last executing test programs: 369.397566ms ago: executing program 4 (id=5): socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x3, 0x3}, 0x4) (async) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x3, 0x3}, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'veth1_to_hsr\x00'}) socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) prlimit64(0x0, 0xa, &(0x7f0000000140)={0x8, 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYRES32=r1, @ANYRES16=r3, @ANYBLOB="0100040000fb0100000009000000"], 0x14}, 0x1, 0x0, 0x0, 0x20044044}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0xff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0xfffffffffffffdd1) (async) connect$unix(r6, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0xfffffffffffffdd1) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f0000000000), 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1d8, 0xc8, 0x8, 0x1d8, 0x5803, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff], 'pimreg\x00', 'wlan0\x00', {}, {}, 0x2c, 0x1, 0x1, 0x51}, 0x0, 0x190, 0x1d8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x8, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3274e082555f6722282f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5000000000800", 0x1, 0x1, {0xfffffffffffffffe}}}, @common=@inet=@ecn={{0x28}, {0x1, 0x11, 0x8, 0x6}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x0, 0x3, 'pptp\x00', {0x100000000}}}}, {{@ipv6={@remote, @mcast1, [0xff000000, 0x100000100], [], 'macvtap0\x00', 'macsec0\x00', {}, {}, 0x87}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xffffffff, 0x0, 'netbios-ns\x00', 'syz0\x00', {0xd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) socket$pptp(0x18, 0x1, 0x2) (async) socket$pptp(0x18, 0x1, 0x2) syz_open_dev$tty1(0xc, 0x4, 0x4) r8 = fsopen(&(0x7f0000000240)='mqueue\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r8, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r8, 0x0, 0x37) openat$cgroup_subtree(r9, &(0x7f0000000100), 0x2, 0x0) (async) r10 = openat$cgroup_subtree(r9, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r10, &(0x7f00000000c0)=ANY=[@ANYRES32=r6, @ANYRESDEC=0x0], 0x5) setsockopt$inet_tcp_int(r1, 0x6, 0x4, &(0x7f0000000200)=0x28f, 0x4) (async) setsockopt$inet_tcp_int(r1, 0x6, 0x4, &(0x7f0000000200)=0x28f, 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xe, &(0x7f0000000180)=0xf42, 0x4) (async) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xe, &(0x7f0000000180)=0xf42, 0x4) 364.668565ms ago: executing program 1 (id=2): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2200c050}, 0x0) mkdirat(0xffffffffffffffff, 0x0, 0x48) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0401030c"], 0x7) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) getsockname$inet6(r1, &(0x7f0000000780)={0xa, 0x0, 0x0, @initdev}, &(0x7f00000007c0)=0x1c) pipe2$watch_queue(0x0, 0x80) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000700), 0x80000, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRESOCT=r3, @ANYBLOB="01000cbd7010040000000500000008ea09000a00000008000c00a80a100008000b0000000000060001000700"], 0x40}, 0x1, 0x0, 0x0, 0x44811}, 0x8821) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000800)={{0x1, 0x1, 0x18, r4, {0x9}}, './file0\x00'}) bind$inet6(r1, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x50, &(0x7f0000000600)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa348100000086dd60910100001611fffe8000000000000000000000000000bbfe8000000000000000000000000000aa00000e220016907802030000000000000044000000004e8329904127be7d745e573283ef253b2d97adf924e60a6e51444931e33a1d832e03babf660bed658b0763fe3bbe93d13c1e106236d95d98ec4e44b2c24f584bbda661dd9944235c71cdf6b6ce96d2237edcbb851a2570d35291264ca93f11219647c2033f1868df4fb969677cc0005a0fb12d9976cd3730d32399762908b3bf8c2e30ff41c6586a99d85fdf67af0a99ab"], 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40) syz_emit_ethernet(0x4a, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6000ed6a000b2c00fe8000000000000000000000000000bbfee900000000000000000000000000aa2c00000368dd03556f91e16511da512132b36787b26e16911c38065a", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x5}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000040)="2703022b590200330000002f1eafbcf706e1050000008864000f1102ee16002182973d2bd4b8bf4a8291a14b8a34f90186cee844000000080000000019b0fb0bba", 0x41}, {&(0x7f0000000440)="63f805d7649496db72959832930469edc7b7d050139bf7ada32bc9e37eed1153ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d3333ce2ef36205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5a08ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb0000000000000000", 0x87}, {&(0x7f0000000280)="fe112162c63e6da8bc8432294ef18af53cc330a62a2c7035246635093ba4d30fcf19a90804f04a10939db8f4e13069cda6d167bf1b68c94d8d694d6ad1a4d51a715975560ad48770706eb1b88d021e1119f2eb75275cfe77f862368649be0f7aff5e7826729816e3d3e7986d9434f891c71ca6e4210c6757083cfd8e732048c504f28b6d309fc129ed8eb5a82e224eb648f90134d1d315977c6ea360a7fece4baa3dd7dcc970759f29df0e86469e954e2b050e87b203ca27a2a519b7555c3b73f2681d49442d9647ff5ea64110cc5020fdeafe53a7d8be70f3260816bc376bcdc5352771fa55d9733e27730ec7103520e8359c78edd21ee6c68feb3685a55722f5da09ffe8ba9f05081a8d214156376f99906245f2f390ad717979d98f0574f8c5b52dcc2fa494f461be6c2560ddbaafb80c5b4583cbe56d24f14ab78fd718947077ea736251c7b8eee267267534c84daa6f095e94bfb85986a03ddea362cc7e6682884e710727c1163cd4f336c13b844605b7a815fe39e43bd0d2e414410a82958455b8a6bd9194c631d66295675fed64c04107a595c421111a3af6e9fadab5c9", 0x1a1}, {&(0x7f0000000180)="6fe4dd9eeba3271dc700b581440284", 0xfe69}], 0x4}, 0x0) 288.509644ms ago: executing program 1 (id=6): r0 = syz_open_dev$evdev(&(0x7f0000000340), 0x0, 0x2000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r1 = io_uring_setup(0x1555, &(0x7f0000000240)={0x0, 0x6522, 0x2, 0x1, 0x19e}) mmap$IORING_OFF_CQ_RING(0x0, 0x1000, 0x1000000, 0x4052, r1, 0x8000000) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={r2, 0xffffffffffffffff, 0x2d, 0x0, @val=@netfilter={0xc, 0x0, 0x6}}, 0x20) clock_gettime(0x0, &(0x7f0000000640)={0x0, 0x0}) ppoll(&(0x7f0000000600)=[{r0}], 0x1, &(0x7f0000000680)={r3, r4+60000000}, &(0x7f00000006c0)={[0x42a]}, 0x8) syz_clone(0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/devices/vhci_hcd.0/driver/unbind\x00', 0x1, 0x0) write(r5, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/devices/vhci_hcd.0/driver_override\x00', 0x1, 0x0) write(r6, &(0x7f0000000180)='vhci_hcd\x00', 0x8) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = geteuid() write$P9_RSTATu(r6, &(0x7f0000000900)={0x6f, 0x7d, 0x2, {{0x0, 0x54, 0x6, 0x6, {0x20, 0x1, 0x6}, 0xd040000, 0x2, 0x100, 0xfffffffffffffff9, 0xb, 'securityfs\x00', 0x1, '#', 0x3, '-/)', 0x12, '/dev/input/event#\x00'}, 0x6, '//({--', 0x0, 0x0, r8}}, 0x6f) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000140)={'batadv0\x00', &(0x7f0000000000)=@ethtool_stats}) r9 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0) write(r9, &(0x7f0000000200)='vhci_hcd.0\x00', 0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r10, &(0x7f0000000100)='select \n', 0x10) write(r10, &(0x7f0000000100)='file read /etc/passwd exec.argv[0]=\"sh\" exec.envp[\"PATH\"]=\"/bin\"\n', 0x4c) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r10, 0x89f0, &(0x7f0000000300)={'syztnl0\x00', &(0x7f0000000280)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x0, 0x800, 0x17, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @loopback, 0x700, 0x7800, 0x2, 0xc}}) r12 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x9, '\x00', 0x0, r10, 0x5, 0x3, 0x3}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x9, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0xb2, 0x0, 0x0, 0x0, 0x100}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffd}, @tail_call={{0x18, 0x2, 0x1, 0x0, r10}}]}, &(0x7f0000000200)='syzkaller\x00', 0x913, 0x3b, &(0x7f0000000240)=""/59, 0x40f00, 0x26, '\x00', r11, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000380)={0x8000002, 0x1}, 0x8, 0x10, &(0x7f00000003c0)={0x5, 0x7, 0x8001, 0x8}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000480)=[r10, r12, r10], &(0x7f00000004c0)=[{0x0, 0x4, 0x1, 0x1}, {0x1, 0x1, 0xe}, {0x2, 0x1, 0x1, 0xb}, {0x4, 0x5, 0x7, 0x8}, {0x3, 0x3, 0x6, 0x2}, {0x2, 0x3, 0xe, 0x5}], 0x10, 0x2}, 0x94) ioctl$EVIOCGVERSION(r0, 0x5452, &(0x7f0000002200)=""/188) 251.984475ms ago: executing program 3 (id=4): syz_clone(0x9126000, 0x0, 0x0, &(0x7f0000005c00), 0x0, 0x0) r0 = socket$inet6(0xa, 0x4, 0xfffffffc) syz_emit_vhci(&(0x7f0000000480)=ANY=[@ANYBLOB="02c9000e000a506b010000000000ff46ff0000bb6b5c6a0b9ddbc277156fc01364fefed91b56f6b8b49af9912b328205cb5517019cef90c72bca2351d2de3cccd64a150ebe1203b8458c5e"], 0x13) (async) syz_emit_vhci(&(0x7f0000000480)=ANY=[@ANYBLOB="02c9000e000a506b010000000000ff46ff0000bb6b5c6a0b9ddbc277156fc01364fefed91b56f6b8b49af9912b328205cb5517019cef90c72bca2351d2de3cccd64a150ebe1203b8458c5e"], 0x13) lsetxattr$smack_xattr_label(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.SMACK64IPOUT\x00', &(0x7f00000000c0)={']()!'}, 0x51, 0x2) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000340)=0xc6, 0x4) setsockopt$inet6_IPV6_DSTOPTS(0xffffffffffffffff, 0x29, 0x3b, &(0x7f0000000580)={0x1, 0x3a, '\x00', [@generic={0x1, 0xb9, "f5cb870334a7c2b6a2b691e1ea68eee7489e4d00ba615611eac0d2892250b9a71c65cb432a0026ebf78fa25f7a14a701921101574d9518185ae09146ba30091bc0993c6b4710484fdfefcdad0ce251c86268a6f81a57f17fc70a447a23ecaef335620c60d5eb85e2929ffcc77e3f720de6d938c241a77484adf497723c897c556f0c30324ad01612aafea0885f3f941a4584ffa6fa9418fadf2bea4f0f578b400a9ce793a49fd1e83ef586e65a391fedb96319e86decdab824"}, @generic={0x2, 0xcd, "26c9d684734a39048e21f8dce5408890f41eb462b3e7bb8761b45ca2d2a5a1289bf1b6c07fac8c755fcd400798611c82df1bd5af1e10838a5528b6e917241dc215d3917b0b7738b6ce8b46ef6431fd1149ce43c47a81662f941e0bcbae084b6073de0d4388eba62d0259bd7e467046580f1f5af573e14a9f5a04c56aba6f1e344f00278db978fd8265cbf97b1ea63c61cc65596c7eb7dbaf1ba513cdb930b0d9c5b9b4b46a456e80f15bb58a59fbe843bd4011c5a369b7dafe61340dda2bbeb2944a1cf4311b5a6dae3832d2db"}, @padn={0x1, 0x1, [0x0]}, @calipso={0x7, 0x28, {0x1, 0x8, 0x6, 0x5, [0x2, 0x100000000, 0x6, 0x7f]}}, @hao={0xc9, 0x10, @loopback}, @enc_lim={0x4, 0x1, 0x6}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}]}, 0x1e0) recvfrom(r0, 0x0, 0x0, 0x120, &(0x7f0000000380)=@tipc=@id={0x1e, 0x3, 0x2, {0x4e21, 0x4}}, 0x80) (async) recvfrom(r0, 0x0, 0x0, 0x120, &(0x7f0000000380)=@tipc=@id={0x1e, 0x3, 0x2, {0x4e21, 0x4}}, 0x80) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x5, @empty}, 0x1c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000240), 0x8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xc, &(0x7f0000000400)=ANY=[@ANYBLOB="1800f4ffffff00000000000000000000181100000c6c2751fbd6ed2dc0dee32f569e03dacb03276f453ad4f24f3e279647d99d7d8506cace", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x2b, 0x1, 0x1) (async) r3 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) syz_emit_vhci(&(0x7f0000000200)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e5b, 0x80000000, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x5}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x20, 0x4, 0x0, 0x5907}, {0x20, 0x0, 0x0, 0xfffff024}, {0x6, 0x0, 0x0, 0x3}]}, 0x10) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000080)=ANY=[], 0xdd12}], 0x1, 0x0, 0x0, 0x1}, 0x200488d4) sendmmsg(r4, &(0x7f0000001c00), 0x400000000000159, 0x40840) (async) sendmmsg(r4, &(0x7f0000001c00), 0x400000000000159, 0x40840) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) r7 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fc, 0x301) ioctl$USBDEVFS_REAPURB(r7, 0x4004550c, 0xfffffffffffffffe) (async) ioctl$USBDEVFS_REAPURB(r7, 0x4004550c, 0xfffffffffffffffe) ioctl$USBDEVFS_SUBMITURB(r7, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0x0, 0x40, &(0x7f0000000000)={0x4b5a9da54893e123, 0x14, 0x8, 0x2}, 0x8, 0x7, 0x200, 0x0, 0x0, 0x20000, 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c000000100003042abd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="b4a5af8840000000140012800b00010062617461647600000400028008001f0003000000a845d267071deb13a9c732b6284b4087452abf80c29a9f5748"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c000000100003042abd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="b4a5af8840000000140012800b00010062617461647600000400028008001f0003000000a845d267071deb13a9c732b6284b4087452abf80c29a9f5748"], 0x3c}}, 0x0) setsockopt$inet6_tcp_buf(r6, 0x6, 0x1f, 0x0, 0x0) (async) setsockopt$inet6_tcp_buf(r6, 0x6, 0x1f, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r1}, &(0x7f0000000000), &(0x7f0000000040)=r2}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r1}, &(0x7f0000000000), &(0x7f0000000040)=r2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001940)={r1, &(0x7f0000000100)="54757ed2eac79143ef050c973b6dd3ce0af5460612cb22420fed3ef728d2fb21830b88b842de332611cbb5634a5f7b182503aa4beeec3860069cb6331df0f35671aebf065ccde399c89606eb7c8251d2fed9e15d1d9ce4ca741d27e42106c29b97d5a53281a0ae19918c5964e391d49ef675f3ceb9805d357533ab96471f68fa3cb5c305766ae437f05945651efb55e96e9bbcd0e79413c9667ed5256dfebbfecc62e0b249df92ebc75562", &(0x7f0000000940)=""/4096}, 0x20) syz_emit_ethernet(0xd2, &(0x7f0000000900)=ANY=[@ANYBLOB="ffffffffbfff20000000000086dd600489f1009c1100fc01008c000000000025030000000000ff02000000000000000000000000000100000e22"], 0x0) 179.341238ms ago: executing program 0 (id=1): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'macvtap0\x00', 0x0}) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) socket(0x10, 0x803, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x0, 0x4, 0x0, "e83ae75240c2d6d8ec87bb53679fd0450078548ceb6c4414fab091000000000000000776aea5922406b64cddaeb9d339ba3c01c2c7d0df8e61740b9af2d4e499d58654a4cf0fa0ce1f830c3279cffcfd"}, 0xd8) setsockopt$inet_tcp_int(r2, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) timer_create(0x3, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a01040000000000000000010080000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a312000000098000000060a010400000000000000000100000008000b400000000070000480340001800b000100657874686472000024000280080001400000000c080003400000003b08000440000000220500020007000000380001800c0001006269747769736500280002800800034000000004080001400000001408000240000000120800064000000005040005800900010073797a30"], 0x10c}}, 0x0) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000600)="5ce5f722afde7c1d564116cfdc3876cba258ffe95384551a7d54788d7e4f7a6d17f45eb393996e49971a183420ce2be1a6a6385e7ff9b00e9aa2c12e883d3dd3e64e9f305e3fbabd3da08364d14ae3da53009fb2a744d95edfb309e4eb979d5239bbae94ab63d70d00f49df4c763920ab0503466605e1fca2f5a753d1e024a0102cdf645249abeedaf00ee4f4b8accdcb57c1faaea57b28407db60593d5033e8303bb193b6630f5bd972e7c452b1154f7fc20079eeb1831417459c961b329b9e2ec1dc16285e1a5ddddcb919ed5ffbf9cb114610c1444c7702eaba6312a6bc852185980ca26d4003cac3f68741df5558d7a617442a0bbc02f36bd6236394b062699d0f7b74b8ef55f15a8c182138546b92cd4e7e06b46f0578f8a21c3d2aa4c521751bc211f852d9df55ea1edabbf95d90b9894ea685cfb7879b68ee5ff3690c5b49a6c987d50599b7cbca7a26a0be2bad008f1d5219c406c32af4c53bf600c4fdee16bf60c0a31238d9ccf549f1997b4fd501d4ab8c9cb0f9082312abfc64ea8a516fffed538c4f61c5f73bc12ebdf60e47f95264ae74dcafc4bca9b41e79272ca821558919051bf4265e23072557ed13f5b58aabd8e5704c010e8b4341f611db9a9d192bb0c4ed07853a2dd8380d0a18b795e9967ce67e71142045edfa787e8a5dd9471516b7badfe684e1bf334df849a0c548c46d847a2164ee4e8f41e186560750cd3f4250be48595a9e5cd05e28f1b6c87d03cf03022378a51fcaf450dcc6432b69ad389ac4fc57bb7325d1e5594a4adf393d93f8d538a12212e2c0188aebbe1eb52a84b2b5b3d823868736cddc3245b9d4861f87d10769f5c942f4a31b11a5233ffbcf371b48d9f9d1fdb1c2a31dfdd86a43b6db2067b0674a45c45eb070ad89946e19d633ca123c43e1d7dd0a90c3afeef99e6127f222f48079fe01a444ae7757911e6cb27c33288ef498f8cd28cc5bc99a6378e5cefd0a49bba57891a9c28960ed82e5e665e9f6d5efd54ca6620f01fd784a7bf4487dc35930233a0fd80efdb9835469967e60636bd0b9d62efba907c39ec79abf95403fc231f31c7d34fa347cabd3c85eec08284000a491604856813f7fc3576803e5f076d0f76f8ce9cecdf1db1d2ce0dfdd91937fc6ee1bed0d54ecaef9b09caeb7bace1ae15707dfe25782a67d97c2992f2964f13718ef31020348c0e786a52089fc871a3799377942c02d8c7574792b93821602975f35e8602429f36ad5af13eaf637fba276e31839bfe963958fbb7651cf41063f21ef6afafc301a3ed05dce33019b364ae43953378d36c3fe3719f3bc9d1b20372aaea4d4cbca71552530dd71f86384f55df6bb3f8cbb893d76b0be9af3533a5420c867ab9734ed8932dfef88fca2d253c0d7f8d10fef500599dcb940b98487ee194857d1606268f831195a3b0a188949e103d61cff91dda3e28fe5f46347e788e13072e984df559144145ffb946c82f6b66cfbe670acef44b15fed3e13c9afdd0187447eb7646dc29b9ef400227e8df8447879c654690366b38f8332987a0167d9a0a7a52a1cef2bf7b827877db8a5d3be6ff782d0438b11a5cfff7a28585779608aee42bfc3fd907898f2d1b34d0b5273267913c9d1628e2ed107cf5e1b08e1fbc12ef872fd7d5b6bc85d9964b2021fc90cad88af27b5ccf38435f2b988d20426167e0d0b13554bcf3f83e885e00fc3523b54c714c799a8706d09d643f61547987bf493a9cf72655edd6125e5391899059176f040064ec4bdfdf12bccdd79b05d519ba8bf088db22c8bfeaec0328288925ef7cf29f281d5aaae4c82c9feb1821609cf32e699f55589b18def3e1eec60198bf2fb4a72623a78a9fe56d08342ce9d187cfce3e9f76b38f9dcb09743ece9edd99641383bb9d7581aff586cf23863264022818af2309d2549cfc3f5c96d1ee50d9bdb22d6f0b889e4c150c77d5d373307c579c14f06e279a9b4eff1f850c7054958bb349be02970587583643313f96e6033cd0078cb122bdc88c29d78fc60e8dba3867b197a151e04f786fd56e91a0ffa0fb1d1700f3b72140e3179d4c06c3ba0583e3a9889cac4fad206ff87776ff93b9c78f108316e588458000e3e988c2ab1b4b47d0c650120d52f3067ec783a886f8b72205a441f218b30f2c702285de9b18828de8306c5cc20489cc9e169ad373732c3999a47a605871f45e64ef30e79d2485bed70d76c05474c814379730d2880368a3038fb95196731faf8a2d602a695e98bec34ee9147f23a95351f31063244abf7a3a033ebf1b2560971f63c1966fd5d21126795132d0a3e330bdc524f4e57f720bb776834cce9df55bc497413a32fed3626b194b84266e7c7b9a0d6524e49c81020a25e7cc865589802f12b5872e727873603de7fa2af0f203c9fe0d6019080cea26a4472cd468b753fa329a789067ce0f45c81b40b718f3689d14d20f72ae3180237280163b7cc85530adaeb96724e664a53965f405f53b61b1720944d59aa27b1fb68d0c97d6f94e2690b414636f73a9ad52738a4567ee97a9a074f7467bf943c34ced6044f08cd7cd9a5bce98cff478a3343b7140f5e623bfc958c896d66f22b60d53649666d32ba5c12789e9f7176907ffcb8920b93fdd771523453413da99379e61b1c46a0fac8b8a8c4642913d4e92475de993d35200822795322362f43bb08bd1fc5bbfa7c52f83d6cda415342921db1e0ddca3fafd8fe18122b202bd01f1d1cccb21f177f0aa589c42ce58b014bd979b696c7bec58b3a5552989468b27a67a104c9727204eaaabdc6e49c6ba2a59222ce568f9653f39cdb5dae4f7f3e30fb3ffb5ebf61802fda98526a50e517b4e3619959d93a30b96704484cc93f4ede1565c23cc821f12f1877086ff1df25402c1087d5c0046deacc841b3c56e7c8aba911994cb388f8bd3a0643efcca6f92cc5ff93d1d6560855f4489ef78505f04fbba29b3c6c0f6ca1d388c03d3e21e3ff9061f60c7997d41e32969ae72a1292d1d59f1d44c2fd5a0000ce3ce6db6a1c2c993eb33b65e26adc3265dffb97edad6e30cb7a66b8821c6efc31f2256b921db39374c266123c3ef6c50566ed10cb847a8eb2cb480fc53752af00bfa715ab17040dae63beecb44d9e3cacbb08d7dc2ea17fc46a69ecd130bbc754bc4ff5b67b1a107bce0f07a67ee13df90c1edbbd26190dc7efb736e4529c67af7e8c9c86a6efc4b3826246871a20062ce79c336006b9125f2affb2723d22e4bf762f73517551bd9508714ce95e9110ee7898efbf818f859edecd6036431114740e21b936db252d5e1c0bdbe912c90b5afe6dd3e5a83155c6634a9d5ca9132fdfde1146eb4f43e51be2fa90232a83c267d619e765d2df67612b747b0d7a3d2a73ddd0df65ac67f80d4474c3ac77f5084f43a3a570a651fa6f420243335f4481ee4e6cfade77e1b1e8df89c51bbd180488bb5f8b5dbd7d89c9be29d344f69a083ea4055e875c04774745d6db0d9da9a5e45300e5be3e91eb28cbaa5fe77d05470011e51cabc553165e5ea89f0dd953341a77f27f397184d72f40890984f8761fa9d44d711e4f44cbeea4baf6e6bd50b579db9eb86ca5c30b9066a179c691c0aaca58cc2734ace033c8f6f1bd77fd787736580b9825cbddf3c15e7be451d4084fd6d21504926514b253f56d63b329e0ec71235da1f767d76528bddc6c5b19ec625dc44e53ea998b92ef203c85cd161017782ba85194ca65a9a758ab1c825243fbcad6c7f90ca6feefee36ec78e8f847c245b033b8a81056799259f7fcbb6ab2fc4b3e0f4a9f9d6b518d4019594c89538d20e6d471eb2e33834d244b9832bd91a1c4c6f9806f5c4edf7fd538c1a8622831a325ce17f05831a4958b07d4360e9d78e2ca2f6a02ead8cf9e64308ccac3af6a26fba9d2ca1af61e91c5172abb7bd6842640e2849cec05f89a9552c6487abe7c8697e418f699def69737b37f2e386c517421f04ad071b3726f4f5256c665ce6c65d330a956d52ba59e32e3c3ee33c4cc33864dc11340db58c2d06621623311025bf4aed22bab73dba20a2c51b550918f6afebfe347e62b8be78a0363867c1f1849faf8af59a4abebbceed3afc2effad08ea79ffac6e687fab119a5957a1363317363c6877a9c2c9dcdbc9722bcf90cbbd067696a94ce3db5969d35e10e84750dfab911f5f2d0f232b4d8de76025fb8326c322cbfc02e134f6647b56ec3b67ff877deae5f534fc4af0af351453be68d9c0e740533c458503fe8094eb44b2c16ecbb856fa01053e44812a1a763ec0e459eb993f6884aabccdffd1a8a33e8d3805f4086cc40421a75ceb7c36996bce383fc208bf56b75fa10253b6e13c11dd7de50a57507ae89615cdc3d19ae3ad3ccacce7e4af0db6fa9eb890346d1f09d4167df432505863397170b984bdaeb19d853bad6a866cd216f77627f5c01120f06060b6b09b62b890bf2bcf18904c9f54726ea7116222c5b39d774e1aeac4aac3b6731289a40c5c6a4da49582cfdf76982633a04886858ed8f4f7f933b1f4b4b9ce67ede2d0960d26b336572720a91fafbe6d3d2490cfc8e7e63e153f15dab8c1377315e1483c18926d8bba7126437c106b14acf3fd7bb06523eb3e6f66b393e82a8d24c422cad441bd2e399df06091ffe28622bcbd00f3d7ca572892cfaf3ec3f9b66858d04e1b67d2f190448b3bdf07974442539073b9d90f9f4a4ef8412f9e4142622efa3e6c3a69fa5b043424acfba50c01bd5df09986131fb406ea678fe8336d3ca271dbaf665c77c4f1a718c6c73c68e1f26aaa1733890b1a0eb112365d754d951bbc15c66ff650e9933dc304b7c577b2c5b53869c3c7d610b44dfcb2fc3b48cbda1c0780186de75a6c4719a7d71079ab7765b5305a2fc9c1abf4e5f2a7a85be2eb35a9304606af18abf8cd59cdc2c507c9d115147fdf61bf076d6900d1a1330cecaf865a03a6a20d026a0209b87e305d9fd0f4aa811208ad44da7de4a243825ae96c7525832f00c6f7e1828334a3e783ab5adc07b81d06880cec1158e940b231b3dc0c2df2faf594a67a2fd53a5720798b14cc510cacc9560b9b777747072ec23d4995a8a614003e8f635c0f88681239a2722683f14e587affff88e76e5a60b468b75f05d7caa439ce8d292874321ef66c0b06765c245c597d94d595fecd20615eb66ecbce90747750a82ce06e9d37564472636577624a17dacf5f90829cdfdf03409dce8f919bb7bba7eb297db9232d7ad7d2f22ed10e2bc78b50fdbe5504bc0bcfc8eeb1cad95e7f5aa67387d355b6795807c027cc2ea4e8cd19cdba3e7975a32c99b5c3ab9e7a4f440cbd834048547f0f6539f77ae4bcf7c704d5b02b80ba019c2d5ee825b79b7d2441161ae5f3dae16efb4e1a7b283478ec964c519c81ca543167f2bafe743db8a5fbb107568dd6c27394f414211024ba7132f10cad7d01c1b73d6ebe88574a8c5f0797d26ba412bfb8f9facc91427f9542f7343a059cd65c6d4668312f77f67b509178c9f48d2d6169ab26d03ef346f96dcbfd222aaa77d6aa266e494db490e4b973ed3d431f83f1c27037db5deac37fa1c7bb31a0ff564082eeaddf61cd5e5bff6c4b458eae8d2d03ea13e19f4592921327c36cdae5c5af4687395ea6a5ffc2d042182a17470716b5e70c77cce4e81f918103f8d57871628f1e67c688b5b1e2bbc1c18331e14f3aeb966d7d99bc42b84bf6f8f8cc0c2260869f7da7eed55104116eebe629d7081fb6dc877eb1e763805316f8be66c8df009a9f4144b993c43d464", 0xff7}], 0x1}, 0x4040000) setns(0xc9, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x42000, 0x2}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x12, @private1}, @IFLA_GENEVE_ID={0x8, 0x1, 0x4}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40680c5}, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000340)) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r1, {0x0, 0x4}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x3c, 0x28, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffdfc, {0x0, 0x0, 0x0, r1, {0x7}, {0x0, 0xfff1}, {0x2, 0x9}}, [@qdisc_kind_options=@q_blackhole={0xe}, @TCA_RATE={0x6, 0x5, {0x4, 0x5}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40098}, 0x4040000) 171.281262ms ago: executing program 2 (id=3): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r1 = syz_open_dev$loop(&(0x7f0000000240), 0x75f, 0xa8182) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() ioctl$BLKROSET(r1, 0x125d, &(0x7f0000000040)=0x100) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mount(0x0, 0x0, &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r5, 0x1, 0xc, &(0x7f0000000000)=0x101, 0x4) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=@base={0x4, 0x4, 0x4, 0x10005}, 0x48) close(r6) sendmsg$tipc(r0, &(0x7f00000005c0)={&(0x7f0000000000), 0x10, &(0x7f0000000480)=[{&(0x7f0000000180)="f7", 0x101d0}], 0x1}, 0x0) 0s ago: executing program 3 (id=7): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() rt_tgsigqueueinfo(0x0, 0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r3 = syz_io_uring_setup(0x18d6, &(0x7f00000000c0)={0x0, 0x5352, 0x8, 0x2000, 0x99}, &(0x7f0000ffe000), &(0x7f00000004c0), &(0x7f0000000000)) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x1b, &(0x7f0000000000)={@remote, 0x0, 0x2}, 0x20) r5 = io_uring_setup(0x1020, &(0x7f00000000c0)={0x0, 0x0, 0x3000, 0x1, 0xfefffffd}) io_uring_register$IORING_REGISTER_RESIZE_RINGS(r5, 0x21, &(0x7f0000005500)={0x0, 0x2fc3f, 0x20, 0x2, 0x37a}, 0x1) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r7, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_CALL(r7, 0x4008af21, &(0x7f0000000040)={0x0, r6}) r8 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) setrlimit(0x2, &(0x7f0000000080)={0x0, 0x8000000000000000}) pread64$ublk_ch(r8, &(0x7f0000001f80)=@buf_max_buf, 0x1000, 0x100000000801) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r3, 0x2, &(0x7f0000000180), 0xfe) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.207' (ED25519) to the list of known hosts. [ 27.746977][ T4702] cgroup: Unknown subsys name 'net' [ 27.828248][ T4702] cgroup: Unknown subsys name 'cpuset' [ 27.830364][ T4702] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 27.947075][ T4702] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 28.780595][ T4726] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 28.781334][ T4726] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 28.781589][ T4726] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 28.781759][ T4726] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 28.782189][ T4726] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 28.782393][ T4726] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 28.789948][ T4728] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 28.791498][ T4726] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 28.791869][ T4726] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 28.792106][ T4726] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 28.792273][ T4726] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 28.792507][ T4726] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 28.792812][ T4726] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 28.793397][ T4726] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 28.793514][ T4726] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 28.793926][ T4726] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 28.794092][ T4726] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 28.794663][ T4726] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 28.794910][ T4726] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 28.797978][ T4728] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 28.798125][ T4726] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 28.799651][ T4728] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 28.801555][ T4726] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 28.801696][ T4726] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 28.808111][ T4713] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 29.116458][ T4719] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.116727][ T4719] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.116798][ T4719] bridge_slave_0: entered allmulticast mode [ 29.117292][ T4719] bridge_slave_0: entered promiscuous mode [ 29.120835][ T4719] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.120859][ T4719] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.120966][ T4719] bridge_slave_1: entered allmulticast mode [ 29.121392][ T4719] bridge_slave_1: entered promiscuous mode [ 29.129845][ T4719] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.130840][ T4719] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.149421][ T4719] team0: Port device team_slave_0 added [ 29.150723][ T4719] team0: Port device team_slave_1 added [ 29.182448][ T4719] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.182480][ T4719] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.182491][ T4719] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.183233][ T4719] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.183242][ T4719] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.183257][ T4719] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.194492][ T4719] hsr_slave_0: entered promiscuous mode [ 29.194840][ T4719] hsr_slave_1: entered promiscuous mode [ 29.259660][ T4712] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.261241][ T4712] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.262742][ T4712] bridge_slave_0: entered allmulticast mode [ 29.264235][ T4712] bridge_slave_0: entered promiscuous mode [ 29.274769][ T4712] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.277327][ T4712] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.278728][ T4712] bridge_slave_1: entered allmulticast mode [ 29.281026][ T4712] bridge_slave_1: entered promiscuous mode [ 29.299423][ T4718] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.299520][ T4718] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.299590][ T4718] bridge_slave_0: entered allmulticast mode [ 29.300057][ T4718] bridge_slave_0: entered promiscuous mode [ 29.309684][ T4720] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.310347][ T4720] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.310421][ T4720] bridge_slave_0: entered allmulticast mode [ 29.310864][ T4720] bridge_slave_0: entered promiscuous mode [ 29.311903][ T4718] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.311935][ T4718] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.311992][ T4718] bridge_slave_1: entered allmulticast mode [ 29.312403][ T4718] bridge_slave_1: entered promiscuous mode [ 29.314464][ T4712] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.316071][ T4712] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.333665][ T4720] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.333751][ T4720] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.333854][ T4720] bridge_slave_1: entered allmulticast mode [ 29.334277][ T4720] bridge_slave_1: entered promiscuous mode [ 29.349937][ T4720] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.352726][ T4720] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.359245][ T4718] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.363180][ T4712] team0: Port device team_slave_0 added [ 29.371845][ T4718] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.372471][ T4712] team0: Port device team_slave_1 added [ 29.378256][ T4715] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.378337][ T4715] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.378396][ T4715] bridge_slave_0: entered allmulticast mode [ 29.378827][ T4715] bridge_slave_0: entered promiscuous mode [ 29.380042][ T4715] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.380064][ T4715] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.380115][ T4715] bridge_slave_1: entered allmulticast mode [ 29.380592][ T4715] bridge_slave_1: entered promiscuous mode [ 29.401432][ T4720] team0: Port device team_slave_0 added [ 29.403033][ T4718] team0: Port device team_slave_0 added [ 29.403324][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.403331][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.403345][ T4712] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.404242][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.404252][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.404268][ T4712] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.406620][ T4715] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.407740][ T4715] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.409216][ T4719] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 29.413768][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.414604][ T4718] team0: Port device team_slave_1 added [ 29.430360][ T4720] team0: Port device team_slave_1 added [ 29.436963][ T4719] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 29.439125][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.443274][ T4718] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.443295][ T4718] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.443324][ T4718] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.444487][ T4715] team0: Port device team_slave_0 added [ 29.445923][ T4715] team0: Port device team_slave_1 added [ 29.451761][ T4715] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.451770][ T4715] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.451785][ T4715] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.452317][ T4715] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.452324][ T4715] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.452338][ T4715] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.463474][ T4715] hsr_slave_0: entered promiscuous mode [ 29.463770][ T4715] hsr_slave_1: entered promiscuous mode [ 29.464004][ T4715] debugfs: 'hsr0' already exists in 'hsr' [ 29.464043][ T4715] Cannot create hsr debugfs directory [ 29.473078][ T4720] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.474313][ T4720] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.475803][ T4720] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.476467][ T4720] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.476476][ T4720] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.476489][ T4720] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.476659][ T4719] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 29.480692][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.486088][ T4712] hsr_slave_0: entered promiscuous mode [ 29.486833][ T4712] hsr_slave_1: entered promiscuous mode [ 29.487049][ T4712] debugfs: 'hsr0' already exists in 'hsr' [ 29.487059][ T4712] Cannot create hsr debugfs directory [ 29.487352][ T4718] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.487358][ T4718] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.487370][ T4718] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.495099][ T4719] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 29.497038][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.520355][ T4720] hsr_slave_0: entered promiscuous mode [ 29.522102][ T4720] hsr_slave_1: entered promiscuous mode [ 29.523393][ T4720] debugfs: 'hsr0' already exists in 'hsr' [ 29.524513][ T4720] Cannot create hsr debugfs directory [ 29.546808][ T4718] hsr_slave_0: entered promiscuous mode [ 29.548562][ T4718] hsr_slave_1: entered promiscuous mode [ 29.549834][ T4718] debugfs: 'hsr0' already exists in 'hsr' [ 29.550929][ T4718] Cannot create hsr debugfs directory [ 29.599764][ T4719] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.599817][ T4719] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.599972][ T4719] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.600008][ T4719] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.653205][ T4715] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 29.655409][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.658635][ T4715] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 29.661021][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.662540][ T4715] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 29.664706][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.666424][ T4715] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 29.668857][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.690719][ T4715] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.690762][ T4715] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.690843][ T4715] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.690871][ T4715] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.700273][ T4720] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 29.702556][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.704466][ T4720] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 29.707229][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.708190][ T4720] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 29.709800][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.711280][ T4719] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.717575][ T4720] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 29.720209][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.727008][ T4719] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.728576][ T15] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.730061][ T15] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.737270][ T15] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.739027][ T15] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.755480][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.755551][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.756950][ T15] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.756977][ T15] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.786149][ T4712] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 29.788481][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.789051][ T4712] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 29.792028][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.792341][ T4712] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 29.796983][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.798767][ T4712] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 29.800943][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.817966][ T4720] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.821615][ T4720] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.826609][ T4715] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.838373][ T1267] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.838417][ T1267] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.850839][ T4715] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.861231][ T1267] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.861271][ T1267] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.861650][ T1267] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.861668][ T1267] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.862034][ T1267] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.862053][ T1267] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.869998][ T4718] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 29.872551][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.873171][ T4718] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 29.876149][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.885710][ T4718] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 29.888636][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.890400][ T4718] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 29.892659][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.910081][ T4720] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 29.912068][ T4720] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 29.960033][ T4712] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.968323][ T4719] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.974299][ T4712] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.010442][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.010492][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.010873][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.010907][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.021128][ T4718] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.024313][ T4712] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.032915][ T4718] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.040964][ T3286] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.041015][ T3286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.041853][ T3286] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.041899][ T3286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.128775][ T4719] veth0_vlan: entered promiscuous mode [ 30.147713][ T4715] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.152318][ T4719] veth1_vlan: entered promiscuous mode [ 30.183708][ T4720] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.208548][ T4719] veth0_macvtap: entered promiscuous mode [ 30.209702][ T4719] veth1_macvtap: entered promiscuous mode [ 30.222100][ T4715] veth0_vlan: entered promiscuous mode [ 30.240401][ T4719] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.241499][ T4719] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.249138][ T39] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.249661][ T39] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.249704][ T39] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.249728][ T39] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.250539][ T4720] veth0_vlan: entered promiscuous mode [ 30.252779][ T4720] veth1_vlan: entered promiscuous mode [ 30.274461][ T4720] veth0_macvtap: entered promiscuous mode [ 30.280690][ T4715] veth1_vlan: entered promiscuous mode [ 30.289028][ T4720] veth1_macvtap: entered promiscuous mode [ 30.303536][ T4712] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.308211][ T4718] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.319999][ T4715] veth0_macvtap: entered promiscuous mode [ 30.321082][ T4715] veth1_macvtap: entered promiscuous mode [ 30.322755][ T4720] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.324412][ T4720] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.343674][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.343704][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.375096][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.375127][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.381864][ T39] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.382066][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.382094][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.385477][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.385488][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.388120][ T15] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.388805][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.388828][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.396361][ T4715] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.399041][ T4715] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.411952][ T4712] veth0_vlan: entered promiscuous mode [ 30.420052][ T4712] veth1_vlan: entered promiscuous mode [ 30.424888][ T4718] veth0_vlan: entered promiscuous mode [ 30.432054][ T4718] veth1_vlan: entered promiscuous mode [ 30.449895][ T4719] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.455064][ T4718] veth0_macvtap: entered promiscuous mode [ 30.464177][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.464206][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.470273][ T4712] veth0_macvtap: entered promiscuous mode [ 30.472655][ T4712] veth1_macvtap: entered promiscuous mode [ 30.482008][ T4718] veth1_macvtap: entered promiscuous mode [ 30.513560][ T3286] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.513594][ T3286] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.519194][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.521783][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.524563][ T4718] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.533326][ T4718] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.547327][ T129] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.585141][ T3286] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.585170][ T3286] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.587828][ T3286] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.594257][ T4896] xt_CT: No such helper "netbios-ns" [ 30.611874][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.611912][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.631394][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.633226][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.640294][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.641955][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.646145][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.646340][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.646464][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.646561][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.646577][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.646590][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.646603][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.646617][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.646630][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.646643][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.681317][ T4713] Bluetooth: Unexpected start frame (len 14) [ 30.705475][ T4908] vhci_hcd vhci_hcd.0: remove, state 4 [ 30.707547][ T4908] usb usb3: USB disconnect, device number 1 [ 30.791968][ T15] vhci_hcd vhci_hcd.0: stop threads [ 30.792004][ T15] vhci_hcd vhci_hcd.0: release socket [ 30.792046][ T15] vhci_hcd vhci_hcd.0: disconnect device [ 30.796741][ T3286] vhci_hcd vhci_hcd.0: stop threads [ 30.796766][ T3286] vhci_hcd vhci_hcd.0: release socket [ 30.796779][ T3286] vhci_hcd vhci_hcd.0: disconnect device [ 30.797871][ T12] vhci_hcd vhci_hcd.0: stop threads [ 30.797882][ T12] vhci_hcd vhci_hcd.0: release socket [ 30.797903][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 30.797966][ T12] vhci_hcd vhci_hcd.0: stop threads [ 30.797972][ T12] vhci_hcd vhci_hcd.0: release socket [ 30.797981][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 30.798020][ T12] vhci_hcd vhci_hcd.0: stop threads [ 30.798026][ T12] vhci_hcd vhci_hcd.0: release socket [ 30.798034][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 30.798069][ T12] vhci_hcd vhci_hcd.0: stop threads [ 30.798074][ T12] vhci_hcd vhci_hcd.0: release socket [ 30.798082][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 30.798117][ T12] vhci_hcd vhci_hcd.0: stop threads [ 30.798122][ T12] vhci_hcd vhci_hcd.0: release socket [ 30.798130][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 30.798163][ T12] vhci_hcd vhci_hcd.0: stop threads [ 30.798168][ T12] vhci_hcd vhci_hcd.0: release socket [ 30.798176][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 30.798197][ T4908] vhci_hcd vhci_hcd.0: USB bus 3 deregistered [ 30.803300][ T4908] vhci_hcd vhci_hcd.0: remove, state 4 [ 30.803322][ T4908] usb usb2: USB disconnect, device number 1 [ 30.816079][ T4713] Bluetooth: hci3: command tx timeout [ 30.816211][ T4713] Bluetooth: hci1: command tx timeout [ 30.816275][ T4713] Bluetooth: hci2: command tx timeout [ 30.816336][ T4713] Bluetooth: hci0: command tx timeout [ 31.967428][ T693] vhci_hcd vhci_hcd.0: stop threads [ 31.967463][ T693] vhci_hcd vhci_hcd.0: release socket [ 31.967494][ T693] vhci_hcd vhci_hcd.0: disconnect device [ 31.972306][ T4908] vhci_hcd vhci_hcd.0: USB bus 2 deregistered [ 31.975584][ T693] ================================================================== [ 31.975598][ T693] BUG: KASAN: slab-use-after-free in __mutex_lock+0x130/0xf14 [ 31.975617][ T693] Read of size 8 at addr ffff0000c98e0748 by task kworker/u8:5/693 [ 31.975627][ T693] [ 31.975632][ T693] CPU: 1 UID: 0 PID: 693 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT [ 31.975641][ T693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 31.975645][ T693] Workqueue: usbip_event event_handler [ 31.975658][ T693] Call trace: [ 31.975661][ T693] show_stack+0x2c/0x3c (C) [ 31.975674][ T693] __dump_stack+0x30/0x40 [ 31.975684][ T693] dump_stack_lvl+0xd8/0x12c [ 31.975693][ T693] print_address_description+0xb0/0x238 [ 31.975701][ T693] print_report+0x68/0x84 [ 31.975708][ T693] kasan_report+0x8c/0xc4 [ 31.975717][ T693] __asan_report_load8_noabort+0x20/0x2c [ 31.975727][ T693] __mutex_lock+0x130/0xf14 [ 31.975734][ T693] mutex_lock_nested+0x24/0x30 [ 31.975741][ T693] event_handler+0x1d4/0x460 [ 31.975750][ T693] process_scheduled_works+0x788/0x10b8 [ 31.975759][ T693] worker_thread+0x798/0xbd0 [ 31.975767][ T693] kthread+0x304/0x3d4 [ 31.975774][ T693] ret_from_fork+0x10/0x20 [ 31.975781][ T693] [ 31.975783][ T693] Allocated by task 1: [ 31.975787][ T693] kasan_save_track+0x40/0x78 [ 31.975794][ T693] kasan_save_alloc_info+0x40/0x50 [ 31.975802][ T693] __kasan_kmalloc+0x9c/0xb4 [ 31.975809][ T693] __kmalloc_noprof+0x340/0x6b8 [ 31.975815][ T693] __usb_create_hcd+0x70/0x7ec [ 31.975824][ T693] usb_create_hcd+0x3c/0x50 [ 31.975832][ T693] vhci_hcd_probe+0x108/0x3b4 [ 31.975839][ T693] platform_probe+0x100/0x1a4 [ 31.975846][ T693] really_probe+0x29c/0x800 [ 31.975854][ T693] __driver_probe_device+0x1e0/0x350 [ 31.975862][ T693] driver_probe_device+0x6c/0x19c [ 31.975870][ T693] __device_attach_driver+0x198/0x2f8 [ 31.975878][ T693] bus_for_each_drv+0x144/0x1dc [ 31.975884][ T693] __device_attach+0x248/0x390 [ 31.975896][ T693] device_initial_probe+0x90/0xc8 [ 31.975905][ T693] bus_probe_device+0x58/0x120 [ 31.975912][ T693] device_add+0x6cc/0x9e0 [ 31.975917][ T693] platform_device_add+0x3dc/0x6f0 [ 31.975923][ T693] platform_device_register_full+0x4fc/0x5ac [ 31.975929][ T693] vhci_hcd_init+0x1b0/0x2ec [ 31.975938][ T693] do_one_initcall+0x274/0xc38 [ 31.975946][ T693] do_initcall_level+0x12c/0x1c4 [ 31.975954][ T693] do_initcalls+0x70/0xd0 [ 31.975961][ T693] do_basic_setup+0x7c/0x90 [ 31.975969][ T693] kernel_init_freeable+0x268/0x3a8 [ 31.975976][ T693] kernel_init+0x24/0x1dc [ 31.975984][ T693] ret_from_fork+0x10/0x20 [ 31.975990][ T693] [ 31.975991][ T693] Freed by task 4908: [ 31.975994][ T693] kasan_save_track+0x40/0x78 [ 31.976001][ T693] kasan_save_free_info+0x54/0x6c [ 31.976009][ T693] __kasan_slab_free+0x74/0xa4 [ 31.976016][ T693] kfree+0x188/0x690 [ 31.976021][ T693] usb_put_hcd+0x124/0x16c [ 31.976029][ T693] vhci_hcd_remove+0xd8/0xfc [ 31.976036][ T693] platform_remove+0x6c/0x88 [ 31.976042][ T693] device_remove+0xc4/0x134 [ 31.976049][ T693] device_release_driver_internal+0x124/0x20c [ 31.976058][ T693] device_driver_detach+0x48/0x58 [ 31.976065][ T693] unbind_store+0xc0/0xf0 [ 31.976072][ T693] drv_attr_store+0x80/0xa4 [ 31.976079][ T693] sysfs_kf_write+0xe0/0x108 [ 31.976088][ T693] kernfs_fop_write_iter+0x260/0x3b8 [ 31.976095][ T693] vfs_write+0x51c/0xa0c [ 31.976100][ T693] ksys_write+0x12c/0x228 [ 31.976105][ T693] __arm64_sys_write+0x84/0x98 [ 31.976111][ T693] invoke_syscall+0x98/0x244 [ 31.976119][ T693] el0_svc_common+0xec/0x23c [ 31.976127][ T693] do_el0_svc+0x4c/0x5c [ 31.976134][ T693] el0_svc+0x64/0x260 [ 31.976141][ T693] el0t_64_sync_handler+0x44/0x104 [ 31.976147][ T693] el0t_64_sync+0x198/0x19c [ 31.976153][ T693] [ 31.976155][ T693] Last potentially related work creation: [ 31.976158][ T693] kasan_save_stack+0x40/0x6c [ 31.976164][ T693] kasan_record_aux_stack+0xb0/0xc8 [ 31.976172][ T693] insert_work+0x54/0x1a0 [ 31.976178][ T693] __queue_work+0xdd8/0x1440 [ 31.976183][ T693] queue_work_on+0xc0/0x130 [ 31.976192][ T693] usb_hcd_giveback_urb+0x29c/0x350 [ 31.976199][ T693] unlink1+0x244/0x2e8 [ 31.976206][ T693] usb_hcd_unlink_urb+0xe4/0x1dc [ 31.976214][ T693] usb_kill_urb+0x108/0x31c [ 31.976222][ T693] hub_quiesce+0x1c0/0x29c [ 31.976229][ T693] hub_suspend+0x6b8/0x858 [ 31.976235][ T693] usb_suspend_both+0x2e8/0x918 [ 31.976241][ T693] usb_runtime_suspend+0x5c/0x110 [ 31.976247][ T693] __rpm_callback+0x124/0x2f8 [ 31.976253][ T693] rpm_callback+0x70/0x1a0 [ 31.976258][ T693] rpm_suspend+0x43c/0xf74 [ 31.976265][ T693] __pm_runtime_suspend+0xf8/0x144 [ 31.976273][ T693] usb_new_device+0xad4/0x11f8 [ 31.976280][ T693] register_root_hub+0x224/0x568 [ 31.976287][ T693] usb_add_hcd+0x944/0xdec [ 31.976295][ T693] vhci_hcd_probe+0x13c/0x3b4 [ 31.976302][ T693] platform_probe+0x100/0x1a4 [ 31.976308][ T693] really_probe+0x29c/0x800 [ 31.976316][ T693] __driver_probe_device+0x1e0/0x350 [ 31.976323][ T693] driver_probe_device+0x6c/0x19c [ 31.976331][ T693] __device_attach_driver+0x198/0x2f8 [ 31.976339][ T693] bus_for_each_drv+0x144/0x1dc [ 31.976346][ T693] __device_attach+0x248/0x390 [ 31.976353][ T693] device_initial_probe+0x90/0xc8 [ 31.976361][ T693] bus_probe_device+0x58/0x120 [ 31.976368][ T693] device_add+0x6cc/0x9e0 [ 31.976373][ T693] platform_device_add+0x3dc/0x6f0 [ 31.976379][ T693] platform_device_register_full+0x4fc/0x5ac [ 31.976384][ T693] vhci_hcd_init+0x1b0/0x2ec [ 31.976391][ T693] do_one_initcall+0x274/0xc38 [ 31.976399][ T693] do_initcall_level+0x12c/0x1c4 [ 31.976407][ T693] do_initcalls+0x70/0xd0 [ 31.976414][ T693] do_basic_setup+0x7c/0x90 [ 31.976421][ T693] kernel_init_freeable+0x268/0x3a8 [ 31.976429][ T693] kernel_init+0x24/0x1dc [ 31.976437][ T693] ret_from_fork+0x10/0x20 [ 31.976442][ T693] [ 31.976443][ T693] Second to last potentially related work creation: [ 31.976446][ T693] kasan_save_stack+0x40/0x6c [ 31.976453][ T693] kasan_record_aux_stack+0xb0/0xc8 [ 31.976460][ T693] insert_work+0x54/0x1a0 [ 31.976466][ T693] __queue_work+0xdd8/0x1440 [ 31.976471][ T693] queue_work_on+0xc0/0x130 [ 31.976479][ T693] usb_hcd_giveback_urb+0x29c/0x350 [ 31.976487][ T693] usb_hcd_submit_urb+0xedc/0x169c [ 31.976494][ T693] usb_submit_urb+0xd44/0x1458 [ 31.976502][ T693] usb_start_wait_urb+0x104/0x478 [ 31.976508][ T693] usb_control_msg+0x1e8/0x378 [ 31.976516][ T693] hub_ext_port_status+0x158/0x578 [ 31.976522][ T693] hub_activate+0x59c/0x15c4 [ 31.976529][ T693] hub_init_func2+0x24/0x34 [ 31.976536][ T693] process_scheduled_works+0x788/0x10b8 [ 31.976543][ T693] worker_thread+0x798/0xbd0 [ 31.976549][ T693] kthread+0x304/0x3d4 [ 31.976555][ T693] ret_from_fork+0x10/0x20 [ 31.976560][ T693] [ 31.976562][ T693] The buggy address belongs to the object at ffff0000c98e0000 [ 31.976562][ T693] which belongs to the cache kmalloc-8k of size 8192 [ 31.976568][ T693] The buggy address is located 1864 bytes inside of [ 31.976568][ T693] freed 8192-byte region [ffff0000c98e0000, ffff0000c98e2000) [ 31.976574][ T693] [ 31.976576][ T693] The buggy address belongs to the physical page: [ 31.976580][ T693] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1098e0 [ 31.976586][ T693] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.976592][ T693] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 31.976599][ T693] page_type: f5(slab) [ 31.976606][ T693] raw: 05ffc00000000040 ffff0000c0002280 dead000000000122 0000000000000000 [ 31.976611][ T693] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 31.976617][ T693] head: 05ffc00000000040 ffff0000c0002280 dead000000000122 0000000000000000 [ 31.976622][ T693] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 31.976628][ T693] head: 05ffc00000000003 fffffdffc3263801 00000000ffffffff 00000000ffffffff [ 31.976633][ T693] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 31.976636][ T693] page dumped because: kasan: bad access detected [ 31.976639][ T693] [ 31.976640][ T693] Memory state around the buggy address: [ 31.976644][ T693] ffff0000c98e0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.976648][ T693] ffff0000c98e0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.976652][ T693] >ffff0000c98e0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.976655][ T693] ^ [ 31.976659][ T693] ffff0000c98e0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.976663][ T693] ffff0000c98e0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.976666][ T693] ================================================================== [ 31.976674][ T693] Disabling lock debugging due to kernel taint [ 31.976684][ T693] : stop threads [ 31.976693][ T693] : release socket [ 31.976705][ T693] : disconnect device [ 31.976720][ T693] : stop threads [ 31.976728][ T693] : release socket [ 31.976738][ T693] : disconnect device [ 31.976753][ T693] : stop threads [ 31.976760][ T693] : release socket [ 31.976771][ T693] : disconnect device [ 31.976785][ T693] : stop threads [ 31.976792][ T693] : release socket [ 31.976803][ T693] : disconnect device [ 31.976817][ T693] : stop threads [ 31.976824][ T693] : release socket [ 31.976835][ T693] : disconnect device [ 31.976849][ T693] : stop threads [ 31.976856][ T693] : release socket [ 31.976866][ T693] : disconnect device [ 31.976880][ T693] : stop threads [ 31.976890][ T693] : release socket [ 31.976900][ T693] : disconnect device [ 32.200808][ T4936] loop2: detected capacity change from 0 to 512 [ 32.208694][ T4935] loop0: detected capacity change from 0 to 1024 [ 32.211373][ T4935] EXT4-fs (loop0): stripe (5) is not aligned with cluster size (16), stripe is disabled [ 32.226806][ T4936] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 32.243411][ T4935] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 32.243835][ T4936] EXT4-fs (loop2): 1 orphan inode deleted [ 32.244030][ T4936] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.252692][ T4944] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 32.257179][ T4944] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 32.268424][ T4936] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9'. [ 32.307242][ T693] Quota error (device loop2): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 32.309312][ T693] EXT4-fs error (device loop2): ext4_release_dquot:7077: comm kworker/u8:5: Failed to release dquot type 1 [ 32.312736][ T4718] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.324490][ T4935] EXT4-fs error (device loop0): ext4_find_dest_de:2050: inode #12: block 7: comm syz.0.8: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0 [ 32.332834][ T4935] EXT4-fs (loop0): Remounting filesystem read-only [ 32.332885][ T4935] overlayfs: cleanup of 'work/#5' failed (-30) [ 32.351017][ T4712] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.585745][ T4717] Bluetooth: hci4: command tx timeout [ 32.895645][ T4713] Bluetooth: hci2: command tx timeout [ 32.895673][ T4713] Bluetooth: hci1: command tx timeout [ 32.895715][ T4728] Bluetooth: hci3: command tx timeout [ 32.897432][ T4717] Bluetooth: hci0: command tx timeout [ 34.655635][ T4717] Bluetooth: hci4: command tx timeout [ 34.975610][ T4717] Bluetooth: hci2: command tx timeout [ 34.975632][ T4725] Bluetooth: hci3: command tx timeout [ 34.975642][ T4713] Bluetooth: hci1: command tx timeout [ 34.976122][ T4728] Bluetooth: hci0: command tx timeout [ 36.735737][ T4717] Bluetooth: hci4: command tx timeout [ 37.055549][ T4717] Bluetooth: hci2: command tx timeout [ 37.055593][ T4717] Bluetooth: hci3: command tx timeout [ 37.055597][ T4728] Bluetooth: hci0: command tx timeout [ 37.065555][ T4728] Bluetooth: hci1: command tx timeout