last executing test programs: 1.831034169s ago: executing program 1 (id=2): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$rtc(0x0, 0x1, 0xcc42) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) shutdown(0xffffffffffffffff, 0x0) clock_adjtime(0x7, &(0x7f00000003c0)={0xfffffffffffffff9, 0x2, 0x0, 0x8, 0x4, 0x6, 0xa5a, 0x3, 0x9, 0x2, 0x1, 0x9, 0x9, 0x8, 0x100000000, 0x3, 0x7, 0xa5, 0x6, 0xffffffffffffffff, 0x6, 0xfffffffffffffffc, 0xffffffffffffffc0, 0x2, 0x6, 0x5af}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)}, 0x0) mprotect(&(0x7f00004b0000/0x3000)=nil, 0x3000, 0x1000005) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f00000000c0)={0xfff, 0x9, 0x4, 0x3, 0x6, 0x1, 0xf8b}, 0xc) unshare(0x26020480) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000100)={0x0, 0x0}) r3 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r3, &(0x7f0000000140)={0x18, 0x2, {0xffff, @loopback}}, 0x1e) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0xc0001, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000001c0)=0x15) ioctl$TCSETS(r4, 0x40384708, &(0x7f0000000040)={0x8, 0x1, 0x8, 0x3f, 0xff, "3eccd25569e20900"}) 634.414508ms ago: executing program 4 (id=5): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xcf, 0x8b, 0xed, 0x20, 0xfd9, 0x25, 0x2940, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xca, 0xfb, 0x1a}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000140)=ANY=[@ANYBLOB="071101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000180)={0x1, 0x9, 0x4, &(0x7f0000000100)={0x8, "c6c1f7b51030c4b7c578258facb1ed3ee2dfe17a04bc517b5464b3b94bce47509d"}}) 0s ago: executing program 1 (id=6): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x2f00020b, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7515, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010000000"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2251197285d36a80, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x7, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xb6cb}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.208' (ED25519) to the list of known hosts. [ 354.772363][ T5783] cgroup: Unknown subsys name 'net' [ 354.901855][ T5783] cgroup: Unknown subsys name 'cpuset' [ 354.915574][ T5783] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 360.394226][ T5783] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 365.320523][ T5803] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 365.330708][ T5809] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 365.346821][ T5809] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 365.362933][ T5803] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 365.373020][ T5803] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 365.381425][ T5809] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 365.390147][ T5808] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 365.392630][ T5803] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 365.398356][ T5808] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 365.414292][ T5812] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 365.414482][ T5809] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 365.422567][ T5812] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 365.453503][ T5072] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 365.457355][ T5812] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 365.473475][ T5072] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 365.476720][ T5812] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 365.484524][ T5808] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 365.504706][ T5072] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 365.526380][ T5800] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 365.537468][ T5800] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 365.696946][ T5805] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 365.714474][ T5805] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 365.723393][ T5805] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 365.753779][ T5805] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 365.765939][ T5805] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 366.950641][ T5797] chnl_net:caif_netlink_parms(): no params data found [ 366.990547][ T5796] chnl_net:caif_netlink_parms(): no params data found [ 367.180361][ T5799] chnl_net:caif_netlink_parms(): no params data found [ 367.457814][ T5795] chnl_net:caif_netlink_parms(): no params data found [ 367.553401][ T5813] chnl_net:caif_netlink_parms(): no params data found [ 367.573202][ T5800] Bluetooth: hci3: command tx timeout [ 367.578772][ T5800] Bluetooth: hci1: command tx timeout [ 367.582999][ T5805] Bluetooth: hci0: command tx timeout [ 367.586684][ T5808] Bluetooth: hci2: command tx timeout [ 367.813093][ T5808] Bluetooth: hci4: command tx timeout [ 367.896219][ T5796] bridge0: port 1(bridge_slave_0) entered blocking state [ 367.904314][ T5796] bridge0: port 1(bridge_slave_0) entered disabled state [ 367.911893][ T5796] bridge_slave_0: entered allmulticast mode [ 367.924126][ T5796] bridge_slave_0: entered promiscuous mode [ 368.068802][ T5796] bridge0: port 2(bridge_slave_1) entered blocking state [ 368.079281][ T5796] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.088165][ T5796] bridge_slave_1: entered allmulticast mode [ 368.098992][ T5796] bridge_slave_1: entered promiscuous mode [ 368.139096][ T5797] bridge0: port 1(bridge_slave_0) entered blocking state [ 368.149054][ T5797] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.156911][ T5797] bridge_slave_0: entered allmulticast mode [ 368.165192][ T5797] bridge_slave_0: entered promiscuous mode [ 368.315522][ T5797] bridge0: port 2(bridge_slave_1) entered blocking state [ 368.324457][ T5797] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.331983][ T5797] bridge_slave_1: entered allmulticast mode [ 368.341432][ T5797] bridge_slave_1: entered promiscuous mode [ 368.358432][ T5796] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 368.381826][ T5796] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 368.424002][ T5799] bridge0: port 1(bridge_slave_0) entered blocking state [ 368.431465][ T5799] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.441089][ T5799] bridge_slave_0: entered allmulticast mode [ 368.449585][ T5799] bridge_slave_0: entered promiscuous mode [ 368.551588][ T5799] bridge0: port 2(bridge_slave_1) entered blocking state [ 368.559430][ T5799] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.567006][ T5799] bridge_slave_1: entered allmulticast mode [ 368.575262][ T5799] bridge_slave_1: entered promiscuous mode [ 368.629874][ T5795] bridge0: port 1(bridge_slave_0) entered blocking state [ 368.637335][ T5795] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.645163][ T5795] bridge_slave_0: entered allmulticast mode [ 368.653710][ T5795] bridge_slave_0: entered promiscuous mode [ 368.720414][ T5797] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 368.737503][ T5796] team0: Port device team_slave_0 added [ 368.750349][ T5796] team0: Port device team_slave_1 added [ 368.756748][ T5795] bridge0: port 2(bridge_slave_1) entered blocking state [ 368.764436][ T5795] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.771841][ T5795] bridge_slave_1: entered allmulticast mode [ 368.780422][ T5795] bridge_slave_1: entered promiscuous mode [ 368.797686][ T5813] bridge0: port 1(bridge_slave_0) entered blocking state [ 368.805454][ T5813] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.813175][ T5813] bridge_slave_0: entered allmulticast mode [ 368.822721][ T5813] bridge_slave_0: entered promiscuous mode [ 368.873567][ T5797] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 368.982543][ T5813] bridge0: port 2(bridge_slave_1) entered blocking state [ 368.990035][ T5813] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.997854][ T5813] bridge_slave_1: entered allmulticast mode [ 369.006131][ T5813] bridge_slave_1: entered promiscuous mode [ 369.024837][ T5799] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 369.060494][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 369.067758][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 369.093992][ T5796] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 369.233536][ T5799] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 369.248974][ T5797] team0: Port device team_slave_0 added [ 369.259192][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 369.266742][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 369.294027][ T5796] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 369.314074][ T5795] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 369.331305][ T5813] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 369.374240][ T5797] team0: Port device team_slave_1 added [ 369.405448][ T5795] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 369.422575][ T5813] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 369.556552][ T5799] team0: Port device team_slave_0 added [ 369.587710][ T5797] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 369.594902][ T5797] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 369.621124][ T5797] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 369.653140][ T5808] Bluetooth: hci2: command tx timeout [ 369.658717][ T5808] Bluetooth: hci0: command tx timeout [ 369.665232][ T5072] Bluetooth: hci1: command tx timeout [ 369.670796][ T5072] Bluetooth: hci3: command tx timeout [ 369.696319][ T5799] team0: Port device team_slave_1 added [ 369.725830][ T5797] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 369.733508][ T5797] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 369.760403][ T5797] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 369.779630][ T5795] team0: Port device team_slave_0 added [ 369.793881][ T5813] team0: Port device team_slave_0 added [ 369.837175][ T5796] hsr_slave_0: entered promiscuous mode [ 369.846087][ T5796] hsr_slave_1: entered promiscuous mode [ 369.880473][ T5795] team0: Port device team_slave_1 added [ 369.893158][ T5808] Bluetooth: hci4: command tx timeout [ 369.921152][ T5813] team0: Port device team_slave_1 added [ 369.977688][ T5799] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 369.984904][ T5799] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.011364][ T5799] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 370.110912][ T5799] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 370.118360][ T5799] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.144752][ T5799] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 370.158744][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 370.166282][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.203278][ T5795] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 370.321118][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 370.328469][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.355206][ T5795] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 370.390024][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 370.398169][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.424904][ T5813] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 370.441388][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 370.448731][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.475169][ T5813] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 370.574490][ T5797] hsr_slave_0: entered promiscuous mode [ 370.582602][ T5797] hsr_slave_1: entered promiscuous mode [ 370.590738][ T5797] debugfs: 'hsr0' already exists in 'hsr' [ 370.596696][ T5797] Cannot create hsr debugfs directory [ 370.849422][ T5795] hsr_slave_0: entered promiscuous mode [ 370.857981][ T5795] hsr_slave_1: entered promiscuous mode [ 370.866048][ T5795] debugfs: 'hsr0' already exists in 'hsr' [ 370.871866][ T5795] Cannot create hsr debugfs directory [ 370.890371][ T5799] hsr_slave_0: entered promiscuous mode [ 370.898753][ T5799] hsr_slave_1: entered promiscuous mode [ 370.907069][ T5799] debugfs: 'hsr0' already exists in 'hsr' [ 370.913010][ T5799] Cannot create hsr debugfs directory [ 371.058347][ T5813] hsr_slave_0: entered promiscuous mode [ 371.067196][ T5813] hsr_slave_1: entered promiscuous mode [ 371.075928][ T5813] debugfs: 'hsr0' already exists in 'hsr' [ 371.081753][ T5813] Cannot create hsr debugfs directory [ 371.733344][ T5072] Bluetooth: hci3: command tx timeout [ 371.733497][ T5805] Bluetooth: hci2: command tx timeout [ 371.739210][ T5808] Bluetooth: hci0: command tx timeout [ 371.744569][ T5805] Bluetooth: hci1: command tx timeout [ 371.928767][ T5796] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 371.973090][ T5805] Bluetooth: hci4: command tx timeout [ 372.020745][ T5796] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 372.073865][ T5796] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 372.120089][ T5796] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 372.262112][ T5797] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 372.296571][ T5797] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 372.329943][ T5797] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 372.347540][ T5797] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 372.544043][ T5799] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 372.594593][ T5799] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 372.620646][ T5799] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 372.675881][ T5799] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 372.847250][ T5795] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 372.870138][ T5795] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 372.893809][ T5795] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 372.912398][ T5795] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 373.138487][ T5796] 8021q: adding VLAN 0 to HW filter on device bond0 [ 373.223890][ T5813] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 373.245999][ T5813] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 373.291683][ T5813] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 373.324044][ T5813] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 373.385774][ T5796] 8021q: adding VLAN 0 to HW filter on device team0 [ 373.446960][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state [ 373.454449][ T5830] bridge0: port 1(bridge_slave_0) entered forwarding state [ 373.556809][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state [ 373.564303][ T5830] bridge0: port 2(bridge_slave_1) entered forwarding state [ 373.738080][ T5797] 8021q: adding VLAN 0 to HW filter on device bond0 [ 373.813130][ T5805] Bluetooth: hci1: command tx timeout [ 373.818916][ T5808] Bluetooth: hci0: command tx timeout [ 373.818934][ T5805] Bluetooth: hci2: command tx timeout [ 373.819018][ T5805] Bluetooth: hci3: command tx timeout [ 373.948061][ T5797] 8021q: adding VLAN 0 to HW filter on device team0 [ 373.980176][ T5799] 8021q: adding VLAN 0 to HW filter on device bond0 [ 374.053208][ T5805] Bluetooth: hci4: command tx timeout [ 374.068061][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 374.075434][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 374.157609][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state [ 374.164959][ T5830] bridge0: port 2(bridge_slave_1) entered forwarding state [ 374.207232][ T5795] 8021q: adding VLAN 0 to HW filter on device bond0 [ 374.259557][ T5799] 8021q: adding VLAN 0 to HW filter on device team0 [ 374.350374][ T5795] 8021q: adding VLAN 0 to HW filter on device team0 [ 374.399726][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state [ 374.407251][ T5843] bridge0: port 1(bridge_slave_0) entered forwarding state [ 374.464395][ T5868] bridge0: port 2(bridge_slave_1) entered blocking state [ 374.471744][ T5868] bridge0: port 2(bridge_slave_1) entered forwarding state [ 374.594445][ T5868] bridge0: port 1(bridge_slave_0) entered blocking state [ 374.601894][ T5868] bridge0: port 1(bridge_slave_0) entered forwarding state [ 374.736433][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state [ 374.743803][ T5830] bridge0: port 2(bridge_slave_1) entered forwarding state [ 374.801992][ T5813] 8021q: adding VLAN 0 to HW filter on device bond0 [ 375.047890][ T5813] 8021q: adding VLAN 0 to HW filter on device team0 [ 375.084636][ T5796] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 375.261505][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 375.269143][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 375.447532][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state [ 375.455068][ T5843] bridge0: port 2(bridge_slave_1) entered forwarding state [ 375.922185][ T5797] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 376.130193][ T5813] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 376.701637][ T5799] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 376.929575][ T5797] veth0_vlan: entered promiscuous mode [ 377.079928][ T5795] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 377.106630][ T5797] veth1_vlan: entered promiscuous mode [ 377.227165][ T5796] veth0_vlan: entered promiscuous mode [ 377.300125][ T5813] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 377.347348][ T5799] veth0_vlan: entered promiscuous mode [ 377.374755][ T5796] veth1_vlan: entered promiscuous mode [ 377.448402][ T5799] veth1_vlan: entered promiscuous mode [ 377.547676][ T5797] veth0_macvtap: entered promiscuous mode [ 377.568399][ T5795] veth0_vlan: entered promiscuous mode [ 377.596526][ T5797] veth1_macvtap: entered promiscuous mode [ 377.689225][ T5797] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 377.781180][ T5795] veth1_vlan: entered promiscuous mode [ 377.812058][ T5797] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 377.874555][ T5796] veth0_macvtap: entered promiscuous mode [ 377.927940][ T5799] veth0_macvtap: entered promiscuous mode [ 377.959212][ T5796] veth1_macvtap: entered promiscuous mode [ 377.968377][ T5877] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.982679][ T5877] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.020054][ T5799] veth1_macvtap: entered promiscuous mode [ 378.032106][ T5878] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.041519][ T5878] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.059565][ T5813] veth0_vlan: entered promiscuous mode [ 378.211392][ T5813] veth1_vlan: entered promiscuous mode [ 378.285946][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 378.364228][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 378.380645][ T5795] veth0_macvtap: entered promiscuous mode [ 378.452127][ T5795] veth1_macvtap: entered promiscuous mode [ 378.479548][ T5799] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 378.545052][ T5877] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.554200][ T5877] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.597932][ T5877] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.610946][ T5877] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.647922][ T5799] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 378.779567][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 378.870055][ T35] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.884201][ T35] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.906673][ T5813] veth0_macvtap: entered promiscuous mode [ 378.930488][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 378.955976][ T35] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.965302][ T35] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.012469][ T5813] veth1_macvtap: entered promiscuous mode [ 379.150609][ T5878] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.182608][ T5878] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.192251][ T5878] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.259951][ T5878] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.411599][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 379.566895][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 379.704376][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.753210][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.762217][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.798783][ T35] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 382.977317][ T5830] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 383.023200][ T5830] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 383.300350][ T5878] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 383.352466][ T5878] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 383.795290][ T5797] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 383.871417][ T5877] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 383.920414][ T5877] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 384.175972][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 384.206315][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 384.502159][ T5989] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 384.524378][ T5989] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 384.536142][ T5989] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 384.934982][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 385.543829][ T5435] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 385.626250][ T5830] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 385.634787][ T5830] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 385.761446][ T5435] usb 5-1: Using ep0 maxpacket: 32 [ 385.775051][ T5878] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 385.798216][ T5435] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 385.798390][ T5878] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 385.825684][ T5435] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 385.874763][ T5435] usb 5-1: config 0 descriptor?? [ 386.126422][ T5877] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.148852][ T5877] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.196604][ T5435] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 386.231916][ T5435] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 386.260581][ T5435] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 386.289965][ T5435] usb 5-1: media controller created [ 386.329058][ T5877] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.363048][ T5877] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.409376][ T5996] ===================================================== [ 386.416731][ T5996] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 [ 386.424110][ T5996] _copy_to_user+0xcc/0x120 [ 386.428822][ T5996] i2cdev_ioctl_smbus+0x586/0x660 [ 386.434183][ T5996] i2cdev_ioctl+0xa14/0xf40 [ 386.438805][ T5996] __se_sys_ioctl+0x23c/0x400 [ 386.444146][ T5996] __x64_sys_ioctl+0x97/0xe0 [ 386.448901][ T5996] x64_sys_call+0x1975/0x3ea0 [ 386.453844][ T5996] do_syscall_64+0x134/0xf80 [ 386.458609][ T5996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 386.464844][ T5996] [ 386.467228][ T5996] Uninit was stored to memory at: [ 386.472480][ T5996] __i2c_smbus_xfer+0x25a0/0x3120 [ 386.477942][ T5996] i2c_smbus_xfer+0x2d8/0x480 [ 386.486499][ T5996] i2cdev_ioctl_smbus+0x4a1/0x660 [ 386.491696][ T5996] i2cdev_ioctl+0xa14/0xf40 [ 386.497449][ T5996] __se_sys_ioctl+0x23c/0x400 [ 386.502289][ T5996] __x64_sys_ioctl+0x97/0xe0 [ 386.507498][ T5996] x64_sys_call+0x1975/0x3ea0 [ 386.512345][ T5996] do_syscall_64+0x134/0xf80 [ 386.517222][ T5996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 386.523374][ T5996] [ 386.525761][ T5996] Local variable msgbuf1.i created at: [ 386.531282][ T5996] __i2c_smbus_xfer+0x853/0x3120 [ 386.536568][ T5996] i2c_smbus_xfer+0x2d8/0x480 [ 386.541407][ T5996] [ 386.543889][ T5996] Bytes 0-1 of 2 are uninitialized [ 386.549075][ T5996] Memory access of size 2 starts at ffff888054903d06 [ 386.556043][ T5996] Data copied to user address 0000200000000100 [ 386.562276][ T5996] [ 386.564843][ T5996] CPU: 0 UID: 0 PID: 5996 Comm: syz.4.5 Not tainted syzkaller #0 PREEMPT(full) [ 386.569409][ T5830] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.574118][ T5996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 386.574179][ T5996] ===================================================== [ 386.574213][ T5996] Disabling lock debugging due to kernel taint [ 386.623549][ T5435] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 386.632377][ T5996] Kernel panic - not syncing: kmsan.panic set ... [ 386.638924][ T5996] CPU: 0 UID: 0 PID: 5996 Comm: syz.4.5 Tainted: G B syzkaller #0 PREEMPT(full) [ 386.649692][ T5996] Tainted: [B]=BAD_PAGE [ 386.653932][ T5996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 386.664121][ T5996] Call Trace: [ 386.667492][ T5996] [ 386.670500][ T5996] __dump_stack+0x26/0x30 [ 386.675003][ T5996] dump_stack_lvl+0x50/0x1c0 [ 386.679774][ T5996] ? dump_stack+0x12/0x25 [ 386.684288][ T5996] dump_stack+0x1e/0x25 [ 386.688697][ T5996] vpanic+0x7b4/0x1430 [ 386.692978][ T5996] panic+0x15d/0x160 [ 386.697096][ T5996] kmsan_report+0x31a/0x320 [ 386.701787][ T5996] ? kmsan_internal_check_memory+0x1e8/0x240 [ 386.707961][ T5996] ? kmsan_copy_to_user+0xef/0x190 [ 386.713256][ T5996] ? _copy_to_user+0xcc/0x120 [ 386.718243][ T5996] ? i2cdev_ioctl_smbus+0x586/0x660 [ 386.723575][ T5996] ? i2cdev_ioctl+0xa14/0xf40 [ 386.728366][ T5996] ? __se_sys_ioctl+0x23c/0x400 [ 386.733368][ T5996] ? __x64_sys_ioctl+0x97/0xe0 [ 386.738275][ T5996] ? x64_sys_call+0x1975/0x3ea0 [ 386.743276][ T5996] ? do_syscall_64+0x134/0xf80 [ 386.748204][ T5996] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 386.754504][ T5996] ? __pfx_az6027_i2c_xfer+0x10/0x10 [ 386.759971][ T5996] ? __pfx_az6027_i2c_xfer+0x10/0x10 [ 386.765431][ T5996] ? __i2c_transfer+0x1179/0x3280 [ 386.770579][ T5996] ? kmsan_get_metadata+0xf1/0x160 [ 386.776213][ T5996] ? kmsan_internal_set_shadow_origin+0x7a/0x110 [ 386.782729][ T5996] ? kmsan_get_metadata+0xf1/0x160 [ 386.788029][ T5996] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 386.794459][ T5996] ? __i2c_smbus_xfer+0x1f6c/0x3120 [ 386.799817][ T5996] ? kmsan_get_metadata+0xf1/0x160 [ 386.805098][ T5996] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 386.811100][ T5996] kmsan_internal_check_memory+0x1e8/0x240 [ 386.817085][ T5996] kmsan_copy_to_user+0xef/0x190 [ 386.822193][ T5996] _copy_to_user+0xcc/0x120 [ 386.826824][ T5996] i2cdev_ioctl_smbus+0x586/0x660 [ 386.832003][ T5996] i2cdev_ioctl+0xa14/0xf40 [ 386.836650][ T5996] ? kmsan_report+0x2c9/0x320 [ 386.841487][ T5996] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 386.846738][ T5996] __se_sys_ioctl+0x23c/0x400 [ 386.851607][ T5996] __x64_sys_ioctl+0x97/0xe0 [ 386.856388][ T5996] x64_sys_call+0x1975/0x3ea0 [ 386.861241][ T5996] do_syscall_64+0x134/0xf80 [ 386.866007][ T5996] ? clear_bhb_loop+0x50/0xa0 [ 386.870844][ T5996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 386.876896][ T5996] RIP: 0033:0x7f0589d9c629 [ 386.881419][ T5996] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 386.901248][ T5996] RSP: 002b:00007f058ac03028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 386.909914][ T5996] RAX: ffffffffffffffda RBX: 00007f058a015fa0 RCX: 00007f0589d9c629 [ 386.918017][ T5996] RDX: 0000200000000180 RSI: 0000000000000720 RDI: 0000000000000004 [ 386.926187][ T5996] RBP: 00007f0589e32b39 R08: 0000000000000000 R09: 0000000000000000 [ 386.934254][ T5996] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 386.942332][ T5996] R13: 00007f058a016038 R14: 00007f058a015fa0 R15: 00007ffc5f673508 [ 386.950444][ T5996] [ 386.954004][ T5996] Kernel Offset: disabled [ 386.958431][ T5996] Rebooting in 86400 seconds..