last executing test programs: 1.766396157s ago: executing program 3 (id=122): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x401, 0x2, 0x3, {0x0, 0x0, 0x0, 0x0, 0xc010}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_STATS_PER_PORT={0x5, 0x2d, 0xfe}]}}}]}, 0x3c}}, 0x0) 1.620331595s ago: executing program 3 (id=129): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) syz_clone3(&(0x7f000000dd80)={0xa00400, 0x0, 0x0, 0x0, {0x13}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f000000dd80)={0xa04400, 0x0, 0x0, 0x0, {0x12}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = epoll_create1(0x0) epoll_pwait2(r1, &(0x7f0000000280)=[{}], 0x1, 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.589179997s ago: executing program 1 (id=131): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x3, &(0x7f0000000540)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xc) getitimer(0x2, &(0x7f0000000100)) 1.504303272s ago: executing program 1 (id=132): getpeername(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) timer_settime(r0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) 1.358438641s ago: executing program 3 (id=135): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(0xffffffffffffffff, 0xc0884113, &(0x7f0000000380)={0x0, 0x22, 0x6a, 0x100010001, 0x0, 0xffffdffffffffffd, 0x7, 0xfffffffffffffffb, 0xc68, 0x9, 0x4, 0x1}) 1.059498788s ago: executing program 2 (id=141): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x4e, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddf"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa4, 0x0, &(0x7f0000001040)="d543f4d8ddbc3b5d8af16d4b7207543c1c6e3d2cd57f1ebd4721edf5eca8d5a0921488fe47f058ffa22cf27cb571e72e0cb9c525b6f19565d6c19fca35e3f69153daaf6ebb7814133522e0e6517b249233d92523277f84cd0fd338049c9faed2da33797446627aad81b6a9c78cdd7df447996b839c9673479b2d4098300ea2c980209a9ec06707d28a59ba4817f15ae17698116e511fb014585264cf3dd357a1567015cd"}) 1.02424036s ago: executing program 2 (id=142): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x5b01, 0x0) 848.59475ms ago: executing program 0 (id=146): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x49, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 686.99744ms ago: executing program 0 (id=149): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 614.723184ms ago: executing program 0 (id=150): connect$unix(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x40014) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x2, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x1000, 0x0, 0xfffffffc, 0x7ff}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x32, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 497.137441ms ago: executing program 3 (id=151): r0 = open(&(0x7f00000001c0)='./bus\x00', 0x4c27e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x13, r0, 0x0) fallocate(r0, 0x0, 0x9e1f, 0x575) r1 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r1, &(0x7f0000000880)=[{{&(0x7f0000000080)={0x2, 0x0, @rand_addr=0xac1414bb}, 0x3804, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x1}], 0x1}, 0x20000000}, {{&(0x7f0000000180)={0x2, 0x0, @remote}, 0x69, &(0x7f0000000400)=[{&(0x7f0000000240)="b9", 0x26892}], 0xbb}}], 0x2, 0x0) 495.610511ms ago: executing program 4 (id=152): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x4e, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddf"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa4, 0x0, &(0x7f0000001040)="d543f4d8ddbc3b5d8af16d4b7207543c1c6e3d2cd57f1ebd4721edf5eca8d5a0921488fe47f058ffa22cf27cb571e72e0cb9c525b6f19565d6c19fca35e3f69153daaf6ebb7814133522e0e6517b249233d92523277f84cd0fd338049c9faed2da33797446627aad81b6a9c78cdd7df447996b839c9673479b2d4098300ea2c980209a9ec06707d28a59ba4817f15ae17698116e511fb014585264cf3dd357a1567015cd"}) 443.073984ms ago: executing program 2 (id=153): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5, 0x3, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x74}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) 429.258894ms ago: executing program 0 (id=154): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_DEV_CREATE(r0, 0x5501) write$input_event(r0, &(0x7f0000000200)={{0x77359400}, 0x11, 0xae, 0x7fffffff}, 0xffffffe7) 425.537605ms ago: executing program 4 (id=155): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) close(0xffffffffffffffff) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0xffffbffd, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xf, 0x3, 0x6361, 0x5, 0xa1, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc04c001}, 0x20000804) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x71b923, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xffe0}, {0x2, 0xb}, {0x4, 0xfff3}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x4010844) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 420.793776ms ago: executing program 3 (id=156): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, 0x0, 0x0) 386.148618ms ago: executing program 2 (id=157): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a70000000090a010400000000000000000a0000040900020073797a310000000008000a40fffffffc0900010073797a3100000000080005400000000d2c00128028000180090001006c6173740000000004000280140001800c000120636f756e746572000400028008000340000001"], 0x98}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) 326.844381ms ago: executing program 0 (id=158): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081084e81f782db44b904021d080006067c09e8fe55a10a0015400800142603600e120800160000001001a8001600a400014003", 0x39}], 0x1, 0x0, 0x0, 0x6000}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="d800000010008104687da3aa7143a0b8c81d080b25000000e8fe5538250015000600149b0000001208000313eba96240a8002b", 0x33}], 0x1}, 0x80) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r1, 0x10, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) 325.722641ms ago: executing program 1 (id=159): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x49, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 306.651962ms ago: executing program 2 (id=160): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 174.39593ms ago: executing program 4 (id=161): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840)) r1 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r1, 0xc0884113, &(0x7f0000000380)={0x0, 0x22, 0x6a, 0x100010001, 0x0, 0xffffdffffffffffd, 0x7, 0xfffffffffffffffb, 0xc68, 0x9, 0x4, 0x1}) 172.96184ms ago: executing program 2 (id=162): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0x23}, 0x8) socket(0x2d, 0x2, 0x0) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x1, r1}) ioctl$DMA_BUF_SET_NAME_A(r4, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0x5}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0xd, 0xfffffffe, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x5, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x3, 0x7, 0x5, 0x3e, 0x18e, 0x6, 0x6, 0x0, 0x6, 0x4, 0x8, 0x3ff, 0x80, 0xfffffffc, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x800009, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x8, 0xb, 0x4, 0x9, 0x8, 0x40, 0xa, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000008, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x400003], [0x800007, 0x40c, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x4, 0xb, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x40000005, 0x0, 0x1ef, 0x5, 0x9, 0x86, 0x3, 0x303c, 0x0, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x200, 0x5, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ff, 0x2006, 0x80a2ed, 0x5, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x80005, 0x937, 0x6, 0x6, 0x0, 0xb9, 0x4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0x3, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0x80, 0xfffffff8]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c80)=ANY=[@ANYBLOB="f0010000", @ANYRES16=r5, @ANYBLOB="01000001bcaf19000000030000004c00018038000400200001000a004e230000000300000000000000000000ffffe0000002080000001400020002000000ffffffff00000000000000000d0001007564703a73797a32000000003400078008000100c00000000c00040006000000000000000c0003000004000000000000080001000500000008000100050000005c0101802c0004001400010002004e220000000000000000000000001400020002004e23ac1414aa00000000000000002c0004001400010002004e227f00000100000000000000001400020002004e24e00000020000000000000000080003009d5f00000e00010069623a64766d7270310000000d0001007564703a73797a30000000002400028008000300010000000800030003000000080004000700000008000200ff00000038000400200001000a004e2000000001fe8000000000000000000000000000aa090000001400020002004e24ac1414aa000000000000000044000400200001000a004e2200000008fe8000000000000000000000000000aa6f040000200002000a004e20000000082001000000000000000000000000000210000000380004001400010002004e21ac141432000000000000200002000a004e230000020020010000000000000000000000000000ff0000004fc4821a91a593d6c7b708ff2f8da4118d9863bd3d0ecfed615eee1cbf40c1832c629abfda9707b1b779123a35f0adddb23d"], 0x1f0}, 0x1, 0x0, 0x0, 0x2404c890}, 0x0) r6 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) mq_timedsend(r6, 0x0, 0x0, 0x6, 0x0) r7 = syz_open_dev$I2C(&(0x7f0000000180), 0x0, 0x0) ioctl$I2C_RDWR(r7, 0x707, &(0x7f00000000c0)={&(0x7f0000000080), 0x23}) 162.732661ms ago: executing program 0 (id=163): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c6572"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000780)=@newqdisc={0x8c, 0x24, 0x4ee4e6a52ff56541, 0xffffbffd, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x5c, 0x2, {{0x0, 0x3, 0x6361, 0x5, 0xa1, 0x800006}, [@TCA_NETEM_DELAY_DIST={0x8, 0x2, "7fe8ebd8"}, @TCA_NETEM_SLOT={0x2c, 0xc, {0xffffffff, 0x76, 0x6, 0xe5, 0x8, 0x7}}, @TCA_NETEM_LATENCY64={0xc, 0xa, 0x1}]}}}]}, 0x8c}, 0x1, 0x0, 0x0, 0xc04c001}, 0x20000804) sendmsg$nl_route_sched(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x71b923, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xffe0}, {0x2, 0xb}, {0x4, 0xfff3}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x4010844) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 149.838301ms ago: executing program 3 (id=164): connect$unix(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x40014) sendmsg$nl_route_sched(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x2, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x1000, 0x0, 0xfffffffc, 0x7ff}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x32, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 124.970853ms ago: executing program 1 (id=165): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x4f, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa4, 0x0, &(0x7f0000001040)="d543f4d8ddbc3b5d8af16d4b7207543c1c6e3d2cd57f1ebd4721edf5eca8d5a0921488fe47f058ffa22cf27cb571e72e0cb9c525b6f19565d6c19fca35e3f69153daaf6ebb7814133522e0e6517b249233d92523277f84cd0fd338049c9faed2da33797446627aad81b6a9c78cdd7df447996b839c9673479b2d4098300ea2c980209a9ec06707d28a59ba4817f15ae17698116e511fb014585264cf3dd357a1567015cd"}) 76.339345ms ago: executing program 4 (id=166): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000400000008"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x5, 0x4, 0x7, 0x0, r0}, 0x50) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x1, r1, 0x4}, 0x38) 76.164825ms ago: executing program 4 (id=167): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x54}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) 43.413888ms ago: executing program 1 (id=168): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_DEV_CREATE(r0, 0x5501) write$input_event(r0, &(0x7f0000000200)={{0x77359400}, 0x11, 0xae, 0x7fffffff}, 0xffffffe7) 22.900119ms ago: executing program 1 (id=169): fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000d00)='//_:e\xa4/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\xa5\x94\x0e\x0et\x8d@\xdc\x03+\xcf\xbf\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b 1 [ 31.705543][ T4334] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 31.706818][ T4334] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 31.707992][ T4334] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 31.709357][ T4334] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 31.710707][ T4334] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 31.712362][ T4334] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 31.713633][ T4334] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 31.713989][ T4335] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 31.714833][ T4334] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 31.716423][ T4335] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 31.717093][ T4334] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 31.718013][ T4335] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 31.719028][ T4334] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 31.720116][ T4335] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 31.722593][ T4336] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 31.723302][ T4335] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 31.725506][ T4335] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 31.726787][ T4335] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 31.727966][ T4336] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 31.728039][ T4335] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 31.729142][ T4336] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 31.732054][ T4337] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 31.734978][ T4337] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 31.735323][ T4335] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 31.738185][ T4332] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 31.744471][ T4335] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 31.771959][ T4337] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 31.779744][ T4337] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 31.781513][ T4337] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 31.892731][ T4322] chnl_net:caif_netlink_parms(): no params data found [ 31.901886][ T4320] chnl_net:caif_netlink_parms(): no params data found [ 31.905418][ T4328] chnl_net:caif_netlink_parms(): no params data found [ 31.924508][ T4329] chnl_net:caif_netlink_parms(): no params data found [ 31.932259][ T4321] chnl_net:caif_netlink_parms(): no params data found [ 31.952701][ T4320] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.953852][ T4320] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.955279][ T4320] device bridge_slave_0 entered promiscuous mode [ 31.965946][ T4322] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.967139][ T4322] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.968687][ T4322] device bridge_slave_0 entered promiscuous mode [ 31.970311][ T4320] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.971694][ T4320] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.973103][ T4320] device bridge_slave_1 entered promiscuous mode [ 31.983707][ T4322] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.984903][ T4322] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.986410][ T4322] device bridge_slave_1 entered promiscuous mode [ 31.987886][ T4328] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.988956][ T4328] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.990292][ T4328] device bridge_slave_0 entered promiscuous mode [ 31.995651][ T4329] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.996748][ T4329] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.998095][ T4329] device bridge_slave_0 entered promiscuous mode [ 32.007057][ T4320] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 32.009373][ T4320] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 32.010712][ T4328] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.012087][ T4328] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.013453][ T4328] device bridge_slave_1 entered promiscuous mode [ 32.016594][ T4321] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.017743][ T4321] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.019221][ T4321] device bridge_slave_0 entered promiscuous mode [ 32.020820][ T4329] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.022254][ T4329] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.023562][ T4329] device bridge_slave_1 entered promiscuous mode [ 32.028624][ T4321] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.029764][ T4321] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.034043][ T4321] device bridge_slave_1 entered promiscuous mode [ 32.041426][ T4322] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 32.043897][ T4322] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 32.049598][ T4328] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 32.054385][ T4320] team0: Port device team_slave_0 added [ 32.061825][ T4328] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 32.064320][ T4329] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 32.066271][ T4320] team0: Port device team_slave_1 added [ 32.070434][ T4321] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 32.077023][ T4329] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 32.081030][ T4321] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 32.083738][ T4322] team0: Port device team_slave_0 added [ 32.087520][ T4328] team0: Port device team_slave_0 added [ 32.093712][ T4320] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 32.094837][ T4320] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.098408][ T4320] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 32.103069][ T4322] team0: Port device team_slave_1 added [ 32.104591][ T4328] team0: Port device team_slave_1 added [ 32.105773][ T4320] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 32.106888][ T4320] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.110479][ T4320] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 32.115979][ T4329] team0: Port device team_slave_0 added [ 32.117591][ T4329] team0: Port device team_slave_1 added [ 32.131372][ T4321] team0: Port device team_slave_0 added [ 32.133104][ T4321] team0: Port device team_slave_1 added [ 32.140801][ T4328] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 32.144703][ T4328] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.148338][ T4328] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 32.150572][ T4328] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 32.151985][ T4328] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.155887][ T4328] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 32.157878][ T4329] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 32.158864][ T4329] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.165156][ T4329] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 32.169087][ T4322] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 32.170140][ T4322] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.173886][ T4322] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 32.176028][ T4322] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 32.176954][ T4322] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.180471][ T4322] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 32.185523][ T4329] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 32.186540][ T4329] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.190218][ T4329] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 32.200151][ T4321] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 32.201573][ T4321] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.205422][ T4321] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 32.208310][ T4321] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 32.209346][ T4321] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.215604][ T4321] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 32.272527][ T4320] device hsr_slave_0 entered promiscuous mode [ 32.311425][ T4320] device hsr_slave_1 entered promiscuous mode [ 32.392261][ T4321] device hsr_slave_0 entered promiscuous mode [ 32.431340][ T4321] device hsr_slave_1 entered promiscuous mode [ 32.471238][ T4321] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 32.472492][ T4321] Cannot create hsr debugfs directory [ 32.512202][ T4328] device hsr_slave_0 entered promiscuous mode [ 32.561318][ T4328] device hsr_slave_1 entered promiscuous mode [ 32.611193][ T4328] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 32.612447][ T4328] Cannot create hsr debugfs directory [ 32.662277][ T4322] device hsr_slave_0 entered promiscuous mode [ 32.701369][ T4322] device hsr_slave_1 entered promiscuous mode [ 32.741201][ T4322] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 32.742537][ T4322] Cannot create hsr debugfs directory [ 32.792242][ T4329] device hsr_slave_0 entered promiscuous mode [ 32.831310][ T4329] device hsr_slave_1 entered promiscuous mode [ 32.891161][ T4329] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 32.892367][ T4329] Cannot create hsr debugfs directory [ 33.020319][ T4321] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 33.073887][ T4321] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 33.124088][ T4321] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 33.172247][ T4321] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 33.223736][ T4320] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 33.265634][ T4320] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 33.315324][ T4320] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 33.357427][ T4320] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 33.401983][ T4328] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 33.471654][ T4328] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 33.514250][ T4328] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 33.561420][ T4322] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 33.604169][ T4328] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 33.643672][ T4322] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 33.682322][ T4322] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 33.742667][ T4322] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 33.771276][ T4333] Bluetooth: hci0: command 0x0409 tx timeout [ 33.771481][ T4337] Bluetooth: hci1: command 0x0409 tx timeout [ 33.772286][ T4333] Bluetooth: hci4: command 0x0409 tx timeout [ 33.773200][ T4337] Bluetooth: hci2: command 0x0409 tx timeout [ 33.798012][ T4329] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 33.843344][ T4320] 8021q: adding VLAN 0 to HW filter on device bond0 [ 33.845766][ T4329] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 33.851545][ T4337] Bluetooth: hci3: command 0x0409 tx timeout [ 33.889032][ T4321] 8021q: adding VLAN 0 to HW filter on device bond0 [ 33.896052][ T4329] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 33.943140][ T4329] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 34.005372][ T4321] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.013160][ T4320] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.017700][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 34.019741][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.021386][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 34.022810][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.024180][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 34.025750][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.027355][ T1619] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.028481][ T1619] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.030133][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 34.034477][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.035953][ T1619] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.037052][ T1619] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.038253][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 34.039800][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 34.042489][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.043825][ T1619] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.044868][ T1619] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.046102][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 34.047518][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.048884][ T1619] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.049928][ T1619] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.051274][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 34.052800][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 34.054263][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 34.068280][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 34.070197][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 34.071979][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 34.073467][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 34.079413][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 34.083995][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 34.086240][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 34.100884][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 34.102636][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 34.106825][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 34.108188][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 34.109714][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 34.116580][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 34.118301][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 34.121765][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 34.123307][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 34.126195][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 34.127628][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 34.129801][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 34.137406][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 34.138967][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 34.148856][ T4321] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 34.154407][ T4328] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.164925][ T4322] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.178112][ T4328] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.181035][ T4329] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.186266][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 34.187648][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.192228][ T4322] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.193611][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 34.194922][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.210522][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 34.212592][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.213915][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 34.215307][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.216775][ T1571] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.217857][ T1571] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.219139][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 34.220722][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.223939][ T1571] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.225074][ T1571] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.226394][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 34.229542][ T4329] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.235145][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 34.236661][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.238032][ T1571] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.239198][ T1571] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.240437][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 34.242550][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 34.252980][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 34.254474][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.255822][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.256906][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.259120][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 34.260586][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.263750][ T1619] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.264843][ T1619] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.276702][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 34.278205][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 34.279845][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 34.282621][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 34.284136][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 34.285401][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 34.286604][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 34.288161][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 34.289686][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 34.294224][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 34.297453][ T4320] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.299503][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 34.301045][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 34.317240][ T4321] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.319220][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 34.320819][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.322951][ T1619] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.324064][ T1619] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.325320][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 34.326913][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 34.328546][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 34.330109][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 34.332026][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 34.333524][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 34.335112][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 34.336540][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 34.337907][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 34.339050][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 34.340324][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 34.342635][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 34.347379][ T4329] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 34.348887][ T4329] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 34.352002][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 34.353910][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 34.355395][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 34.356819][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 34.367276][ T4322] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 34.369257][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 34.370596][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 34.374874][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.377708][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 34.379160][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.384304][ T4320] device veth0_vlan entered promiscuous mode [ 34.387832][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.389158][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.393910][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 34.396322][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 34.402553][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 34.403958][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 34.405450][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 34.406841][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 34.408197][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 34.422519][ T4320] device veth1_vlan entered promiscuous mode [ 34.424592][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 34.426143][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 34.427624][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 34.444629][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 34.449311][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 34.450849][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 34.455839][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.460851][ T4320] device veth0_macvtap entered promiscuous mode [ 34.468431][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 34.469917][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 34.472738][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.478941][ T4320] device veth1_macvtap entered promiscuous mode [ 34.494309][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 34.495878][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 34.497303][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.498811][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.500055][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.509528][ T4322] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.513262][ T4321] device veth0_vlan entered promiscuous mode [ 34.515874][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 34.517146][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 34.518375][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 34.519663][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 34.524495][ T4320] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.528820][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 34.530496][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.539338][ T4329] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.541012][ T4321] device veth1_vlan entered promiscuous mode [ 34.543327][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 34.544834][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 34.546258][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.549149][ T4320] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.557326][ T4320] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.558863][ T4320] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.560125][ T4320] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.562374][ T4320] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.569402][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.570894][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.582505][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 34.583958][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 34.585237][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 34.588179][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 34.589695][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.592072][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.593545][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.598758][ T4328] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.604833][ T4322] device veth0_vlan entered promiscuous mode [ 34.615365][ T4322] device veth1_vlan entered promiscuous mode [ 34.619543][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 34.621025][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 34.626427][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.628252][ T4321] device veth0_macvtap entered promiscuous mode [ 34.638573][ T4321] device veth1_macvtap entered promiscuous mode [ 34.655139][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 34.656697][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 34.658005][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 34.659320][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 34.660707][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.673430][ T4328] device veth0_vlan entered promiscuous mode [ 34.676387][ T4328] device veth1_vlan entered promiscuous mode [ 34.685071][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 34.686575][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.688019][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 34.689342][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 34.690774][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.695294][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.702195][ T4321] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.703933][ T4321] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.705987][ T4321] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.707711][ T4352] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.708939][ T4352] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.714157][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.715733][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 34.717262][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.725605][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 34.727238][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.729336][ T4322] device veth0_macvtap entered promiscuous mode [ 34.730868][ T4321] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.733034][ T4321] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.735080][ T4321] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.741578][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 34.743049][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.744495][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.747501][ T4321] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.748917][ T4321] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.750255][ T4321] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.752805][ T4321] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.756306][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.757477][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.758885][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.762541][ T4322] device veth1_macvtap entered promiscuous mode [ 34.767021][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 34.768432][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 34.769919][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.771679][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 34.773146][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.775362][ T4328] device veth0_macvtap entered promiscuous mode [ 34.784924][ T4328] device veth1_macvtap entered promiscuous mode [ 34.790488][ T4322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.792754][ T4322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.794239][ T4322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.795676][ T4322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.797809][ T4322] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.803450][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 34.804915][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 34.806295][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 34.807890][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.815649][ T4322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.819935][ T4322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.826603][ T4322] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.828257][ T4322] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.830351][ T4322] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.837011][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.838684][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.844242][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.845869][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.847380][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.848859][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.850349][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.854847][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.857357][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.859792][ T4322] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.861077][ T4322] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.864801][ T4322] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.866038][ T4322] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.873817][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 34.875442][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.876907][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 34.878320][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.879866][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.882620][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.886162][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.887867][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.889386][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.891004][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.895272][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.896912][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.899164][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.900469][ T4329] device veth0_vlan entered promiscuous mode [ 34.909384][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.910950][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.920577][ T4328] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.922614][ T4328] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.923884][ T4328] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.925107][ T4328] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.927049][ T4434] device syzkaller0 entered promiscuous mode [ 34.932292][ T4329] device veth1_vlan entered promiscuous mode [ 34.934483][ T1619] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.935758][ T1619] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.941085][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 34.942750][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 34.944148][ T1571] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.960110][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 34.962027][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.967182][ T1619] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.968383][ T1619] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.983345][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.994677][ T4352] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.995891][ T4352] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.997719][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.999640][ T4329] device veth0_macvtap entered promiscuous mode [ 35.010301][ T4329] device veth1_macvtap entered promiscuous mode [ 35.028589][ T4329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 35.030229][ T4329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 35.034204][ T4329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 35.035812][ T4329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 35.037431][ T4329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 35.039099][ T4329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 35.040579][ T4329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 35.042485][ T4329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 35.044956][ T4329] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 35.047339][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 35.048922][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 35.050548][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.052930][ T4352] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.054166][ T4352] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.056774][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.067629][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 35.069146][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 35.093764][ T4329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 35.095486][ T4329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 35.098663][ T4329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 35.106779][ T4329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 35.108756][ T4329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 35.110192][ T4329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 35.112556][ T4329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 35.114195][ T4329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 35.116652][ T4329] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 35.118954][ T4438] input: syz1 as /devices/virtual/input/input2 [ 35.120055][ T4438] input: failed to attach handler leds to device input2, error: -6 [ 35.122003][ T4329] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.123293][ T4329] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.124519][ T4329] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.125808][ T4329] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.127440][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.128677][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.145428][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 35.149529][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 35.159023][ T1619] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 35.260405][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.262432][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.263728][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 35.279502][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.280784][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.283175][ T4352] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 35.396750][ T4452] input: syz1 as /devices/virtual/input/input3 [ 35.411373][ T4459] device syzkaller0 entered promiscuous mode [ 35.525172][ T4471] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19'. [ 35.576417][ T27] audit: type=1326 audit(35.560:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4464 comm="syz.2.16" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9e177368 code=0x7ffc0000 [ 35.579853][ T27] audit: type=1326 audit(35.560:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4464 comm="syz.2.16" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=104 compat=0 ip=0xffff9e177368 code=0x7ffc0000 [ 35.592213][ T27] audit: type=1326 audit(35.560:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4464 comm="syz.2.16" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9e177368 code=0x7ffc0000 [ 35.595162][ T27] audit: type=1326 audit(35.560:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4464 comm="syz.2.16" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=198 compat=0 ip=0xffff9e177368 code=0x7ffc0000 [ 35.598130][ T27] audit: type=1326 audit(35.560:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4464 comm="syz.2.16" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9e177368 code=0x7ffc0000 [ 35.625109][ T27] audit: type=1326 audit(35.560:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4464 comm="syz.2.16" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=56 compat=0 ip=0xffff9e177368 code=0x7ffc0000 [ 35.628334][ T27] audit: type=1326 audit(35.560:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4464 comm="syz.2.16" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9e177368 code=0x7ffc0000 [ 35.645343][ T27] audit: type=1326 audit(35.560:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4464 comm="syz.2.16" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=64 compat=0 ip=0xffff9e177368 code=0x7ffc0000 [ 35.648927][ T27] audit: type=1326 audit(35.560:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4464 comm="syz.2.16" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9e177368 code=0x7ffc0000 [ 35.675693][ T27] audit: type=1326 audit(35.560:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4464 comm="syz.2.16" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=64 compat=0 ip=0xffff9e177368 code=0x7ffc0000 [ 35.733149][ T4488] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 35.851326][ T4323] Bluetooth: hci2: command 0x041b tx timeout [ 35.863867][ T4337] Bluetooth: hci4: command 0x041b tx timeout [ 35.864831][ T4337] Bluetooth: hci1: command 0x041b tx timeout [ 35.865809][ T4337] Bluetooth: hci0: command 0x041b tx timeout [ 35.942051][ T4323] Bluetooth: hci3: command 0x041b tx timeout [ 36.010636][ T4511] syz.4.34 uses obsolete (PF_INET,SOCK_PACKET) [ 36.063943][ T4513] netlink: 28 bytes leftover after parsing attributes in process `syz.0.37'. [ 36.065426][ T4513] netlink: 28 bytes leftover after parsing attributes in process `syz.0.37'. [ 36.103498][ T4513] device erspan0 entered promiscuous mode [ 36.142518][ T4513] device gretap0 entered promiscuous mode [ 36.193876][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 36.466562][ T4527] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 36.799132][ T4541] netlink: 44 bytes leftover after parsing attributes in process `syz.4.49'. [ 36.800874][ T4541] netlink: 20 bytes leftover after parsing attributes in process `syz.4.49'. [ 36.937826][ T4548] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 36.939435][ T4548] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.119643][ T4558] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.121077][ T4558] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.360533][ T4573] netlink: 4 bytes leftover after parsing attributes in process `syz.3.60'. [ 37.579489][ T4580] binder: 4576:4580 tried to acquire reference to desc 0, got 1 instead [ 37.590141][ T4580] binder: 4576:4580 ioctl c0306201 0 returned -14 [ 37.828718][ T4588] team0: Device ipvlan1 failed to register rx_handler [ 37.941766][ T4337] Bluetooth: hci0: command 0x040f tx timeout [ 37.942848][ T4337] Bluetooth: hci1: command 0x040f tx timeout [ 37.943794][ T4337] Bluetooth: hci4: command 0x040f tx timeout [ 37.944728][ T4337] Bluetooth: hci2: command 0x040f tx timeout [ 38.011492][ T4323] Bluetooth: hci3: command 0x040f tx timeout [ 38.246932][ T4386] binder: undelivered TRANSACTION_COMPLETE [ 38.360311][ T4612] netlink: 16 bytes leftover after parsing attributes in process `syz.1.72'. [ 38.463208][ T4404] binder: undelivered transaction 5, process died. [ 38.497639][ T4621] binder: 4619:4621 tried to acquire reference to desc 0, got 1 instead [ 38.500250][ T4621] binder: 4619:4621 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 38.506034][ T4621] binder: 4621 RLIMIT_NICE not set [ 38.516466][ T4621] binder: 4619:4621 got transaction to invalid handle, 2 [ 38.518439][ T4621] binder: 4621:4619 cannot find target node [ 38.523190][ T4621] binder: 4619:4621 transaction call to 0:0 failed 18/29201/-22, size 0-0 line 3045 [ 38.539223][ T4404] binder: release 4619:4621 transaction 10 out, still active [ 38.540508][ T4404] binder: send failed reply for transaction 17 to 4619:4621 [ 38.542186][ T4404] binder: undelivered TRANSACTION_COMPLETE [ 38.543073][ T4404] binder: undelivered TRANSACTION_ERROR: 29189 [ 38.544089][ T4404] binder: send failed reply for transaction 10, target dead [ 38.590874][ T4627] netlink: 'syz.4.81': attribute type 10 has an invalid length. [ 39.067548][ T4649] tipc: Enabling of bearer rejected, failed to enable media [ 39.069875][ T4649] device syzkaller0 entered promiscuous mode [ 39.650344][ T4659] binder: 4658:4659 tried to acquire reference to desc 0, got 1 instead [ 39.654871][ T4659] binder: 4658:4659 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 39.656909][ T4659] binder: 4659 RLIMIT_NICE not set [ 39.660221][ T4659] binder: 4658:4659 got transaction to invalid handle, 2 [ 39.666175][ T4659] binder: 4659:4658 cannot find target node [ 40.011745][ T4337] Bluetooth: hci2: command 0x0419 tx timeout [ 40.012818][ T4337] Bluetooth: hci4: command 0x0419 tx timeout [ 40.013728][ T4337] Bluetooth: hci1: command 0x0419 tx timeout [ 40.014619][ T4337] Bluetooth: hci0: command 0x0419 tx timeout [ 40.091680][ T4323] Bluetooth: hci3: command 0x0419 tx timeout [ 40.119169][ T4675] netlink: 'syz.2.100': attribute type 10 has an invalid length. [ 40.160835][ T4682] binder: 4681:4682 tried to acquire reference to desc 0, got 1 instead [ 40.172315][ T4684] tipc: Enabling of bearer rejected, failed to enable media [ 40.174613][ T4684] device syzkaller0 entered promiscuous mode [ 40.214372][ T4688] input: syz1 as /devices/virtual/input/input7 [ 40.215412][ T4688] input: failed to attach handler leds to device input7, error: -6 [ 40.724986][ T4720] tipc: Enabling of bearer rejected, failed to enable media [ 40.727963][ T4720] device syzkaller0 entered promiscuous mode [ 41.170966][ T4748] device syzkaller1 entered promiscuous mode [ 41.383393][ T4762] tipc: Enabling of bearer rejected, failed to enable media [ 41.384949][ T4763] device syzkaller0 entered promiscuous mode [ 41.740877][ T4781] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.744159][ T4781] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.796441][ T4783] device syzkaller1 entered promiscuous mode [ 42.008486][ T4791] netlink: 'syz.4.147': attribute type 1 has an invalid length. [ 42.060996][ T4793] tipc: Enabling of bearer rejected, failed to enable media [ 42.065064][ T4793] device syzkaller0 entered promiscuous mode [ 42.111678][ T4795] netlink: 'syz.0.149': attribute type 10 has an invalid length. [ 42.345908][ T4809] tipc: Started in network mode [ 42.346750][ T4809] tipc: Node identity 26315f9f12c, cluster identity 4711 [ 42.347870][ T4809] tipc: Enabled bearer , priority 0 [ 42.349278][ T4809] device syzkaller0 entered promiscuous mode [ 42.368485][ T4811] device syzkaller1 entered promiscuous mode [ 42.416023][ T4807] tipc: Resetting bearer [ 42.512318][ T4807] tipc: Disabling bearer [ 42.550521][ T4816] netlink: 'syz.0.158': attribute type 1 has an invalid length. [ 42.555393][ T4820] netlink: 'syz.2.160': attribute type 10 has an invalid length. [ 42.603807][ T4829] tipc: Enabling of bearer rejected, failed to enable media [ 42.605690][ T4829] device syzkaller0 entered promiscuous mode [ 42.644845][ T4836] binder_user_error: 19 callbacks suppressed [ 42.644854][ T4836] binder: 4835:4836 tried to acquire reference to desc 0, got 1 instead [ 42.659339][ T4836] binder: 4835:4836 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 42.666231][ T4836] binder: 4836 RLIMIT_NICE not set [ 42.667244][ T4836] binder: 4835:4836 got transaction to invalid handle, 2 [ 42.775459][ T4850] ================================================================== [ 42.776748][ T4850] BUG: KASAN: use-after-free in dvb_device_open+0xd4/0x388 [ 42.777850][ T4850] Read of size 8 at addr ffff0000d367a418 by task syz.4.170/4850 [ 42.778977][ T4850] [ 42.779342][ T4850] CPU: 0 PID: 4850 Comm: syz.4.170 Not tainted syzkaller #0 [ 42.780336][ T4850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 42.781817][ T4850] Call trace: [ 42.782317][ T4850] dump_backtrace+0x1c0/0x1ec [ 42.783051][ T4850] show_stack+0x2c/0x3c [ 42.783668][ T4850] __dump_stack+0x30/0x40 [ 42.784307][ T4850] dump_stack_lvl+0xf4/0x15c [ 42.785016][ T4850] print_address_description+0x88/0x218 [ 42.785908][ T4850] print_report+0x50/0x68 [ 42.786527][ T4850] kasan_report+0xa8/0xfc [ 42.787204][ T4850] __asan_report_load8_noabort+0x2c/0x38 [ 42.788092][ T4850] dvb_device_open+0xd4/0x388 [ 42.788792][ T4850] chrdev_open+0x3d4/0x518 [ 42.789482][ T4850] do_dentry_open+0x72c/0xf98 [ 42.790230][ T4850] vfs_open+0x7c/0x90 [ 42.790859][ T4850] path_openat+0x1f8c/0x26bc [ 42.791526][ T4850] do_filp_open+0x194/0x384 [ 42.792204][ T4850] do_sys_openat2+0x134/0x3f4 [ 42.792892][ T4850] __arm64_sys_openat+0x118/0x14c [ 42.793672][ T4850] invoke_syscall+0x98/0x2b4 [ 42.794398][ T4850] el0_svc_common+0x138/0x258 [ 42.795089][ T4850] do_el0_svc+0x58/0x130 [ 42.795724][ T4850] el0_svc+0x58/0x128 [ 42.796282][ T4850] el0t_64_sync_handler+0x84/0xf0 [ 42.797070][ T4850] el0t_64_sync+0x18c/0x190 [ 42.797740][ T4850] [ 42.798086][ T4850] Allocated by task 1: [ 42.798696][ T4850] kasan_set_track+0x4c/0x80 [ 42.799362][ T4850] kasan_save_alloc_info+0x24/0x30 [ 42.800074][ T4850] __kasan_kmalloc+0xa0/0xb8 [ 42.800823][ T4850] kmalloc_trace+0x7c/0x94 [ 42.801533][ T4850] dvb_register_device+0x1a0/0x17a8 [ 42.802288][ T4850] dvb_register_frontend+0x4c0/0x720 [ 42.803061][ T4850] vidtv_bridge_probe+0x9ac/0xe34 [ 42.803794][ T4850] platform_probe+0x13c/0x1b4 [ 42.804509][ T4850] really_probe+0x39c/0xacc [ 42.805144][ T4850] __driver_probe_device+0x180/0x310 [ 42.805921][ T4850] driver_probe_device+0x78/0x324 [ 42.806721][ T4850] __driver_attach+0x3bc/0x60c [ 42.807383][ T4850] bus_for_each_dev+0x148/0x1d0 [ 42.808070][ T4850] driver_attach+0x4c/0x5c [ 42.808701][ T4850] bus_add_driver+0x2d8/0x554 [ 42.809389][ T4850] driver_register+0x200/0x378 [ 42.810053][ T4850] __platform_driver_register+0x6c/0x80 [ 42.810837][ T4850] vidtv_bridge_init+0x4c/0x8c [ 42.811488][ T4850] do_one_initcall+0x278/0x9e0 [ 42.812197][ T4850] do_initcall_level+0x154/0x214 [ 42.812933][ T4850] do_initcalls+0x58/0xac [ 42.813566][ T4850] do_basic_setup+0x8c/0xa0 [ 42.814186][ T4850] kernel_init_freeable+0x35c/0x4f0 [ 42.814907][ T4850] kernel_init+0x24/0x1d8 [ 42.815514][ T4850] ret_from_fork+0x10/0x20 [ 42.816169][ T4850] [ 42.816495][ T4850] Freed by task 4756: [ 42.817078][ T4850] kasan_set_track+0x4c/0x80 [ 42.817794][ T4850] kasan_save_free_info+0x38/0x5c [ 42.818524][ T4850] ____kasan_slab_free+0x148/0x1b0 [ 42.819251][ T4850] __kasan_slab_free+0x18/0x28 [ 42.820019][ T4850] slab_free_freelist_hook+0x16c/0x1e8 [ 42.820845][ T4850] __kmem_cache_free+0xbc/0x218 [ 42.821524][ T4850] kfree+0xd0/0x1a8 [ 42.822087][ T4850] dvb_device_open+0x2dc/0x388 [ 42.822727][ T4850] chrdev_open+0x3d4/0x518 [ 42.823327][ T4850] do_dentry_open+0x72c/0xf98 [ 42.823981][ T4850] vfs_open+0x7c/0x90 [ 42.824590][ T4850] path_openat+0x1f8c/0x26bc [ 42.825283][ T4850] do_filp_open+0x194/0x384 [ 42.825940][ T4850] do_sys_openat2+0x134/0x3f4 [ 42.826632][ T4850] __arm64_sys_openat+0x118/0x14c [ 42.827318][ T4850] invoke_syscall+0x98/0x2b4 [ 42.828028][ T4850] el0_svc_common+0x138/0x258 [ 42.828728][ T4850] do_el0_svc+0x58/0x130 [ 42.829338][ T4850] el0_svc+0x58/0x128 [ 42.829926][ T4850] el0t_64_sync_handler+0x84/0xf0 [ 42.830693][ T4850] el0t_64_sync+0x18c/0x190 [ 42.831315][ T4850] [ 42.831668][ T4850] The buggy address belongs to the object at ffff0000d367a400 [ 42.831668][ T4850] which belongs to the cache kmalloc-256 of size 256 [ 42.833029][ T4851] tipc: Started in network mode [ 42.833747][ T4850] The buggy address is located 24 bytes inside of [ 42.833747][ T4850] 256-byte region [ffff0000d367a400, ffff0000d367a500) [ 42.834593][ T4851] tipc: Node identity 2e762ce3df58, cluster identity 4711 [ 42.836448][ T4850] [ 42.836453][ T4850] The buggy address belongs to the physical page: [ 42.837557][ T4851] tipc: Enabled bearer , priority 0 [ 42.837804][ T4850] page:00000000d95cec77 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11367a [ 42.841200][ T4850] head:00000000d95cec77 order:1 compound_mapcount:0 compound_pincount:0 [ 42.842438][ T4850] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 42.843642][ T4850] raw: 05ffc00000010200 0000000000000000 dead000000000001 ffff0000c0002480 [ 42.844897][ T4850] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 42.846148][ T4850] page dumped because: kasan: bad access detected [ 42.847146][ T4850] [ 42.847488][ T4850] Memory state around the buggy address: [ 42.848351][ T4850] ffff0000d367a300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.849546][ T4850] ffff0000d367a380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.850755][ T4850] >ffff0000d367a400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.851844][ T4850] ^ [ 42.852547][ T4851] device syzkaller0 entered promiscuous mode [ 42.853458][ T4850] ffff0000d367a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.854634][ T4850] ffff0000d367a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.855781][ T4850] ================================================================== [ 42.867192][ T4850] Disabling lock debugging due to kernel taint [ 42.868142][ T4850] ------------[ cut here ]------------ [ 42.868933][ T4850] refcount_t: addition on 0; use-after-free. [ 42.869899][ T4850] WARNING: CPU: 0 PID: 4850 at lib/refcount.c:25 refcount_warn_saturate+0x134/0x1f8 [ 42.871162][ T4850] Modules linked in: [ 42.871752][ T4850] CPU: 0 PID: 4850 Comm: syz.4.170 Tainted: G B syzkaller #0 [ 42.872989][ T4850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 42.874415][ T4850] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 42.875519][ T4850] pc : refcount_warn_saturate+0x134/0x1f8 [ 42.876309][ T4850] lr : refcount_warn_saturate+0x134/0x1f8 [ 42.877066][ T4850] sp : ffff800020f975c0 [ 42.877688][ T4850] x29: ffff800020f975c0 x28: ffff0000e0f21428 x27: dfff800000000000 [ 42.878863][ T4850] x26: ffff0000d38e3400 x25: dfff800000000000 x24: 1fffe0001a6cf483 [ 42.879996][ T4850] x23: 0000000000000000 x22: ffff0000d367a410 x21: ffff0000d2def2e0 [ 42.881094][ T4850] x20: ffff0000d367a410 x19: ffff800017bd9000 x18: ffff800011b8bf60 [ 42.882216][ T4850] x17: 0000000000000000 x16: ffff80000804309c x15: 0000000000000002 [ 42.883418][ T4850] x14: 0000000000000001 x13: 1fffe00033ea87a3 x12: 0000000000080000 [ 42.884556][ T4850] x11: 000000000007ffff x10: ffff80002ca57000 x9 : d804026bd62f2e00 [ 42.885666][ T4850] x8 : d804026bd62f2e00 x7 : 0000000000000001 x6 : 0000000000000001 [ 42.886846][ T4850] x5 : ffff800020f97058 x4 : ffff8000152f4cc0 x3 : ffff80000853857c [ 42.888139][ T4850] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000 [ 42.889339][ T4850] Call trace: [ 42.889827][ T4850] refcount_warn_saturate+0x134/0x1f8 [ 42.890583][ T4850] dvb_device_open+0x328/0x388 [ 42.891278][ T4850] chrdev_open+0x3d4/0x518 [ 42.891904][ T4850] do_dentry_open+0x72c/0xf98 [ 42.892586][ T4850] vfs_open+0x7c/0x90 [ 42.893190][ T4850] path_openat+0x1f8c/0x26bc [ 42.893908][ T4850] do_filp_open+0x194/0x384 [ 42.894586][ T4850] do_sys_openat2+0x134/0x3f4 [ 42.895274][ T4850] __arm64_sys_openat+0x118/0x14c [ 42.895966][ T4850] invoke_syscall+0x98/0x2b4 [ 42.896641][ T4850] el0_svc_common+0x138/0x258 [ 42.897325][ T4850] do_el0_svc+0x58/0x130 [ 42.897989][ T4850] el0_svc+0x58/0x128 [ 42.898580][ T4850] el0t_64_sync_handler+0x84/0xf0 [ 42.899318][ T4850] el0t_64_sync+0x18c/0x190 [ 42.899988][ T4850] irq event stamp: 733 [ 42.900568][ T4850] hardirqs last enabled at (733): [] finish_lock_switch+0xb0/0x1c4 [ 42.901904][ T4850] hardirqs last disabled at (732): [] __schedule+0x298/0x1b0c [ 42.903114][ T4850] softirqs last enabled at (170): [] local_bh_enable+0x10/0x34 [ 42.904371][ T4850] softirqs last disabled at (168): [] local_bh_disable+0x10/0x34 [ 42.905676][ T4850] ---[ end trace 0000000000000000 ]--- [ 42.909243][ T4848] ------------[ cut here ]------------ [ 42.910144][ T4848] refcount_t: underflow; use-after-free. [ 42.911737][ T4848] WARNING: CPU: 1 PID: 4848 at lib/refcount.c:28 refcount_warn_saturate+0x154/0x1f8 [ 42.913177][ T4848] Modules linked in: [ 42.913697][ T4848] CPU: 1 PID: 4848 Comm: syz.4.170 Tainted: G B W syzkaller #0 [ 42.914889][ T4848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 42.916317][ T4848] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 42.917330][ T4848] pc : refcount_warn_saturate+0x154/0x1f8 [ 42.918194][ T4848] lr : refcount_warn_saturate+0x154/0x1f8 [ 42.918990][ T4848] sp : ffff8000210079b0 [ 42.919585][ T4848] x29: ffff8000210079b0 x28: ffff0000cfa498f8 x27: 1fffe0001c1e4285 [ 42.920699][ T4848] x26: 00000000ffff9b91 x25: ffff0000d30e9800 x24: ffff0000d367a400 [ 42.921799][ T4848] x23: dfff800000000000 x22: ffff0000d30e9b20 x21: 00000000c0000000 [ 42.923024][ T4848] x20: ffff0000d367a410 x19: ffff800017bd9000 x18: ffff800011b8bf60 [ 42.924161][ T4848] x17: 1fffe00033eac97e x16: ffff80000804309c x15: 0000000040000000 [ 42.925384][ T4848] x14: 0000000000000001 x13: 1fffe00033eaf030 x12: 0000000000ff0100 [ 42.926569][ T4848] x11: ff00800008048348 x10: 0000000040000000 x9 : 268ec2fa2d7b3200 [ 42.927703][ T4848] x8 : 268ec2fa2d7b3200 x7 : 0000000000000004 x6 : ffff80000825796c [ 42.929014][ T4848] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 [ 42.930163][ T4848] x2 : ffff800021007540 x1 : 0000000000000000 x0 : ffff800008257a00 [ 42.931256][ T4848] Call trace: [ 42.931725][ T4848] refcount_warn_saturate+0x154/0x1f8 [ 42.932484][ T4848] dvb_generic_release+0x16c/0x1e0 [ 42.933162][ T4848] dvb_frontend_release+0x114/0x400 [ 42.933891][ T4848] __fput+0x1bc/0x7b8 [ 42.934429][ T4848] ____fput+0x20/0x30 [ 42.934966][ T4848] task_work_run+0x1ec/0x278 [ 42.935643][ T4848] do_notify_resume+0x1fa0/0x2aa4 [ 42.936317][ T4848] el0_svc+0x98/0x128 [ 42.936897][ T4848] el0t_64_sync_handler+0x84/0xf0 [ 42.937635][ T4848] el0t_64_sync+0x18c/0x190 [ 42.938294][ T4848] irq event stamp: 3044 [ 42.938890][ T4848] hardirqs last enabled at (3043): [] _raw_spin_unlock_irqrestore+0x48/0xac [ 42.940353][ T4848] hardirqs last disabled at (3044): [] __schedule+0x298/0x1b0c [ 42.941792][ T4848] softirqs last enabled at (3034): [] local_bh_enable+0x10/0x34 [ 42.943199][ T4848] softirqs last disabled at (3032): [] local_bh_disable+0x10/0x34 [ 42.944616][ T4848] ---[ end trace 0000000000000000 ]--- [ 42.949444][ T4849] tipc: Resetting bearer [ 43.003037][ T4849] tipc: Disabling bearer