EMATCHES={0x364, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x577}}, @TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0xc000, 0x3, 0x9}, {0xfffffffb, 0xfffffff8, 0xffffffff, 0xc0000}}}]}, @TCA_EMATCH_TREE_LIST={0x44, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x14, 0x3, 0x0, 0x0, {{0x7, 0x2, 0x8f}, {0x6, 0x3, 0x3, "5d23cb"}}}, @TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x57, 0x1, 0xc}, {0xc, 0x0, 0x6, 0x2, 0xc, 0x0, 0x1}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0x4800}, {{0x2, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x0, 0x1}}}}]}, @TCA_EMATCH_TREE_LIST={0xb4, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x3, 0x0, 0x0, {{0x40, 0x2, 0x40}, {0xffff}}}, @TCF_EM_CONTAINER={0x38, 0x3, 0x0, 0x0, {{0x81, 0x0, 0x100}, "703b0f31ff2a6cafa4db6625fefc86f2fb3f18767eebce46b772652b96d3d99fa630e7830f5e7db319dfc9d6"}}, @TCF_EM_IPT={0xc, 0x3, 0x0, 0x0, {{0x2a66, 0x9, 0x8}}}, @TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x40, 0x7, 0x7}, {{0x3, 0x1}, {0x4, 0x1, 0x1}}}}, @TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0xcc9, 0x7, 0x1}, {{0x2, 0x0, 0x0, 0x1}, {0x0, 0x1, 0x0, 0x1}}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x3, 0x1, 0x81}, {0x8001, 0x20001b, 0x6, 0x7, 0x6, 0x0, 0x2}}}, @TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0x3, 0x3, 0x3}, {0x1, 0x455a, 0xffffffff, 0x7}}}]}, @TCA_EMATCH_TREE_LIST={0x134, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0x18, 0x1, 0x0, 0x0, {{0x10, 0x0, 0x9}, "d6a7e54ac780db66a159"}}, @TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0x400, 0x3, 0xef1}, {0x5, 0x70, 0x6, 0x206f}}}, @TCF_EM_IPT={0x80, 0x2, 0x0, 0x0, {{0x6, 0x9, 0x1}, [@TCA_EM_IPT_MATCH_DATA={0x4b, 0x5, "659de6dcda8831fe936b8722ab2d4cca4a3fb313fb4ad54899e1b0326714d6ce83853542fd4a1818018da64925f89da90719562a1e8c9bd577b07b82ae52a71e46cd695ec5ba1b"}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_HOOK={0x8, 0x1, 0x4}, @TCA_EM_IPT_HOOK={0x8, 0x1, 0x1}]}}, @TCF_EM_NBYTE={0x14, 0x3, 0x0, 0x0, {{0x8, 0x2, 0x6}, {0x0, 0x4, 0x0, "74e484e5"}}}, @TCF_EM_META={0x24, 0x2, 0x0, 0x0, {{0x9, 0x4, 0x1000}, [@TCA_EM_META_LVALUE={0x0, 0x2, [@TCF_META_TYPE_VAR="104c8137ce", @TCF_META_TYPE_VAR, @TCF_META_TYPE_INT=0x8, @TCF_META_TYPE_INT=0x5]}, @TCA_EM_META_HDR={0xc, 0x1, {{0xd, 0x4, 0x2}, {0xc1e5, 0x1, 0x2}}}]}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x9, 0x3, 0x81}, {0x38, 0x6, 0xdb, 0xdea5}}}, @TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0xfca7, 0x7, 0x533}, {{0x0, 0x1, 0x1, 0x1}, {0x0, 0x1}}}}, @TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x1ff, 0x7, 0x8001}, {{0x3, 0x1, 0x0, 0x1}, {0x2, 0x0, 0x1, 0x1}}}}]}, @TCA_EMATCH_TREE_LIST={0x40, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x14, 0x2, 0x0, 0x0, {{0x401, 0x9, 0x1}, [@TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0xf}]}}, @TCF_EM_IPSET={0x10, 0x1, 0x0, 0x0, {{0x401, 0x8, 0xfffd}, {0x1, 0x4, 0x1}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x2, 0x1, 0x3}, {0x3, 0x9, 0x6, 0x5, 0x2, 0x1}}}]}, @TCA_EMATCH_TREE_LIST={0xc4, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0x44, 0x2, 0x0, 0x0, {{0x9f93}, "9426c9058a6ecc068883da8b9ee826ed10b0e36c47f3b273d06fff696fe2126382a4fd984ef391601764a093311532edab4ed5eafc6698"}}, @TCF_EM_CONTAINER={0x34, 0x1, 0x0, 0x0, {{0xf}, "d07d3c4df19ec28a37b542b0eb9e76d1488601726f03dfea6f44a0ebde665e861899e46f5e2b"}}, @TCF_EM_U32={0xb, 0x1, 0x0, 0x0, {{0x3c9}, {0xffffad69, 0x3, 0x9}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0xdb, 0x1, 0x7}, {0x0, 0x101, 0x80, 0x2, 0x0, 0x1, 0x1}}}, @TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0x8000, 0x7, 0x7}, {{0x3, 0x0, 0x1}, {0x1}}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x3}}]}, @TCA_FLOW_XOR={0x8}]}}, @TCA_CHAIN={0x8, 0xb, 0x1}]}, 0x47c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 206.806027ms ago: executing program 2 (id=191): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000008000000004"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000008000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000010000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41002, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x18) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1a3a700080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000010007b0000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 8.288635ms ago: executing program 2 (id=192): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x142ba3) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x8a883, 0x2) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74dc2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x9]}}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 0s ago: executing program 1 (id=193): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x43c, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0xffff, 0x8}}, [@filter_kind_options=@f_flow={{0x9}, {0x40c, 0x2, [@TCA_FLOW_POLICE={0x408, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x81, 0xffffffff, 0xda, 0x3, 0x0, 0x2a, 0x100, 0x73d, 0x3509, 0x3, 0x10000, 0x7, 0x1000, 0x8, 0x3, 0x3, 0x882e, 0x8, 0x6, 0x4, 0x9, 0xfffffffb, 0x2, 0x6, 0x80000000, 0x3fc, 0x9, 0xffff, 0x7a, 0x5, 0x7, 0x7fff, 0xffffff40, 0x9, 0x6, 0x8, 0x2, 0x57, 0x0, 0x4, 0x7fff, 0x9, 0xfffffffb, 0x2, 0xcf9f, 0x0, 0x1, 0x8, 0x1, 0x5, 0xfffffff9, 0x20d5, 0x80000001, 0x6, 0x4, 0x9, 0x8, 0xfffffffd, 0x5, 0x7, 0xc, 0x8, 0x4, 0x3, 0xfffffffe, 0x7, 0x3, 0x800, 0x1, 0x4, 0x2, 0x1, 0x1, 0x801e, 0x7, 0x1, 0x0, 0x8, 0x5, 0x8001, 0x4, 0x1, 0xfff, 0x9, 0x3, 0x7ff, 0xd0, 0x8, 0x0, 0x3, 0x1, 0x9, 0xe, 0x7fff, 0xfffffff8, 0x4, 0x0, 0xb1, 0x3, 0xffffff44, 0x1, 0x8, 0x200, 0x6, 0x556, 0x1, 0x2c, 0x5, 0x80000001, 0x1, 0x0, 0xffffff00, 0x3, 0x2, 0x7, 0x9, 0x1c00, 0x5, 0xa2, 0x3, 0x8, 0x0, 0x5, 0x8001, 0xbfffffff, 0x7, 0x80, 0x7, 0x0, 0x743, 0x5, 0x3, 0x7, 0x200, 0xd06, 0x0, 0x8, 0x3, 0x100, 0x2, 0x8, 0x1, 0x1, 0x8, 0xa, 0x7, 0x6, 0x4, 0x7ff, 0xfe, 0xfffffffe, 0x7, 0xf80, 0x7, 0x5a, 0x2302, 0xffff, 0x3ff, 0x2, 0x5, 0x1, 0x6, 0x3, 0x401, 0x10001, 0x512d, 0x1, 0xe, 0x8, 0xa3c0, 0x4, 0x8000, 0x10001, 0x15a, 0x6, 0x120000, 0x6b2, 0x7fffffff, 0x7, 0x9, 0x80000004, 0x5, 0x7e9, 0x48, 0x9, 0x3, 0x0, 0x5, 0x6, 0xf, 0xff, 0xd, 0x6, 0x9, 0x0, 0x200, 0x9, 0xff, 0x4, 0x7, 0x7, 0x8, 0x80000000, 0x56, 0x4a82, 0xffff0000, 0x7ff, 0x3e1, 0x6, 0x80000000, 0x4c0, 0x2, 0xa, 0x6, 0x2, 0x6, 0x8, 0x8000048, 0x1a, 0x2000000, 0x1ff, 0x844, 0x6, 0x3ff, 0x2, 0x100, 0x6, 0xffffffff, 0x200, 0xc26, 0x4, 0x5, 0x1, 0x7fff, 0xf, 0x401, 0x401, 0x4, 0x7, 0x3565, 0x2, 0x4, 0xebf, 0x9, 0x1000, 0x1, 0x71f, 0x2, 0x7, 0x6e8, 0x8, 0x0, 0x80000000, 0x1, 0x9, 0x2]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x1}, 0x800) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r2, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700000000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) r3 = socket$kcm(0x10, 0x2, 0x4) close(r3) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000780)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea6f464160af36514001ac00800020004000200060000000364bc24eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.25' (ED25519) to the list of known hosts. [ 66.292518][ T5815] cgroup: Unknown subsys name 'net' [ 66.468231][ T5815] cgroup: Unknown subsys name 'cpuset' [ 66.476863][ T5815] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 67.867703][ T5815] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 69.903580][ T5828] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 69.912114][ T5828] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 69.923512][ T5830] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 69.931428][ T5830] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 69.940213][ T5830] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 69.941062][ T5832] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 69.948265][ T5830] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 69.957255][ T5832] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 69.963868][ T5830] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 69.970507][ T5832] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 69.976911][ T5830] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 69.987755][ T5832] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 69.990881][ T5830] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 70.006463][ T5830] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 70.007087][ T5832] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 70.027904][ T5830] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 70.036208][ T5830] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 70.043927][ T5830] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 70.052684][ T5830] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 70.071759][ T5830] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 70.131927][ T5832] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 70.140606][ T5832] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 70.149402][ T5832] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 70.158563][ T5832] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 70.167394][ T5832] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 70.654523][ T5837] chnl_net:caif_netlink_parms(): no params data found [ 70.840732][ T5840] chnl_net:caif_netlink_parms(): no params data found [ 70.898028][ T5844] chnl_net:caif_netlink_parms(): no params data found [ 70.910609][ T5839] chnl_net:caif_netlink_parms(): no params data found [ 71.066303][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.073522][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.081882][ T5837] bridge_slave_0: entered allmulticast mode [ 71.089149][ T5837] bridge_slave_0: entered promiscuous mode [ 71.120170][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.127432][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.134614][ T5837] bridge_slave_1: entered allmulticast mode [ 71.142362][ T5837] bridge_slave_1: entered promiscuous mode [ 71.154207][ T5838] chnl_net:caif_netlink_parms(): no params data found [ 71.206723][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.213919][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.221509][ T5840] bridge_slave_0: entered allmulticast mode [ 71.228799][ T5840] bridge_slave_0: entered promiscuous mode [ 71.276597][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.283834][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.291102][ T5840] bridge_slave_1: entered allmulticast mode [ 71.298152][ T5840] bridge_slave_1: entered promiscuous mode [ 71.308737][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.362351][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.372324][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.379682][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.387349][ T5844] bridge_slave_0: entered allmulticast mode [ 71.394246][ T5844] bridge_slave_0: entered promiscuous mode [ 71.406222][ T5839] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.413385][ T5839] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.420918][ T5839] bridge_slave_0: entered allmulticast mode [ 71.427998][ T5839] bridge_slave_0: entered promiscuous mode [ 71.459711][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.466301][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.473715][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.481247][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.488646][ T5844] bridge_slave_1: entered allmulticast mode [ 71.495974][ T5844] bridge_slave_1: entered promiscuous mode [ 71.507680][ T5839] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.515229][ T5839] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.522390][ T5839] bridge_slave_1: entered allmulticast mode [ 71.529520][ T5839] bridge_slave_1: entered promiscuous mode [ 71.539166][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.585026][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.595982][ T5837] team0: Port device team_slave_0 added [ 71.643605][ T5837] team0: Port device team_slave_1 added [ 71.651724][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.674285][ T5839] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.704465][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.714250][ T5838] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.721591][ T5838] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.729252][ T5838] bridge_slave_0: entered allmulticast mode [ 71.736305][ T5838] bridge_slave_0: entered promiscuous mode [ 71.745447][ T5839] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.756426][ T5840] team0: Port device team_slave_0 added [ 71.782188][ T5838] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.789706][ T5838] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.797059][ T5838] bridge_slave_1: entered allmulticast mode [ 71.804059][ T5838] bridge_slave_1: entered promiscuous mode [ 71.823431][ T5840] team0: Port device team_slave_1 added [ 71.829708][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.836793][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.863393][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.912317][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.919618][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.946066][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.959055][ T5844] team0: Port device team_slave_0 added [ 71.977396][ T5839] team0: Port device team_slave_0 added [ 72.001013][ T5844] team0: Port device team_slave_1 added [ 72.008926][ T5838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.020373][ T5839] team0: Port device team_slave_1 added [ 72.027014][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.034048][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.060445][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.084217][ T5838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.095945][ T5832] Bluetooth: hci3: command tx timeout [ 72.096204][ T5828] Bluetooth: hci0: command tx timeout [ 72.107442][ T5826] Bluetooth: hci1: command tx timeout [ 72.113973][ T5830] Bluetooth: hci2: command tx timeout [ 72.124303][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.131569][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.158438][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.219878][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.227319][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.253871][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.264657][ T5830] Bluetooth: hci4: command tx timeout [ 72.279043][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.286252][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.312401][ T5839] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.324693][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.331739][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.358185][ T5839] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.380371][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.387423][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.413483][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.426067][ T5838] team0: Port device team_slave_0 added [ 72.434409][ T5838] team0: Port device team_slave_1 added [ 72.457988][ T5837] hsr_slave_0: entered promiscuous mode [ 72.465298][ T5837] hsr_slave_1: entered promiscuous mode [ 72.512705][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.520158][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.546239][ T5838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.574716][ T5840] hsr_slave_0: entered promiscuous mode [ 72.581649][ T5840] hsr_slave_1: entered promiscuous mode [ 72.587985][ T5840] debugfs: 'hsr0' already exists in 'hsr' [ 72.594132][ T5840] Cannot create hsr debugfs directory [ 72.600745][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.608243][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.634286][ T5838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.708228][ T5839] hsr_slave_0: entered promiscuous mode [ 72.714504][ T5839] hsr_slave_1: entered promiscuous mode [ 72.721061][ T5839] debugfs: 'hsr0' already exists in 'hsr' [ 72.727036][ T5839] Cannot create hsr debugfs directory [ 72.750390][ T5844] hsr_slave_0: entered promiscuous mode [ 72.756732][ T5844] hsr_slave_1: entered promiscuous mode [ 72.762805][ T5844] debugfs: 'hsr0' already exists in 'hsr' [ 72.768665][ T5844] Cannot create hsr debugfs directory [ 72.887875][ T5838] hsr_slave_0: entered promiscuous mode [ 72.894167][ T5838] hsr_slave_1: entered promiscuous mode [ 72.904138][ T5838] debugfs: 'hsr0' already exists in 'hsr' [ 72.910678][ T5838] Cannot create hsr debugfs directory [ 73.289514][ T5837] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 73.305228][ T5837] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 73.316531][ T5837] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 73.335887][ T5837] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 73.398225][ T5839] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 73.410805][ T5839] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 73.434066][ T5839] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 73.445471][ T5839] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 73.502123][ T5840] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 73.520750][ T5840] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 73.533176][ T5840] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 73.543656][ T5840] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 73.638342][ T5844] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 73.651166][ T5844] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 73.661897][ T5844] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 73.681465][ T5844] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 73.764316][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.809154][ T5838] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 73.821769][ T5838] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 73.833510][ T5838] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 73.851955][ T5838] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 73.870763][ T5837] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.909328][ T3014] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.916630][ T3014] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.954050][ T3014] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.961190][ T3014] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.029570][ T5839] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.081896][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.120362][ T5839] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.153434][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.161119][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.175373][ T5826] Bluetooth: hci1: command tx timeout [ 74.175468][ T5832] Bluetooth: hci3: command tx timeout [ 74.180933][ T5830] Bluetooth: hci2: command tx timeout [ 74.187520][ T5828] Bluetooth: hci0: command tx timeout [ 74.200869][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.222822][ T3014] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.230299][ T3014] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.239871][ T5840] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.259801][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.266930][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.283805][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.297974][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.321218][ T1531] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.328345][ T1531] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.336010][ T5828] Bluetooth: hci4: command tx timeout [ 74.339564][ T1531] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.348611][ T1531] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.359377][ T5838] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.374577][ T1531] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.381760][ T1531] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.454187][ T5838] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.501592][ T3014] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.508819][ T3014] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.543917][ T3549] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.551311][ T3549] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.588404][ T5837] veth0_vlan: entered promiscuous mode [ 74.629016][ T5839] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.651035][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.660096][ T5837] veth1_vlan: entered promiscuous mode [ 74.682519][ T5838] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 74.703225][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.780667][ T5839] veth0_vlan: entered promiscuous mode [ 74.816658][ T5839] veth1_vlan: entered promiscuous mode [ 74.827564][ T5840] veth0_vlan: entered promiscuous mode [ 74.838784][ T5838] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.849932][ T5837] veth0_macvtap: entered promiscuous mode [ 74.876820][ T5840] veth1_vlan: entered promiscuous mode [ 74.884463][ T5844] veth0_vlan: entered promiscuous mode [ 74.893474][ T5837] veth1_macvtap: entered promiscuous mode [ 74.934104][ T5844] veth1_vlan: entered promiscuous mode [ 74.963549][ T5839] veth0_macvtap: entered promiscuous mode [ 74.972371][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.999714][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.008344][ T5840] veth0_macvtap: entered promiscuous mode [ 75.018802][ T5839] veth1_macvtap: entered promiscuous mode [ 75.043400][ T3549] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.053356][ T3549] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.063006][ T3549] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.076134][ T5840] veth1_macvtap: entered promiscuous mode [ 75.086154][ T3549] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.113827][ T5838] veth0_vlan: entered promiscuous mode [ 75.127282][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.151485][ T5844] veth0_macvtap: entered promiscuous mode [ 75.163007][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.179360][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.192289][ T5844] veth1_macvtap: entered promiscuous mode [ 75.228095][ T5838] veth1_vlan: entered promiscuous mode [ 75.241210][ T3014] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.265877][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.275986][ T3014] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.297493][ T3014] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.306825][ T3014] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.333719][ T3014] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.342914][ T3014] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.357762][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.366669][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.377630][ T3014] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.392328][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.408821][ T3014] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.434777][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.501849][ T3014] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.511614][ T3014] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.522313][ T3549] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.531016][ T3549] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.564594][ T3014] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.588771][ T3014] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.589917][ T3488] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.603709][ T5838] veth0_macvtap: entered promiscuous mode [ 75.618296][ T5838] veth1_macvtap: entered promiscuous mode [ 75.624371][ T3488] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.669290][ T5837] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 75.710266][ T1531] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.722045][ T1531] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.798783][ T1531] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.814160][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.814373][ T1531] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.868515][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.918893][ T3014] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.939135][ T3014] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.948542][ T3488] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.965001][ T3488] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.974326][ T3488] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.001025][ T3014] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.029819][ T3014] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.056712][ T3488] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.176188][ T3014] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.212352][ T3014] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.256292][ T5828] Bluetooth: hci2: command tx timeout [ 76.256712][ T5830] Bluetooth: hci1: command tx timeout [ 76.261868][ T5832] Bluetooth: hci0: command tx timeout [ 76.261903][ T5832] Bluetooth: hci3: command tx timeout [ 76.349354][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.392273][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.415432][ T5832] Bluetooth: hci4: command tx timeout [ 76.549236][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.583642][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.845370][ T5895] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 77.005025][ T5895] usb 2-1: device descriptor read/64, error -71 [ 77.076862][ T5942] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11'. [ 77.254928][ T5895] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 77.405694][ T5895] usb 2-1: device descriptor read/64, error -71 [ 77.502524][ T5960] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17'. [ 77.529409][ T5895] usb usb2-port1: attempt power cycle [ 77.614072][ T5960] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17'. [ 77.614093][ T144] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 77.711158][ T144] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 77.744075][ T144] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 77.744156][ T5960] Zero length message leads to an empty skb [ 77.779575][ T144] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 77.905212][ T5895] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 77.956288][ T5895] usb 2-1: device descriptor read/8, error -71 [ 78.226630][ T5895] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 78.281199][ T5895] usb 2-1: device descriptor read/8, error -71 [ 78.335224][ T5832] Bluetooth: hci3: command tx timeout [ 78.340658][ T5832] Bluetooth: hci1: command tx timeout [ 78.344462][ T5830] Bluetooth: hci2: command tx timeout [ 78.353015][ T5826] Bluetooth: hci0: command tx timeout [ 78.405281][ T5895] usb usb2-port1: unable to enumerate USB device [ 78.495210][ T5826] Bluetooth: hci4: command tx timeout [ 78.640395][ T6009] --map-set only usable from mangle table [ 78.747845][ T6013] program syz.2.40 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 79.548442][ T30] audit: type=1326 audit(1766846487.821:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6041 comm="syz.0.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff3b738f749 code=0x7ffc0000 [ 79.672175][ T30] audit: type=1326 audit(1766846487.851:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6041 comm="syz.0.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff3b738f749 code=0x7ffc0000 [ 79.754969][ T30] audit: type=1326 audit(1766846487.851:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6041 comm="syz.0.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff3b738f749 code=0x7ffc0000 [ 79.814691][ T6051] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 79.855245][ T30] audit: type=1326 audit(1766846487.851:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6041 comm="syz.0.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff3b738f749 code=0x7ffc0000 [ 79.943976][ T30] audit: type=1326 audit(1766846487.851:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6041 comm="syz.0.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff3b738f749 code=0x7ffc0000 [ 80.014677][ T30] audit: type=1326 audit(1766846487.851:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6041 comm="syz.0.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff3b738f749 code=0x7ffc0000 [ 80.105445][ T30] audit: type=1326 audit(1766846487.851:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6041 comm="syz.0.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff3b738f749 code=0x7ffc0000 [ 80.191760][ T30] audit: type=1326 audit(1766846487.851:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6041 comm="syz.0.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff3b738f749 code=0x7ffc0000 [ 80.254949][ T30] audit: type=1326 audit(1766846487.851:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6041 comm="syz.0.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff3b738f749 code=0x7ffc0000 [ 80.324743][ T30] audit: type=1326 audit(1766846487.851:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6041 comm="syz.0.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff3b738f749 code=0x7ffc0000 [ 80.631296][ T6081] process 'syz.2.73' launched '/dev/fd/4' with NULL argv: empty string added [ 82.164460][ T6136] netlink: 'syz.3.99': attribute type 3 has an invalid length. [ 82.404008][ T6146] IPv6: Can't replace route, no match found [ 82.641035][ T795] IPVS: starting estimator thread 0... [ 82.647234][ T6153] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 82.755006][ T6155] IPVS: using max 39 ests per chain, 93600 per kthread [ 83.137677][ T6174] IPv6: Can't replace route, no match found [ 83.694028][ T6161] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 83.711485][ T6161] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 83.743830][ T6161] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 83.772292][ T6161] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 83.791697][ T6161] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 83.846169][ T6161] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 83.871966][ T6161] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 83.886056][ T6161] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 83.919513][ T6161] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 83.937551][ T6197] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 83.955316][ T6161] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 83.979562][ T6161] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 84.006735][ T6161] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 84.028311][ T6161] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 84.034516][ T6161] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 84.065534][ T6161] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 84.892779][ T30] kauditd_printk_skb: 63 callbacks suppressed [ 84.892796][ T30] audit: type=1326 audit(1766846493.161:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6234 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab2938f749 code=0x7ffc0000 [ 84.927108][ T30] audit: type=1326 audit(1766846493.161:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6234 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab2938f749 code=0x7ffc0000 [ 84.970358][ T30] audit: type=1326 audit(1766846493.161:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6234 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=117 compat=0 ip=0x7fab2938f749 code=0x7ffc0000 [ 84.997023][ T30] audit: type=1326 audit(1766846493.161:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6234 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab2938f749 code=0x7ffc0000 [ 85.019315][ T5826] Bluetooth: hci0: command 0x0c1a tx timeout [ 85.078380][ T30] audit: type=1326 audit(1766846493.161:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6234 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab2938f749 code=0x7ffc0000 [ 85.786515][ T5826] Bluetooth: hci1: command 0x0c1a tx timeout [ 85.935283][ T5826] Bluetooth: hci2: command 0x0c1a tx timeout [ 86.015002][ T5826] Bluetooth: hci3: command 0x0c1a tx timeout [ 86.104952][ T5826] Bluetooth: hci4: command 0x0c1a tx timeout [ 86.703811][ T6308] usb usb1: usbfs: interface 0 claimed by hub while 'syz.2.170' sets config #1 [ 86.848607][ T9] cfg80211: failed to load regulatory.db [ 86.929468][ T6319] netlink: 4 bytes leftover after parsing attributes in process `syz.4.174'. [ 87.054982][ T5826] Bluetooth: hci0: command 0x0c1a tx timeout [ 87.465871][ T6343] netlink: 8 bytes leftover after parsing attributes in process `syz.1.185'. [ 87.614703][ T6347] netlink: 16 bytes leftover after parsing attributes in process `syz.2.187'. [ 87.644891][ T6347] netlink: 16 bytes leftover after parsing attributes in process `syz.2.187'. [ 87.856419][ T5826] Bluetooth: hci1: command 0x0c1a tx timeout [ 87.944412][ T6355] netlink: 28 bytes leftover after parsing attributes in process `syz.2.191'. [ 88.017751][ T5826] Bluetooth: hci2: command 0x0c1a tx timeout [ 88.107149][ T6359] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.107599][ T5826] Bluetooth: hci3: command 0x0c1a tx timeout [ 88.115479][ T6359] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.153298][ T6357] [ 88.155783][ T6357] ====================================================== [ 88.163148][ T6357] WARNING: possible circular locking dependency detected [ 88.170190][ T6357] syzkaller #0 Not tainted [ 88.174683][ T6357] ------------------------------------------------------ [ 88.181864][ T6357] syz.2.192/6357 is trying to acquire lock: [ 88.187834][ T6357] ffff88801bef0220 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_iop_getattr+0x9e/0x450 [ 88.194998][ T5826] Bluetooth: hci4: command 0x0c1a tx timeout [ 88.198818][ T6357] [ 88.198818][ T6357] but task is already holding lock: [ 88.198828][ T6357] ffff888141785fb0 (&q->q_usage_counter(io)#24){++++}-{0:0}, at: lo_ioctl+0x1604/0x1c50 [ 88.221925][ T6357] [ 88.221925][ T6357] which lock already depends on the new lock. [ 88.221925][ T6357] [ 88.232669][ T6357] [ 88.232669][ T6357] the existing dependency chain (in reverse order) is: [ 88.241684][ T6357] [ 88.241684][ T6357] -> #2 (&q->q_usage_counter(io)#24){++++}-{0:0}: [ 88.250587][ T6357] blk_alloc_queue+0x52f/0x610 [ 88.255869][ T6357] __blk_mq_alloc_disk+0x15c/0x340 [ 88.258080][ T6363] netlink: 8 bytes leftover after parsing attributes in process `syz.0.190'. [ 88.261501][ T6357] loop_add+0x411/0xad0 [ 88.261528][ T6357] loop_init+0xd9/0x170 [ 88.279614][ T6357] do_one_initcall+0x1f1/0x800 [ 88.284986][ T6357] do_initcall_level+0x104/0x190 [ 88.290444][ T6357] do_initcalls+0x59/0xa0 [ 88.295319][ T6357] kernel_init_freeable+0x2a7/0x3d0 [ 88.301130][ T6357] kernel_init+0x1d/0x1d0 [ 88.306082][ T6357] ret_from_fork+0x510/0xa50 [ 88.311211][ T6357] ret_from_fork_asm+0x1a/0x30 [ 88.317288][ T6357] [ 88.317288][ T6357] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 88.324498][ T6357] fs_reclaim_acquire+0x72/0x100 [ 88.329966][ T6357] kmem_cache_alloc_noprof+0x45/0x710 [ 88.335864][ T6357] __kernfs_iattrs+0xd9/0x320 [ 88.341323][ T6357] kernfs_iop_setattr+0xea/0x3f0 [ 88.346808][ T6357] notify_change+0xc1a/0xf40 [ 88.351939][ T6357] do_truncate+0x1a4/0x220 [ 88.356901][ T6357] path_openat+0x359d/0x3dd0 [ 88.362110][ T6357] do_filp_open+0x1fa/0x410 [ 88.367164][ T6357] do_sys_openat2+0x121/0x200 [ 88.372359][ T6357] __x64_sys_openat+0x138/0x170 [ 88.377727][ T6357] do_syscall_64+0xec/0xf80 [ 88.382743][ T6357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.389142][ T6357] [ 88.389142][ T6357] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 88.397644][ T6357] __lock_acquire+0x15a6/0x2cf0 [ 88.403011][ T6357] lock_acquire+0x107/0x340 [ 88.408021][ T6357] down_read+0x47/0x2e0 [ 88.412777][ T6357] kernfs_iop_getattr+0x9e/0x450 [ 88.418221][ T6357] vfs_getattr_nosec+0x2e1/0x430 [ 88.423840][ T6357] loop_assign_backing_file+0x222/0x400 [ 88.430470][ T6357] lo_ioctl+0x167f/0x1c50 [ 88.435339][ T6357] blkdev_ioctl+0x60e/0x710 [ 88.440368][ T6357] __se_sys_ioctl+0xfc/0x170 [ 88.445478][ T6357] do_syscall_64+0xec/0xf80 [ 88.450580][ T6357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.457070][ T6357] [ 88.457070][ T6357] other info that might help us debug this: [ 88.457070][ T6357] [ 88.467379][ T6357] Chain exists of: [ 88.467379][ T6357] &root->kernfs_iattr_rwsem --> fs_reclaim --> &q->q_usage_counter(io)#24 [ 88.467379][ T6357] [ 88.481898][ T6357] Possible unsafe locking scenario: [ 88.481898][ T6357] [ 88.489347][ T6357] CPU0 CPU1 [ 88.494794][ T6357] ---- ---- [ 88.500160][ T6357] lock(&q->q_usage_counter(io)#24); [ 88.505539][ T6357] lock(fs_reclaim); [ 88.512120][ T6357] lock(&q->q_usage_counter(io)#24); [ 88.520196][ T6357] rlock(&root->kernfs_iattr_rwsem); [ 88.525570][ T6357] [ 88.525570][ T6357] *** DEADLOCK *** [ 88.525570][ T6357] [ 88.534042][ T6357] 3 locks held by syz.2.192/6357: [ 88.539045][ T6357] #0: ffff8881417c1448 (&lo->lo_mutex){+.+.}-{4:4}, at: lo_ioctl+0x11e4/0x1c50 [ 88.548453][ T6357] #1: ffff888141785fb0 (&q->q_usage_counter(io)#24){++++}-{0:0}, at: lo_ioctl+0x1604/0x1c50 [ 88.558890][ T6357] #2: ffff888141785fe8 (&q->q_usage_counter(queue)#8){+.+.}-{0:0}, at: lo_ioctl+0x1604/0x1c50 [ 88.569499][ T6357] [ 88.569499][ T6357] stack backtrace: [ 88.575479][ T6357] CPU: 0 UID: 0 PID: 6357 Comm: syz.2.192 Not tainted syzkaller #0 PREEMPT(full) [ 88.575496][ T6357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 88.575511][ T6357] Call Trace: [ 88.575519][ T6357] [ 88.575526][ T6357] dump_stack_lvl+0xe8/0x150 [ 88.575548][ T6357] print_circular_bug+0x2e2/0x300 [ 88.575567][ T6357] check_noncircular+0x12e/0x150 [ 88.575584][ T6357] __lock_acquire+0x15a6/0x2cf0 [ 88.575599][ T6357] ? tomoyo_path_perm+0x1e3/0x4b0 [ 88.575618][ T6357] ? kernfs_iop_getattr+0x9e/0x450 [ 88.575632][ T6357] lock_acquire+0x107/0x340 [ 88.575644][ T6357] ? kernfs_iop_getattr+0x9e/0x450 [ 88.575661][ T6357] down_read+0x47/0x2e0 [ 88.575677][ T6357] ? kernfs_iop_getattr+0x9e/0x450 [ 88.575691][ T6357] kernfs_iop_getattr+0x9e/0x450 [ 88.575706][ T6357] vfs_getattr_nosec+0x2e1/0x430 [ 88.575724][ T6357] loop_assign_backing_file+0x222/0x400 [ 88.575742][ T6357] ? __pfx_loop_assign_backing_file+0x10/0x10 [ 88.575769][ T6357] lo_ioctl+0x167f/0x1c50 [ 88.575787][ T6357] ? __pfx_lo_ioctl+0x10/0x10 [ 88.575803][ T6357] ? __rb_erase_color+0x63d/0xa70 [ 88.575815][ T6357] ? __pfx_min_vruntime_cb_rotate+0x10/0x10 [ 88.575838][ T6357] ? __lock_acquire+0x6b6/0x2cf0 [ 88.575853][ T6357] ? __lock_acquire+0x6b6/0x2cf0 [ 88.575867][ T6357] ? __lock_acquire+0x6b6/0x2cf0 [ 88.575886][ T6357] ? __lock_acquire+0x6b6/0x2cf0 [ 88.575900][ T6357] ? __lock_acquire+0x6b6/0x2cf0 [ 88.575913][ T6357] ? __lock_acquire+0x6b6/0x2cf0 [ 88.575928][ T6357] ? unwind_next_frame+0xa5/0x23d0 [ 88.575946][ T6357] ? unwind_next_frame+0xa5/0x23d0 [ 88.575962][ T6357] ? is_bpf_text_address+0x26/0x2b0 [ 88.575985][ T6357] ? is_bpf_text_address+0x26/0x2b0 [ 88.576005][ T6357] ? is_bpf_text_address+0x292/0x2b0 [ 88.576023][ T6357] ? is_bpf_text_address+0x26/0x2b0 [ 88.576043][ T6357] ? kernel_text_address+0xa5/0xe0 [ 88.576062][ T6357] ? __kernel_text_address+0xd/0x40 [ 88.576079][ T6357] ? unwind_get_return_address+0x4d/0x90 [ 88.576094][ T6357] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 88.576114][ T6357] ? arch_stack_walk+0xfc/0x150 [ 88.576133][ T6357] ? stack_trace_save+0x9c/0xe0 [ 88.576151][ T6357] ? __pfx_stack_trace_save+0x10/0x10 [ 88.576170][ T6357] ? stack_depot_save_flags+0x33/0x810 [ 88.576192][ T6357] ? kasan_save_track+0x4f/0x80 [ 88.576205][ T6357] ? kasan_save_track+0x3e/0x80 [ 88.576217][ T6357] ? kasan_save_free_info+0x46/0x50 [ 88.576234][ T6357] ? __kasan_slab_free+0x5c/0x80 [ 88.576247][ T6357] ? kfree+0x1c0/0x660 [ 88.576264][ T6357] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 88.576277][ T6357] ? security_file_ioctl+0xcb/0x2d0 [ 88.576289][ T6357] ? __se_sys_ioctl+0x47/0x170 [ 88.576308][ T6357] ? do_syscall_64+0xec/0xf80 [ 88.576320][ T6357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.576339][ T6357] ? __asan_memset+0x22/0x50 [ 88.576357][ T6357] ? blk_get_meta_cap+0x18c/0x750 [ 88.576375][ T6357] ? __pfx_blk_get_meta_cap+0x10/0x10 [ 88.576395][ T6357] ? blkdev_common_ioctl+0x11d9/0x2c70 [ 88.576413][ T6357] ? kasan_quarantine_put+0xbb/0x1f0 [ 88.576427][ T6357] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 88.576445][ T6357] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 88.576459][ T6357] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 88.576473][ T6357] ? do_vfs_ioctl+0xbe8/0x1430 [ 88.576486][ T6357] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 88.576502][ T6357] ? do_futex+0x333/0x420 [ 88.576520][ T6357] ? __pfx_lo_ioctl+0x10/0x10 [ 88.576535][ T6357] blkdev_ioctl+0x60e/0x710 [ 88.576554][ T6357] ? __pfx_blkdev_ioctl+0x10/0x10 [ 88.576571][ T6357] ? __fget_files+0x2a/0x420 [ 88.576587][ T6357] ? bpf_lsm_file_ioctl+0x9/0x20 [ 88.576602][ T6357] ? __pfx_blkdev_ioctl+0x10/0x10 [ 88.576619][ T6357] __se_sys_ioctl+0xfc/0x170 [ 88.576639][ T6357] do_syscall_64+0xec/0xf80 [ 88.576652][ T6357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.576665][ T6357] ? trace_irq_disable+0x37/0x100 [ 88.576682][ T6357] ? clear_bhb_loop+0x60/0xb0 [ 88.576697][ T6357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.576710][ T6357] RIP: 0033:0x7fcaa4b8f749 [ 88.576728][ T6357] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 88.576739][ T6357] RSP: 002b:00007fcaa5a13038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 88.576754][ T6357] RAX: ffffffffffffffda RBX: 00007fcaa4de5fa0 RCX: 00007fcaa4b8f749 [ 88.576764][ T6357] RDX: 0000000000000004 RSI: 0000000000004c06 RDI: 0000000000000003 [ 88.576773][ T6357] RBP: 00007fcaa4c13f91 R08: 0000000000000000 R09: 0000000000000000 [ 88.576781][ T6357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.576789][ T6357] R13: 00007fcaa4de6038 R14: 00007fcaa4de5fa0 R15: 00007fcaa4f0fa28 [ 88.576804][ T6357] [ 89.134928][ T5826] Bluetooth: hci0: command 0x0c1a tx timeout [ 89.935442][ T5826] Bluetooth: hci1: command 0x0c1a tx timeout [ 90.095213][ T5826] Bluetooth: hci2: command 0x0c1a tx timeout [ 90.174997][ T5826] Bluetooth: hci3: command 0x0c1a tx timeout [ 90.254991][ T5826] Bluetooth: hci4: command 0x0c1a tx timeout