last executing test programs: 9.167051283s ago: executing program 0 (id=130): pipe2(0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0) r3 = syz_io_uring_setup(0x23c, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r7, 0x0, &(0x7f0000000240)="352f1938d141676d9b6c59065f664735c08b9d697a645f85b19ba9030648cd046d1f26aad0196458046b81", 0xfffffffffffffe08, 0xebec93e830f96115}) io_uring_enter(r3, 0x7f5f, 0x4000000, 0x0, 0x0, 0x0) shutdown(r6, 0x1) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, 0x0, &(0x7f0000000480)) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x1d, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x12020) r8 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) r9 = ioctl$LOOP_CTL_GET_FREE(r8, 0x4c82) ioctl$LOOP_CTL_REMOVE(r8, 0x4c81, r9) syz_emit_ethernet(0x46, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3908004900003800000000000690780a250104ac1414aa44044a01070b04030e004b5ca4c14a0000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5c0000009078fffe"], 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x327cf3e4, 0xfffffffffffffffc, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4, 0x8, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000, 0x0, 0x0, 0x5, 0x3, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0xa, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8, 0x0, 0x0, 0x7fffffffffffffff, 0x0, 0x4, 0x0, 0x4, 0x10000, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0xffffffffffffffff]}) close(0xffffffffffffffff) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r10, &(0x7f00000001c0)=[{{&(0x7f0000000540)={0xa, 0x4e22, 0x1, @empty, 0xa}, 0x1c, 0x0}}], 0x1, 0x200880c0) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 5.671599954s ago: executing program 0 (id=157): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x8, 0x2, 0x4, 0x5}, 0x48) semop(0x0, &(0x7f0000000180)=[{0x3, 0x44cf, 0x800}], 0x1f4) 4.330075902s ago: executing program 0 (id=164): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x10, 0x44}]}}]}, 0x38}}, 0x0) 4.23593597s ago: executing program 0 (id=165): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000480)=ANY=[@ANYBLOB="12010000000000201c1b091c00000000000109022d00"], 0x0) r1 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) r4 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000001, 0x10, 0xffffffffffffffff, 0x8000000) syz_io_uring_complete(r4) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000200)=0x4, &(0x7f0000000340)=0x4) r5 = socket$rds(0x15, 0x5, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f0000000280)) 3.127841068s ago: executing program 2 (id=174): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000e40)=ANY=[@ANYBLOB="00220f000000040b2100000095f5758483", @ANYRES64=r0], 0x0}, 0x0) ioctl$HIDIOCGUSAGES(0xffffffffffffffff, 0xd01c4813, 0x0) 2.274868847s ago: executing program 3 (id=185): r0 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x18) symlinkat(&(0x7f00000001c0)='./file0\x00', r1, &(0x7f0000000000)='./file0\x00') openat2(r1, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000040)={0x10c00, 0x0, 0x8}, 0x18) 2.23306824s ago: executing program 3 (id=186): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg$inet(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10, 0x0}}], 0x1, 0x2000c000) 2.187916034s ago: executing program 2 (id=187): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002fc0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff48700000020000005c0000000000000095000000000000002ba728041598d6fbd307ce99e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f071326bd9174842fa9e09000000000000000a0e168c1884d005d94f204e345c652fbc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc84e974a42a550d6f97181980400003e05df3ceb9f1feae5737ecaa81d666963c474c2a175e04ad6ee1cbf9b0a4def23d410f6296b32ae343881dcc7b1b85f3c3d44aeaced3641110bec4e90a634196508000000000000f0f4ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d4dcecb0c005d2a1bcf9436c101040000f73902ebcf0200822775985b231f000000ccb0ecf31b715f5888b2a858ab3f11afc9bd08c676d2b89432fb465b3dad9d2aa7f1521b3ebb0cc52f49129b204eb99b6150e320c9901de2eb879a15943b6dc8ea15aab9dd6968698e3095c4c5c7a156cec33a7bb727667d81ff2757ca1e6bfdd4c968dacf81e65998b9091957d1d11a5730baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba165d876defd3541772f26e27c44cfd7bb5097379cf1756869cebc7b0b2d85d6d29983e830a9cdd1d0a017c100344c52a6f387a1340a1c8889464f90c284a4db539621fbb70f01a2c02dec4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae610afd01409d9a337ac5d58bcb5e5fc231514952c5255f22bd8b325d9b76e57f041b665ab0249886c0a65cc99d5893521372c8d8b7bacac24000020a4a24d8dbd75062e1daef9dead619cc6e7baa72706287793c3d2a2661edcd3545236c204682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b993508000000e480cd9d4850a049ee19b67d17ef0477aeb12b1d255be1ed66d9051f22614d1f62734d6780393e783df8b8a17e3aa9fe9c502f9acee4f1b56e1f231200743792cead3c058a5b700d64d160abe33df726608510136ce8bf239414a1d98ea93e3d35dbb6c23b90cf36e83b8a4309b402d264b09f2779a0bcd7cd6dfc06b02e69d384146056d125cf4aadd80800000000000000e88d10acd06864eac44c42fbe334bdc3e9768fc360b130dc6111fe3293e8e02f819a2aa34dba1c25be27945507a3477b437525b81aef2f0b4c4f63483026b5e34d44705b76ef29f7f6e0a2be625eae975e02069fbff63a06578d6d184f5de7bfb6aa800016996d536256c02294cb1d3a6fb8eae87691fae365a70c3f15871565bba8dd8a8ca049f798abe646f738bebdfc9d8a5edd7a19ca6a42bc3f1db37c17f22a287c6d31a13db5dfef409eb1d3c91c6e6f80d215c9e16e0c4736c81936315418f26770cca4e2f89800d18c89d7f46f679df6c9e7005f209dda94302a30003b952ae1ebfd0ca88368ee6ce139e8b5822422cf4c9dde943d34c432e1001171792c65986146666a549092398af45ba38c41df7e0fffeac41824ca1fd0eb68aa243c9035c788d5480e5aee9c9e5f2e5a3628995b1531bd20360d33d8f9ffffff5f4bf6ea8a1850c4f83306dbca02ee3686da707b6d85db491ba0cc33f6be92c55969a2b52a25419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9bc31f09834b4788be2a442aa81b259e9eb1bf5314844051f3a642aca9ff98c9036471ccff0522903e7bcf62e18f7796bbc280b95e8e0d6fd5644b0ebde3885b06548862de809d3dae3cccf109f7c78e8479a345e805e47dfa82caed44b11a443c5ba92a326dd10921aa79c62800844c7a59f55ee205a11ab50fb402e7da6ada561ec1117cc186b01fd5c2061d22156b1bfeb51f5c65a907f2217d5f80c580dc31b0963ff953ce09148e8dfe3a61bbd2bb173518507a3cd0e37c4da0a71eee31071d5d642498181c69cee3b2e414ddd6a12ff4bdf6e97c247b6025d4376067e25357d3b521a5b927d3392a7503718aea24179528f6a0c6de4e61b49cad1e4d6b000000000000005b2d16877299acefc0655bc1422c3d425d988eedebcf242b780a687c9acae2a5a71c2a16a32ceb377f5d54f9b2fa90b2905925e611be56e9ebe20cab20ab2b5baa1b07b16e81f278e54a479f1a068658e3656cfa196d6c050000000000000000814955c62a7d72b317399e572a7f6a4657b741eb66c9179ffd097d61fcfd0fa1d46cfb110e3e8cff5579e83f2820f95eaa0c609f666950c24311740e36de8f65708cfffce798c99ef8f62fd2398e999b220125da8eb07947512365abbc5b84ef524bdf184727c67910051f204662264607d548dbdffe14b41dd0843cf3d85bb820656a88a9e52a4cd7b3eeadfe00007267f226019ef0a25bc15da71e893856a2182c3167d8ba73f7c6294b159a426ce44cd73f000000a66fc501eae0c3504c1400697ba69fd9b7eaf49aff6a6aea529610db8dfef86c3cc698e9fddf1b13287615b972281a90c3a4cf415df25fbcdd35cf8368f068c4481844bdd0dda553e1cb0966d5686013d382956d50055dce0d1bc225c1d77612b1ec52e743dbc51f25cc07a202b704577316913cf067fa65e476f688de2d6c54ea192a569eed05d0d7536b3205c68d4ee0fe318ed3112c76dcf128a1d5595b773ef4c8a7ba4e10381de8808ff02dd0a7b996ecf1c65e6d9db90c87123d9cb3945330f7a270ee0cca35b1331ca8fec0b2f39f505140751b60f29a83e4bc0ef2ffea443e4aa221cc38a503add16a2c98cb589e1dac1912b4142a3be30f50b2d9479c5bde0beb38030d0c0ce0590000130000000000000000000000554361e1628ee0017ad19ca787f2c078aa260701ce0800000080623902000000000000000000003d118a04fa6a80c4928c01ccab57b5f4eb265ad15004f967543fe6e6ddc2a12165fe3a08bf9475ee0eee3539369b0e566fedbd215a6ddd4fe03dcc7a922e16410d820747b7e806c0f3b6f14c884d150a0ff07f2e0000bfb083c56d3bed0a61fab880f8885c612ebff8523d14cfb12aca274c000000005e5155611969f6e67dd83b20206207cb8b2cd2fab6fa6d7fdaed6a27a2e4db1d5adc80c4014ff11d9dbceba41d8dfce410333a054e82b1d050331c5bc4acb843b94d67f69f49eb4dd3b1b85b018359c32df01db8ebce0dbc36cade09c6b44f6b93d28db8ae4db5624d8a02f7be91bec65e4b3373059587dd6528bbc48e3379d477d482faff738c39c61cac1195043bd5b70cea5fc1083a169a82632ff3a9a48ff805202ae9aec56b9f7795fa27634a7f06359e3058d2dd69c4e5cc11b36d9ed9c4b2867f583de6fc582f789722bd1500e64c495abdb72de2c739d38c72f6f4fb1946081dcc825d5b5b747e9fa1b5226cd31e131263f1fcd7d45a630b46d04af906f0be464d829dd2dfcf7400002b7827f6d957e51bb1f1b44a50200c9dfadfaff2e32baa9c0edaac7144e174dba582a951d2b03c27219cec4fbc7b6e99c3f00188941e3fbf008cbace177ae250fd757a22e21ec05aa45c91e1345ca936184c3fc28153283e13654123cfaf4e661f4b6d430adad1e2116bc385f888405d48f0d386da0cc6747b33395772a68f2ea3fb7e7207000000b24088014c8e64f03d053c4e02ddd08b262e422eff1c9f124b892b0a9462b07d4f88c0693bd9c54ad2ab5227aa59ef2b53ac528c0800000000000000ebfde0c4a37c2d55c176680c4207000000e4aa467f995c9bc99e60441d4dbebead3b436427762618810bac7308c6d3298ea932b66572825e62d18462d3b2342ba48c145ff4674a94fa078cc552d064da2bb69a0d269076f8955076578f44ffb8895f11bd5e06840f8848df72230a28e0304569bfa0350b6dde9e96273de1758505aa1ba89dfb12be7a7c6dae1028d1bc68b6336eb1a5d18f6148354df7e60a489dc543ccdee1fff9d8f8d78844f0c6a77ef1181d5055c2a193a5763ed7749a17296c76818b60426082c86619dacc8a884c4de8572a044faf0c8e4377776c8703ecf2e3f1c3d6410000000000008369f062639e3ddcf725be54f626448fb7bfc74c183b26e31b71a390ccea4be07278dd12fa16848797397b76908fa03613cd961b98b26a0879ccba4a78c82958764bce07a7f70df1cef6d4db1ddbda1db18e4f41c390fd3cb862216ece39a9ec60bd3be5f9329dcaf33bf2c87cc510557460d14421e1d26322ab64388f2cea0d6269ffc8580a01e9acd2ec3ece39f3b4ffdc4dfea3da6ddb002512e2313253801044e751168eabe977c503c30ef7c489e5ea1fff041e54de54cfeb258f2387dad096b72a78d91134927492cfc773c731cca9b13b3f6e7760ab0929c46f51ea5643f3df4f4044f3ad0a6ba739e72d8b8b2835d81534bea8372bc590c111d573e04280659a096eaa495a4154daae7d1800c130d920964845c50c8ba4763b19b6008f6d7a5091895c7a4b7816ab706503be879b18b778b0f61ecfde2f8bbb32cfeb766ec4430ee0ad45a0a263ddc4b2f47680c8d53439f8d388dab87112c83997c83e178be287eb6e8c95bad8f8ed85cd5b03a7352a0fb83398566d1bc133582ce2d95636cd23eba4432180b2d5c3019879cd949a5be1b241b3d0d0d52a3529cc9e704a9d8d54f4f7b776a969a4505e18fe5284985ca7d112c397d776e3baba918b7df456bd970e761e00f3b0efa5ce4246d9f08ba60da3be556c518a1f19504c7cea1491a9eadd27d747ca9cc5f92e30b2ca3cf0b142a8554c87e8026d4e586cf5f7c9d412e6eb4f66a076c8bca6b294305969dabb6c932b57a5dd4234bf1ed3bd095229ee3cbb86883d574c5af4bb78370561de3fbf55bfcd2db3979eb1be120b5795443324023353bdd9fc87c862c247e140379ef098c7b3fa79a6638a245b6a74f14dde9bd4ee48e62cdc70f486ce38641e4e4309aa9f4bd097fa1530db966d9919544ab4890301e51f9525436f5d9591460340f5093161a78a249783945407f2576d6f35a99e3521d7991e3fdfde5ee7f6a8ff8181a68ef15a2ebfe9e22d7c745949ab5cc15b9f5659799b5e00debbf9f623f75bfd4d83c4859ca9b652cea33daeeef47b60c78a21965bcf91919071c7ded19317dc0b7587d9322f8cec9e32675a187465bdfa101bcd9ac680839b375af12c160247dd960e70eb7ee60c52a900440aa9bd9a6b15a4a34dc73c3c4936d8986300fdc264b28537df387e6442c32f5fa2a31d24c1ed888a57fcc50400a084a38a3630ffc465f36a4b770fab0946148161184be39134542e934f3a538bccd48a0325aa9b151855c800000000881d4361e7fbd1fc2331b4e34733480bc497662a8234a7eeab3e65d6b0f5d92edff04416eedcd15b9ddbcb3cf9228afda6b17d44a276b205eabd0069f7e26aea50f537dc77b683ed83d2f9110e00a705f48e9d13378cf09bca22e8f45c4f360d5fff8ba35f21c4513bcc0800000000000000dc5cc7ad7290c60bc609bff9be7cd922f474c3faa78fd42cba7c78d6d912656b6313497625e2f9afaba05b17ca242b7ca8d6556175aee38142a8aac5f677c2f8a6967f2cb5e97aae97a5e5579a706243688ac4d38a4601b4aadb2d319fe7d6bf1272fa3fa701338d7bce390e8bf959081ed39e63a431901d615a26ff95e1620a6c26eda4f92d83499a173e7217001f58ed5406bdb59acbc997e8fd3d53b4c2c2a1b3145bf54a851f3c08931d4c2c32bfe611e5958458af7b3c5319fdb4c40b8d01365fdee93af6fad7c7a8da86460f45c9e99d43264c929e7de4e9620000000000000000000000000000007cf90000008f8a9da7a8a167815c6ffcd1b6863cde9ab45ecd8f06423198bb00cdf76877f407be46b000000000afbb4cb3a8de259a8beb2223f28b855e2bdf4b31b91e5062a42a55bd95e93f77f2499391cf0000000000000000000000000000195007ad27d1d61dc4d5512f117f0ed554c2c88c1713000000000000bb1ff447d6e12da208e9f0422a84f361684861169f498909c4841f4d5a0f5807a3b7d833075fdcd9c1d169b03d7df7f4150fad8b9e92eaf86992adbda360dd91de51c6df335445492608162fb0804dabdeac6fb71042f906eefd37f1d190a1c8a0d9de7f34dcc8cbd7b565fc675f3bf7aac559411808ee703ec3ad461c6ddc571994cb504c46eabbc2ff4b97df394bc75b5e7f45a4450753b5d2b8b8414a7fe6a17661bdb5b1d080cfd974811e1d60763d8d9509c75aa729a334b55ee76b0c2d50270a1deec1a6d7441d0b5b8d7a4d048d156ebcff102e45c15d2a73b40d74807f5182a319d50edbf430f00b1c29a9e4bd92111caacbb1d4541545c2d262646070da42f76e3f3c6d139eed89cc9300000000000000000000000000000000000072d7e605eb8e978d76796d9d3a728c51a3145da8e1ca4973aa8fed855328e9d2509335c5386cac74e862eac50e9ba95b6a2a29e8ef08a9ae29792e77fb9952b1ac5c816db5c23a656db528f81f6a9465d2c94d701ee8646b30650c84b9510a337e82702baf368d29281d3d54b39014756ca5a1be1881000000000000006fbac0b9c9f97c920dfac7e2379ef6bb076118aa9bb24ee12e64aa530f852bf4f970a08a55531934e39fbae483129949a918115571d76740ca6a1cea59df290f2e63675ca30a289775825fe3e5d6f206f3f395346c0738035dc74368bb035fc65a40f8124369b8950ded31af64855c5c95ef5c83b18b23517ca935a0fa1b630d70c4ca4029a90d47701102045fff90675adb3c83983d125ae730b9497c681a912a6bb70300a2d7fba051f82b9d6f710426b5bd0d0bc0b08a0f801276789613da406905011bd6ebbac91ff17a21d1ed0882e73394025772f31dc8a3048789c703f920c55746f6fc955046f9332d72150be23c26cbb08d1b438e84b83fefc6a16958fd46dc7b8cbea1da2d541324e373e9157696d698a0b4bc84d7cc2fdb069db8a5a491a9d2bbc0a61b73f75d81d07d778a1577db3b06d20a21b19ea17e0000815a42318151feaad37f7abf9bfa0bcac3c1934854b3f6dc6de835952ebdda297dd3b29c07c69888cf029271449e035edc8a4459705f222bda537481e66ce3c665129f9829524eca8b5bef27adde96bd3ee95da4a176deff3408da050fe8d512e5a19379b403ee11d010bf86d0af4ac5c2057709b18cff438d0d58810670b222dfeb317bb935f925d2a070e68a701fd4316a677bb513c9476f25969097c165ca1705473341ea03f259dc5bee6a2d2e05176965192941abfae36b3a1e30784e6532c96ab971c5706a88b6f66860e31098b5b788788aad67507ffab2184a950065c1337259b63135fa060fc5ce3e4f6cdfb64f40e1a90351a01fd3d70f9dde03c335a931e58b8570316590ae22c7de567260849049e963ee15db15f592abb24111a219f0d128ceaf19764d92755abc9c313f65e7a220e64bb0d7139ce59da85bc710cea0c6553b336763bd3e39c2374b86885a32cdfae817196a7850257ead09f3e30e676b51062bb9000000000000000000000000000000000000000000000000000000aefb12dd3507c8dd24490bf9de062cd166a4dad6b9f2e53bad342546e546f6dece81d53cf717bd91ad72f4da82018f43259899e53e0b69a92180f1345699045fd23689e66d21d13be1a2d20eb1ce23eda84a63855173ca7f51d436306c"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001800)={0x3, 0x2, &(0x7f0000000280)=@raw=[@map_val={0x18, 0x8, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x5}], 0x0, 0xfffffbff, 0x0, 0x0, 0x41000, 0x70, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 2.175626645s ago: executing program 2 (id=188): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r0, 0x11c, 0x1, 0x0, &(0x7f0000000140)) 2.168118205s ago: executing program 3 (id=189): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) socket$qrtr(0x2a, 0x2, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r0, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(0xffffffffffffffff, 0x26c8, 0x0, 0x1, 0x0, 0x10) r1 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x8000000001, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000080), 0x4) sendmmsg$inet(r4, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(r5) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000b40)) prctl$PR_SCHED_CORE(0x26, 0x1, 0x0, 0x1, 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000080)='./file1\x00') r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x4, 0x1, 0x1, 0x3, {0xa, 0x4e20, 0xffffffff, @ipv4={'\x00', '\xff\xff', @local}, 0x3}}}, 0x32) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r7, 0xffffffff80000800, 0x0, &(0x7f00000000c0)={0x2000000, 0xc, 0xfeff, 0x18e3, 0x200000001, 0x300000000, 0xfffffffffffffff7, 0xce, 0x2f}) writev(r7, &(0x7f0000000040)=[{&(0x7f0000000480)="aaeeac", 0x3}], 0x1) 2.132642848s ago: executing program 2 (id=192): openat$rtc(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet(0xa, 0x801, 0x84) listen(r3, 0xfffffffd) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600030000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) 2.063811364s ago: executing program 1 (id=193): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) r2 = syz_io_uring_setup(0x12de, &(0x7f0000000300)={0x0, 0x2000, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r1, 0x80, &(0x7f0000000540)=@l2tp6={0xa, 0x0, 0x7, @mcast1, 0xbf6b}}) io_uring_enter(r2, 0x5b43, 0xaced, 0x20, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r8, 0x4b67, &(0x7f0000000040)={0x3ffffffffffffe96, &(0x7f0000000000)=[{0x2000, 0x5}]}) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) accept4(r0, 0x0, 0x0, 0x0) 975.682242ms ago: executing program 4 (id=194): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f00000002c0)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', 0x0, 0xc00, 0x514, 0xd3c, 0x7fffffff, 0x4, 0x4}}, 0x120) 966.162712ms ago: executing program 1 (id=195): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f46ecdb4c", 0xe}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&\x00\x00\x00\a'], 0x50) write(0xffffffffffffffff, &(0x7f0000000000)='\"', 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 879.931009ms ago: executing program 2 (id=196): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) semop(0x0, &(0x7f0000000180)=[{0x3, 0x44cf, 0x800}], 0x1f4) 462.893472ms ago: executing program 4 (id=197): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000d80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0xffffffffffffff01, [@ptr={0xc}]}}, 0x0, 0x26, 0x0, 0x1}, 0x28) 436.603095ms ago: executing program 0 (id=198): r0 = io_uring_setup(0x19be, &(0x7f0000000000)={0x0, 0x709f, 0x1000, 0x2, 0xe3}) io_uring_register$IORING_UNREGISTER_PBUF_RING(r0, 0x17, 0x0, 0x1) 436.374915ms ago: executing program 1 (id=199): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000200)=[@in6={0xa, 0x4e24, 0x4, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x4}, 0x8) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000080)={0x6, 0x1, 0xf, 0xafc}, 0x8) sendto$inet6(r0, &(0x7f0000000000)="d2", 0xffc0, 0x44004, &(0x7f0000000100)={0xa, 0x4e24, 0xb, @loopback, 0xc5f}, 0x1c) 335.986263ms ago: executing program 4 (id=200): unshare(0x28000600) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0xc0189436, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x8, 0x3}) 335.724043ms ago: executing program 0 (id=201): socket$inet(0x2, 0x1, 0x100) socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r1, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0) ioctl$TIOCSETD(r5, 0x5423, 0x0) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000300)=0x4f) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) tkill(0x0, 0xb) utimensat(0xffffffffffffff9c, &(0x7f00000003c0)='.\x00', 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r6, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x2d5, 0x132, 0x9}) 335.542123ms ago: executing program 1 (id=202): bpf$TOKEN_CREATE(0x24, &(0x7f0000000780), 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES8, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00'}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='kfree\x00'}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffffd}, 0x18) clock_adjtime(0x0, &(0x7f0000000880)={0x2, 0x2, 0x2fb3, 0x2, 0x5, 0x6, 0x4, 0x2, 0x3ff, 0x400, 0x5, 0x101, 0x1, 0x90a4, 0x6d08, 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x9, 0x9, 0x9, 0x5, 0x4, 0xc3, 0xfffffffffffffffe}) 295.249276ms ago: executing program 4 (id=203): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @none, 0x0, 0x2}, 0xe) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, &(0x7f0000000100)) 279.109957ms ago: executing program 4 (id=204): r0 = socket$pptp(0x18, 0x1, 0x2) connect$pptp(r0, &(0x7f0000000500)={0x18, 0x2, {0x0, @remote}}, 0x1e) 256.163699ms ago: executing program 1 (id=205): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000002c0)='module_request\x00', r0}, 0x10) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000380)={r2, r1, 0x0, 0x0, 0xfffffffffffffffe}, 0x30) 195.835034ms ago: executing program 1 (id=206): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) r2 = syz_io_uring_setup(0x12de, &(0x7f0000000300)={0x0, 0x2000, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r1, 0x80, &(0x7f0000000540)=@l2tp6={0xa, 0x0, 0x7, @mcast1, 0xbf6b}}) io_uring_enter(r2, 0x5b43, 0xaced, 0x20, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r8, 0x4b67, &(0x7f0000000040)={0x3ffffffffffffe96, &(0x7f0000000000)=[{0x2000, 0x5}]}) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) accept4(r0, 0x0, 0x0, 0x0) 195.639714ms ago: executing program 3 (id=207): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt(r0, 0xff80, 0x1, &(0x7f00000079c0)="5d201779", 0x4) 195.554484ms ago: executing program 3 (id=208): r0 = socket(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e22, @empty}, 0x10) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000100)=0xfff, 0x4) listen(r0, 0x7f) r1 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x4, 0x4) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x13, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x2}, 0x1c) 177.534975ms ago: executing program 3 (id=209): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000640)=ANY=[@ANYBLOB="700000001400010000000000fbdbdf25e00000010000000000000000000000000000000000000000000000000000000100000000000700"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\f\x00\b'], 0x70}}, 0x4004040) 14.664319ms ago: executing program 4 (id=210): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000003300)=0xb, 0x4) 0s ago: executing program 2 (id=211): r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) dup3(r3, r2, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.157' (ED25519) to the list of known hosts. [ 31.903204][ T4033] cgroup: Unknown subsys name 'net' [ 32.161916][ T4033] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.431502][ T4033] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 33.316066][ T4044] chnl_net:caif_netlink_parms(): no params data found [ 33.321420][ T4048] chnl_net:caif_netlink_parms(): no params data found [ 33.342611][ T4052] chnl_net:caif_netlink_parms(): no params data found [ 33.375031][ T4043] chnl_net:caif_netlink_parms(): no params data found [ 33.378648][ T4048] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.380137][ T4048] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.381659][ T4048] device bridge_slave_0 entered promiscuous mode [ 33.391846][ T4044] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.392978][ T4044] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.394391][ T4044] device bridge_slave_0 entered promiscuous mode [ 33.397518][ T4044] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.398644][ T4044] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.401643][ T4044] device bridge_slave_1 entered promiscuous mode [ 33.403259][ T4048] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.404502][ T4048] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.405974][ T4048] device bridge_slave_1 entered promiscuous mode [ 33.410496][ T4057] chnl_net:caif_netlink_parms(): no params data found [ 33.438809][ T4048] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 33.444373][ T4044] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 33.451037][ T4048] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 33.452560][ T4052] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.453781][ T4052] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.455332][ T4052] device bridge_slave_0 entered promiscuous mode [ 33.457971][ T4044] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 33.471882][ T4052] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.473075][ T4052] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.474604][ T4052] device bridge_slave_1 entered promiscuous mode [ 33.488194][ T4048] team0: Port device team_slave_0 added [ 33.493292][ T4044] team0: Port device team_slave_0 added [ 33.497153][ T4057] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.498264][ T4057] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.499891][ T4057] device bridge_slave_0 entered promiscuous mode [ 33.505444][ T4048] team0: Port device team_slave_1 added [ 33.512694][ T4044] team0: Port device team_slave_1 added [ 33.513826][ T4043] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.515094][ T4043] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.516600][ T4043] device bridge_slave_0 entered promiscuous mode [ 33.518173][ T4057] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.519452][ T4057] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.520851][ T4057] device bridge_slave_1 entered promiscuous mode [ 33.523186][ T4052] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 33.531132][ T4043] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.532384][ T4043] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.533936][ T4043] device bridge_slave_1 entered promiscuous mode [ 33.538765][ T4052] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 33.543809][ T4048] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 33.544892][ T4048] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.548600][ T4048] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 33.558795][ T4044] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 33.560017][ T4044] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.563937][ T4044] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 33.565977][ T4048] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 33.567100][ T4048] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.571598][ T4048] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 33.578329][ T4057] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 33.582971][ T4044] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 33.584079][ T4044] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.588539][ T4044] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 33.595884][ T4043] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 33.598199][ T4057] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 33.600752][ T4052] team0: Port device team_slave_0 added [ 33.604284][ T4043] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 33.609091][ T4052] team0: Port device team_slave_1 added [ 33.632320][ T4043] team0: Port device team_slave_0 added [ 33.636877][ T4057] team0: Port device team_slave_0 added [ 33.638189][ T4052] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 33.639603][ T4052] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.643626][ T4052] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 33.680168][ T4048] device hsr_slave_0 entered promiscuous mode [ 33.739172][ T4048] device hsr_slave_1 entered promiscuous mode [ 33.779696][ T4043] team0: Port device team_slave_1 added [ 33.781543][ T4057] team0: Port device team_slave_1 added [ 33.785427][ T4052] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 33.786446][ T4052] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.790565][ T4052] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 33.850581][ T4044] device hsr_slave_0 entered promiscuous mode [ 33.889142][ T4044] device hsr_slave_1 entered promiscuous mode [ 33.929032][ T4044] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 33.930330][ T4044] Cannot create hsr debugfs directory [ 33.938744][ T4057] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 33.940065][ T4057] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.943800][ T4057] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 33.953391][ T4043] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 33.954447][ T4043] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.958163][ T4043] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 33.961746][ T4057] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 33.962830][ T4057] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.967039][ T4057] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 33.974096][ T4043] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 33.975256][ T4043] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.979560][ T4043] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 34.050065][ T4052] device hsr_slave_0 entered promiscuous mode [ 34.079223][ T4052] device hsr_slave_1 entered promiscuous mode [ 34.129029][ T4052] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 34.130274][ T4052] Cannot create hsr debugfs directory [ 34.190592][ T4043] device hsr_slave_0 entered promiscuous mode [ 34.219140][ T4043] device hsr_slave_1 entered promiscuous mode [ 34.278992][ T4043] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 34.280155][ T4043] Cannot create hsr debugfs directory [ 34.330177][ T4057] device hsr_slave_0 entered promiscuous mode [ 34.369224][ T4057] device hsr_slave_1 entered promiscuous mode [ 34.408994][ T4057] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 34.410284][ T4057] Cannot create hsr debugfs directory [ 34.513964][ T4044] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 34.535352][ T4044] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 34.570215][ T4044] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 34.612251][ T4044] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 34.681898][ T4048] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 34.732481][ T4048] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 34.770733][ T4048] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 34.820397][ T4048] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 34.873230][ T4052] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 34.910314][ T4052] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 34.961606][ T4052] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 35.000204][ T4052] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 35.056541][ T4057] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 35.090633][ T4057] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 35.163660][ T4057] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 35.199680][ T21] Bluetooth: hci3: command 0x0409 tx timeout [ 35.203421][ T4057] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 35.209156][ T4088] Bluetooth: hci2: command 0x0409 tx timeout [ 35.210187][ T4088] Bluetooth: hci1: command 0x0409 tx timeout [ 35.211181][ T4088] Bluetooth: hci0: command 0x0409 tx timeout [ 35.252446][ T4043] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 35.279372][ T4110] Bluetooth: hci4: command 0x0409 tx timeout [ 35.294259][ T4043] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 35.340891][ T4043] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 35.392361][ T4043] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 35.450123][ T4044] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.490075][ T4057] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.492012][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 35.493892][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.497647][ T4044] 8021q: adding VLAN 0 to HW filter on device team0 [ 35.505730][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 35.507386][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.508791][ T148] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.510018][ T148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.512294][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 35.513850][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.515313][ T148] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.516467][ T148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.517934][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 35.527644][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 35.530177][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 35.536152][ T4052] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.541039][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 35.542720][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.545114][ T4057] 8021q: adding VLAN 0 to HW filter on device team0 [ 35.553553][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 35.555209][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 35.556798][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 35.558448][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 35.561840][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 35.563512][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.564958][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 35.573220][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 35.574700][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.576203][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 35.577740][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.580271][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.581386][ T356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.582854][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 35.584309][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.585808][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 35.590976][ T4048] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.593170][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 35.594678][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.596198][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.597218][ T356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.604578][ T4044] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 35.607822][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 35.612128][ T4052] 8021q: adding VLAN 0 to HW filter on device team0 [ 35.615641][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 35.617344][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.624644][ T4043] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.627079][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 35.630763][ T4048] 8021q: adding VLAN 0 to HW filter on device team0 [ 35.644922][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 35.646670][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 35.648179][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 35.650748][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 35.652586][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 35.654073][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.655598][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 35.657176][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.659647][ T457] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.660699][ T457] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.662091][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 35.663539][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.665002][ T457] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.666163][ T457] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.667492][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 35.670947][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 35.672611][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 35.676693][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 35.687049][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 35.688632][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.690403][ T457] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.691603][ T457] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.692988][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 35.694496][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.695936][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 35.697443][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.700810][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 35.702574][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 35.704126][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 35.705506][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 35.711737][ T4057] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 35.714324][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 35.715982][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 35.717569][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 35.719418][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.720966][ T148] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.722073][ T148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.725242][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 35.726884][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.731281][ T4043] 8021q: adding VLAN 0 to HW filter on device team0 [ 35.743014][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 35.744616][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.746181][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 35.747786][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 35.751415][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 35.752986][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.754535][ T148] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.755644][ T148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.758431][ T4052] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 35.766269][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 35.767710][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 35.770758][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 35.772286][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 35.773758][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.775280][ T148] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.776305][ T148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.782399][ T4044] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 35.786790][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 35.788228][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 35.789564][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 35.790761][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 35.803600][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 35.805294][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 35.806920][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 35.808404][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 35.812063][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 35.813654][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 35.815139][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.818132][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 35.824238][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.825792][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 35.831702][ T4048] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 35.836002][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 35.837635][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 35.844890][ T4057] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 35.849197][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 35.850476][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 35.851727][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 35.853640][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.858830][ T4052] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 35.862740][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 35.864108][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 35.867740][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 35.869681][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.873974][ T4043] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 35.875642][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 35.877272][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 35.888524][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 35.891477][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 35.899945][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 35.901530][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 35.908575][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 35.910164][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 35.921131][ T4052] device veth0_vlan entered promiscuous mode [ 35.922725][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 35.924139][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 35.925802][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 35.927091][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 35.928582][ T4044] device veth0_vlan entered promiscuous mode [ 35.943309][ T4044] device veth1_vlan entered promiscuous mode [ 35.948300][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 35.950311][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 35.951604][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 35.960095][ T4048] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 35.968810][ T4052] device veth1_vlan entered promiscuous mode [ 35.992108][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 35.993730][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 35.995164][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 35.996625][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 35.998186][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.000428][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 36.001974][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.007394][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 36.008665][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 36.012493][ T4044] device veth0_macvtap entered promiscuous mode [ 36.017840][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 36.020243][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 36.021704][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.025131][ T4043] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.027151][ T4052] device veth0_macvtap entered promiscuous mode [ 36.032041][ T4044] device veth1_macvtap entered promiscuous mode [ 36.034912][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 36.036331][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 36.037745][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 36.043817][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.052379][ T4052] device veth1_macvtap entered promiscuous mode [ 36.055204][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 36.056684][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 36.058143][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.061383][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.062771][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.072730][ T4048] device veth0_vlan entered promiscuous mode [ 36.077983][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 36.081003][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.083122][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.084578][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.087224][ T4044] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.090441][ T4048] device veth1_vlan entered promiscuous mode [ 36.093040][ T4052] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 36.094712][ T4052] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.097325][ T4052] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.098788][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 36.100773][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 36.102320][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.105096][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 36.106726][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.110322][ T4057] device veth0_vlan entered promiscuous mode [ 36.112418][ T4044] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.115971][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 36.117449][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 36.120260][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.129316][ T4052] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 36.130979][ T4052] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.133012][ T4052] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.134591][ T4044] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.135968][ T4044] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.137261][ T4044] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.138663][ T4044] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.143649][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 36.145288][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.146850][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 36.148351][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.151456][ T4057] device veth1_vlan entered promiscuous mode [ 36.155416][ T4043] device veth0_vlan entered promiscuous mode [ 36.156670][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 36.158247][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 36.161012][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.162699][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.164108][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.171091][ T4052] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.172523][ T4052] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.173898][ T4052] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.175189][ T4052] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.190629][ T4043] device veth1_vlan entered promiscuous mode [ 36.210620][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 36.212203][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 36.213625][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 36.215036][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 36.216554][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.218693][ T4048] device veth0_macvtap entered promiscuous mode [ 36.226970][ T136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.228261][ T136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.235285][ T4048] device veth1_macvtap entered promiscuous mode [ 36.242371][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 36.243873][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 36.245281][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 36.263281][ T148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.264539][ T148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.267763][ T4048] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 36.272015][ T4048] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.273512][ T4048] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 36.275107][ T4048] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.277306][ T4048] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.282362][ T4057] device veth0_macvtap entered promiscuous mode [ 36.284270][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 36.285730][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 36.287206][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.288659][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 36.292189][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.293732][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 36.295242][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.298919][ T4043] device veth0_macvtap entered promiscuous mode [ 36.303790][ T4057] device veth1_macvtap entered promiscuous mode [ 36.305973][ T4043] device veth1_macvtap entered promiscuous mode [ 36.307685][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 36.309497][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 36.310929][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 36.312471][ T356] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 36.316924][ T356] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.318284][ T356] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.335709][ T4048] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 36.337359][ T4048] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.338784][ T4048] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 36.351785][ T4048] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.354216][ T4048] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.357678][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 36.359919][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 36.361727][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.371517][ T4043] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 36.373284][ T4043] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.374890][ T4043] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 36.376675][ T4043] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.378337][ T4043] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 36.382054][ T4043] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.384257][ T4043] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.386952][ T4043] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 36.388561][ T4043] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.390559][ T4043] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 36.392155][ T4043] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.393657][ T4043] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 36.395135][ T4043] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.397069][ T4043] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.400518][ T4043] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.401850][ T4043] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.403172][ T4043] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.404567][ T4043] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.441337][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.442610][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.453837][ T4048] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.455277][ T4048] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.456729][ T4048] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.458097][ T4048] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.462636][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 36.464622][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.466201][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 36.467718][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.469943][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 36.475672][ T4057] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 36.477294][ T4057] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.484244][ T4057] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 36.485974][ T4057] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.487492][ T4057] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 36.489891][ T4057] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.491460][ T4057] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 36.493157][ T4057] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.495357][ T4057] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.909559][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.910923][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.913386][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.914583][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.923880][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 36.925329][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 36.926961][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.929412][ T4096] libceph: connect (1)[c::]:6789 error -101 [ 36.930270][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 36.930900][ T4096] libceph: mon0 (1)[c::]:6789 connect error [ 36.933796][ T4057] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 36.935618][ T4057] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.937187][ T4057] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 36.938888][ T4057] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.940705][ T4057] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 36.942499][ T4057] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.944016][ T4057] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 36.945519][ T4057] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 36.947621][ T4057] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.963024][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 36.964539][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.992950][ T4057] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.994500][ T4057] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.994816][ T4161] udc-core: couldn't find an available UDC or it's busy [ 36.995863][ T4057] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.997034][ T4161] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 36.998259][ T4057] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.058708][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.060419][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.066611][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 37.075996][ T457] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.077315][ T457] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.083666][ T136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.084400][ T457] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 37.084985][ T136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.087851][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 37.100674][ T136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.101968][ T136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.104084][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 37.185681][ T4156] ceph: No mds server is up or the cluster is laggy [ 37.194931][ T4123] libceph: connect (1)[c::]:6789 error -101 [ 37.195696][ T4176] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9'. [ 37.195924][ T4123] libceph: mon0 (1)[c::]:6789 connect error [ 37.289602][ T4124] Bluetooth: hci0: command 0x041b tx timeout [ 37.295487][ T4124] Bluetooth: hci1: command 0x041b tx timeout [ 37.296575][ T4124] Bluetooth: hci2: command 0x041b tx timeout [ 37.297609][ T4124] Bluetooth: hci3: command 0x041b tx timeout [ 37.374662][ T4124] Bluetooth: hci4: command 0x041b tx timeout [ 38.756080][ T4202] input: syz1 as /devices/virtual/input/input2 [ 38.760970][ T4205] Zero length message leads to an empty skb [ 38.762574][ T4205] binder: 4200:4205 BC_INCREFS_DONE node 1 has no pending increfs request [ 38.764669][ T4205] binder: 4200:4205 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 38.765959][ T4205] binder: 4200:4205 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 38.767897][ T4205] binder: 4205 RLIMIT_NICE not set [ 39.861248][ T4124] Bluetooth: hci3: command 0x040f tx timeout [ 39.864306][ T4123] Bluetooth: hci4: command 0x040f tx timeout [ 39.869148][ T4124] Bluetooth: hci2: command 0x040f tx timeout [ 39.955013][ T4124] Bluetooth: hci1: command 0x040f tx timeout [ 39.956522][ T4124] Bluetooth: hci0: command 0x040f tx timeout [ 40.145072][ T4045] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 40.146636][ T4045] CPU: 0 PID: 4045 Comm: kworker/u5:1 Not tainted 5.15.189-syzkaller #0 [ 40.147892][ T4045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 40.149494][ T4045] Workqueue: hci2 hci_rx_work [ 40.150246][ T4045] Call trace: [ 40.150762][ T4045] dump_backtrace+0x0/0x43c [ 40.151430][ T4045] show_stack+0x2c/0x3c [ 40.152116][ T4045] __dump_stack+0x30/0x40 [ 40.152847][ T4045] dump_stack_lvl+0xf8/0x160 [ 40.153644][ T4045] dump_stack+0x1c/0x5c [ 40.154343][ T4045] sysfs_create_dir_ns+0x22c/0x24c [ 40.155188][ T4045] kobject_add_internal+0x590/0xc54 [ 40.155992][ T4045] kobject_add+0x134/0x1f8 [ 40.156760][ T4045] device_add+0x3f0/0xf94 [ 40.157506][ T4045] hci_conn_add_sysfs+0xbc/0x1cc [ 40.158322][ T4045] le_conn_complete_evt+0x9a4/0x11bc [ 40.159205][ T4045] hci_le_meta_evt+0x85c/0x3010 [ 40.159981][ T4045] hci_event_packet+0xd10/0x11bc [ 40.160819][ T4045] hci_rx_work+0x1cc/0x880 [ 40.161517][ T4045] process_one_work+0x79c/0x1140 [ 40.162246][ T4045] worker_thread+0x8f4/0x101c [ 40.163007][ T4045] kthread+0x374/0x454 [ 40.163590][ T4045] ret_from_fork+0x10/0x20 [ 40.165618][ T4045] kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 40.167752][ T4045] Bluetooth: hci2: failed to register connection device [ 40.168656][ T4242] udc-core: couldn't find an available UDC or it's busy [ 40.180622][ T4242] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 40.200914][ T4244] udc-core: couldn't find an available UDC or it's busy [ 40.202021][ T4244] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 40.567948][ T4264] binder: 4255:4264 BC_INCREFS_DONE node 2 has no pending increfs request [ 40.571981][ T4264] binder: 4255:4264 Release 1 refcount change on invalid ref 2 ret -22 [ 40.573379][ T4264] binder: 4255:4264 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 41.269709][ T4273] netlink: 4 bytes leftover after parsing attributes in process `syz.3.42'. [ 41.271500][ T4273] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 41.292660][ T4273] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 41.306420][ T4281] syz.1.44 uses obsolete (PF_INET,SOCK_PACKET) [ 41.366900][ T4290] hpfs: Bad magic ... probably not HPFS [ 41.921339][ T4096] Bluetooth: hci4: command 0x0419 tx timeout [ 41.922595][ T1542] Bluetooth: hci3: command 0x0419 tx timeout [ 42.000391][ T4088] Bluetooth: hci0: command 0x0419 tx timeout [ 42.001766][ T4088] Bluetooth: hci1: command 0x0419 tx timeout [ 42.002752][ T4088] Bluetooth: hci2: command 0x0419 tx timeout [ 42.573145][ T4314] udc-core: couldn't find an available UDC or it's busy [ 42.574219][ T4314] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 42.934291][ T4319] device veth0_to_team entered promiscuous mode [ 43.205632][ T4333] blk_update_request: I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 43.207717][ T4333] exFAT-fs (loop2): unable to read boot sector [ 43.208748][ T4333] exFAT-fs (loop2): failed to read boot sector [ 43.209812][ T4333] exFAT-fs (loop2): failed to recognize exfat type [ 43.636796][ T4342] tipc: Started in network mode [ 43.637738][ T4342] tipc: Node identity ba041641374a, cluster identity 4711 [ 43.641345][ T4342] tipc: Enabled bearer , priority 0 [ 43.642821][ T4342] device syzkaller0 entered promiscuous mode [ 43.654729][ T4342] tipc: Resetting bearer [ 43.657398][ T4341] tipc: Resetting bearer [ 43.663711][ T4341] tipc: Disabling bearer [ 44.275289][ T4045] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 44.279032][ T4045] CPU: 0 PID: 4045 Comm: kworker/u5:1 Not tainted 5.15.189-syzkaller #0 [ 44.280297][ T4045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 44.281848][ T4045] Workqueue: hci2 hci_rx_work [ 44.282579][ T4045] Call trace: [ 44.283112][ T4045] dump_backtrace+0x0/0x43c [ 44.283804][ T4045] show_stack+0x2c/0x3c [ 44.284408][ T4045] __dump_stack+0x30/0x40 [ 44.285036][ T4045] dump_stack_lvl+0xf8/0x160 [ 44.285710][ T4045] dump_stack+0x1c/0x5c [ 44.286345][ T4045] sysfs_create_dir_ns+0x22c/0x24c [ 44.287104][ T4045] kobject_add_internal+0x590/0xc54 [ 44.287835][ T4045] kobject_add+0x134/0x1f8 [ 44.288501][ T4045] device_add+0x3f0/0xf94 [ 44.289183][ T4045] hci_conn_add_sysfs+0xbc/0x1cc [ 44.289943][ T4045] le_conn_complete_evt+0x9a4/0x11bc [ 44.290772][ T4045] hci_le_meta_evt+0x85c/0x3010 [ 44.291622][ T4045] hci_event_packet+0xd10/0x11bc [ 44.292387][ T4045] hci_rx_work+0x1cc/0x880 [ 44.293024][ T4045] process_one_work+0x79c/0x1140 [ 44.293784][ T4045] worker_thread+0x8f4/0x101c [ 44.294482][ T4045] kthread+0x374/0x454 [ 44.295099][ T4045] ret_from_fork+0x10/0x20 [ 44.303360][ T4045] kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 44.305425][ T4045] Bluetooth: hci2: failed to register connection device [ 45.310135][ T4380] tipc: Started in network mode [ 45.311084][ T4380] tipc: Node identity f650351b607e, cluster identity 4711 [ 45.312347][ T4380] tipc: Enabled bearer , priority 0 [ 45.316267][ T4369] tipc: Resetting bearer [ 45.343001][ T4369] tipc: Disabling bearer [ 46.222523][ T4045] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 46.224010][ T4045] CPU: 0 PID: 4045 Comm: kworker/u5:1 Not tainted 5.15.189-syzkaller #0 [ 46.225283][ T4045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 46.226883][ T4045] Workqueue: hci4 hci_rx_work [ 46.227644][ T4045] Call trace: [ 46.228130][ T4045] dump_backtrace+0x0/0x43c [ 46.228796][ T4045] show_stack+0x2c/0x3c [ 46.229413][ T4045] __dump_stack+0x30/0x40 [ 46.230116][ T4045] dump_stack_lvl+0xf8/0x160 [ 46.230839][ T4045] dump_stack+0x1c/0x5c [ 46.231552][ T4045] sysfs_create_dir_ns+0x22c/0x24c [ 46.232368][ T4045] kobject_add_internal+0x590/0xc54 [ 46.233206][ T4045] kobject_add+0x134/0x1f8 [ 46.233945][ T4045] device_add+0x3f0/0xf94 [ 46.234635][ T4045] hci_conn_add_sysfs+0xbc/0x1cc [ 46.235375][ T4045] le_conn_complete_evt+0x9a4/0x11bc [ 46.236260][ T4045] hci_le_meta_evt+0x85c/0x3010 [ 46.237019][ T4045] hci_event_packet+0xd10/0x11bc [ 46.237791][ T4045] hci_rx_work+0x1cc/0x880 [ 46.238521][ T4045] process_one_work+0x79c/0x1140 [ 46.239271][ T4045] worker_thread+0x8f4/0x101c [ 46.240033][ T4045] kthread+0x374/0x454 [ 46.240697][ T4045] ret_from_fork+0x10/0x20 [ 46.241620][ T4045] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 46.243826][ T4045] Bluetooth: hci4: failed to register connection device [ 46.555158][ T4408] netlink: 24 bytes leftover after parsing attributes in process `syz.1.88'. [ 46.727172][ T4412] udc-core: couldn't find an available UDC or it's busy [ 46.730708][ T4412] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 47.114725][ T4096] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 47.136997][ T1969] libceph: connect (1)[c::]:6789 error -101 [ 47.138053][ T1969] libceph: mon0 (1)[c::]:6789 connect error [ 47.399130][ T4089] libceph: connect (1)[c::]:6789 error -101 [ 47.400126][ T4089] libceph: mon0 (1)[c::]:6789 connect error [ 47.425521][ T4096] usb 1-1: Using ep0 maxpacket: 32 [ 47.560656][ T4096] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 47.561045][ T4096] usb 1-1: config 0 has no interface number 0 [ 47.843496][ T4444] udc-core: couldn't find an available UDC or it's busy [ 47.844788][ T4444] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 47.911275][ T4089] libceph: connect (1)[c::]:6789 error -101 [ 47.912461][ T4089] libceph: mon0 (1)[c::]:6789 connect error [ 48.001686][ T4096] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 48.003213][ T4096] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.004578][ T4096] usb 1-1: Product: syz [ 48.005292][ T4096] usb 1-1: Manufacturer: syz [ 48.006017][ T4096] usb 1-1: SerialNumber: syz [ 48.018220][ T4045] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 48.019314][ T4096] usb 1-1: config 0 descriptor?? [ 48.019893][ T4045] CPU: 0 PID: 4045 Comm: kworker/u5:1 Not tainted 5.15.189-syzkaller #0 [ 48.022053][ T4045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 48.022304][ T4414] ceph: No mds server is up or the cluster is laggy [ 48.023661][ T4045] Workqueue: hci2 hci_rx_work [ 48.025373][ T4045] Call trace: [ 48.025895][ T4045] dump_backtrace+0x0/0x43c [ 48.026681][ T4045] show_stack+0x2c/0x3c [ 48.027398][ T4045] __dump_stack+0x30/0x40 [ 48.028140][ T4045] dump_stack_lvl+0xf8/0x160 [ 48.028882][ T4045] dump_stack+0x1c/0x5c [ 48.029631][ T4045] sysfs_create_dir_ns+0x22c/0x24c [ 48.030509][ T4045] kobject_add_internal+0x590/0xc54 [ 48.031371][ T4045] kobject_add+0x134/0x1f8 [ 48.032081][ T4045] device_add+0x3f0/0xf94 [ 48.032781][ T4045] hci_conn_add_sysfs+0xbc/0x1cc [ 48.033618][ T4045] le_conn_complete_evt+0x9a4/0x11bc [ 48.034478][ T4045] hci_le_meta_evt+0x85c/0x3010 [ 48.035260][ T4045] hci_event_packet+0xd10/0x11bc [ 48.036068][ T4045] hci_rx_work+0x1cc/0x880 [ 48.036774][ T4045] process_one_work+0x79c/0x1140 [ 48.037528][ T4045] worker_thread+0x8f4/0x101c [ 48.038287][ T4045] kthread+0x374/0x454 [ 48.038964][ T4045] ret_from_fork+0x10/0x20 [ 48.040088][ T4045] kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 48.042210][ T4045] Bluetooth: hci2: failed to register connection device [ 48.120594][ T4096] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 48.392674][ T4096] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 48.396205][ T4096] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 48.657960][ T4089] libceph: connect (1)[c::]:6789 error -101 [ 48.659783][ T4089] libceph: mon0 (1)[c::]:6789 connect error [ 49.033776][ T4089] libceph: connect (1)[c::]:6789 error -101 [ 49.034891][ T4089] libceph: mon0 (1)[c::]:6789 connect error [ 49.038624][ T4101] usb 1-1: USB disconnect, device number 2 [ 49.049034][ C1] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -108 [ 49.055472][ T4101] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 49.133656][ T4101] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 49.136119][ T4101] quatech2 1-1:0.51: device disconnected [ 49.257119][ T4049] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 49.259759][ T4049] CPU: 0 PID: 4049 Comm: kworker/u5:2 Not tainted 5.15.189-syzkaller #0 [ 49.261030][ T4049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 49.262672][ T4049] Workqueue: hci1 hci_rx_work [ 49.263439][ T4049] Call trace: [ 49.263949][ T4049] dump_backtrace+0x0/0x43c [ 49.264683][ T4049] show_stack+0x2c/0x3c [ 49.265309][ T4049] __dump_stack+0x30/0x40 [ 49.265969][ T4049] dump_stack_lvl+0xf8/0x160 [ 49.266670][ T4049] dump_stack+0x1c/0x5c [ 49.267272][ T4049] sysfs_create_dir_ns+0x22c/0x24c [ 49.268078][ T4049] kobject_add_internal+0x590/0xc54 [ 49.268883][ T4049] kobject_add+0x134/0x1f8 [ 49.269560][ T4049] device_add+0x3f0/0xf94 [ 49.270322][ T4049] hci_conn_add_sysfs+0xbc/0x1cc [ 49.271117][ T4049] le_conn_complete_evt+0x9a4/0x11bc [ 49.271906][ T4049] hci_le_meta_evt+0x85c/0x3010 [ 49.272656][ T4049] hci_event_packet+0xd10/0x11bc [ 49.273437][ T4049] hci_rx_work+0x1cc/0x880 [ 49.274121][ T4049] process_one_work+0x79c/0x1140 [ 49.274944][ T4049] worker_thread+0x8f4/0x101c [ 49.275742][ T4049] kthread+0x374/0x454 [ 49.276397][ T4049] ret_from_fork+0x10/0x20 [ 49.287416][ T4049] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 49.289780][ T4049] Bluetooth: hci1: failed to register connection device [ 49.800503][ T1969] libceph: connect (1)[c::]:6789 error -101 [ 49.827024][ T1969] libceph: mon0 (1)[c::]:6789 connect error [ 49.926845][ T4472] ceph: No mds server is up or the cluster is laggy [ 49.961574][ T4096] libceph: connect (1)[c::]:6789 error -101 [ 49.962745][ T4096] libceph: mon0 (1)[c::]:6789 connect error [ 50.079319][ T4495] ceph: No mds server is up or the cluster is laggy [ 50.634931][ T4512] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 50.637494][ T4512] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 50.639728][ T4512] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 52.009472][ T1969] Bluetooth: hci2: command 0x0406 tx timeout [ 52.779814][ T4045] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 52.781401][ T4045] CPU: 0 PID: 4045 Comm: kworker/u5:1 Not tainted 5.15.189-syzkaller #0 [ 52.782701][ T4045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 52.784138][ T4045] Workqueue: hci3 hci_rx_work [ 52.784792][ T4045] Call trace: [ 52.785222][ T4045] dump_backtrace+0x0/0x43c [ 52.785861][ T4045] show_stack+0x2c/0x3c [ 52.786495][ T4045] __dump_stack+0x30/0x40 [ 52.787219][ T4045] dump_stack_lvl+0xf8/0x160 [ 52.787979][ T4045] dump_stack+0x1c/0x5c [ 52.788608][ T4045] sysfs_create_dir_ns+0x22c/0x24c [ 52.789404][ T4045] kobject_add_internal+0x590/0xc54 [ 52.790285][ T4045] kobject_add+0x134/0x1f8 [ 52.791022][ T4045] device_add+0x3f0/0xf94 [ 52.791731][ T4045] hci_conn_add_sysfs+0xbc/0x1cc [ 52.792515][ T4045] le_conn_complete_evt+0x9a4/0x11bc [ 52.793402][ T4045] hci_le_meta_evt+0x85c/0x3010 [ 52.794235][ T4045] hci_event_packet+0xd10/0x11bc [ 52.795049][ T4045] hci_rx_work+0x1cc/0x880 [ 52.795784][ T4045] process_one_work+0x79c/0x1140 [ 52.796608][ T4045] worker_thread+0x8f4/0x101c [ 52.797364][ T4045] kthread+0x374/0x454 [ 52.797996][ T4045] ret_from_fork+0x10/0x20 [ 52.799802][ T4045] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 52.801913][ T4045] Bluetooth: hci3: failed to register connection device [ 52.826309][ T1969] libceph: connect (1)[c::]:6789 error -13 [ 52.828189][ T1969] libceph: mon0 (1)[c::]:6789 connect error [ 52.837956][ T1969] libceph: connect (1)[c::]:6789 error -13 [ 52.840893][ T1969] libceph: mon0 (1)[c::]:6789 connect error [ 52.967814][ T3625] Bluetooth: hci4: command 0x0406 tx timeout [ 53.099312][ T3625] libceph: connect (1)[c::]:6789 error -13 [ 53.100444][ T3625] libceph: mon0 (1)[c::]:6789 connect error [ 54.236187][ T3625] libceph: connect (1)[c::]:6789 error -13 [ 54.237205][ T3625] libceph: mon0 (1)[c::]:6789 connect error [ 54.241816][ T4539] ceph: No mds server is up or the cluster is laggy [ 54.569973][ T4049] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 54.571566][ T4049] CPU: 1 PID: 4049 Comm: kworker/u5:2 Not tainted 5.15.189-syzkaller #0 [ 54.572945][ T4049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 54.574577][ T4049] Workqueue: hci4 hci_rx_work [ 54.575360][ T4049] Call trace: [ 54.575869][ T4049] dump_backtrace+0x0/0x43c [ 54.576595][ T4049] show_stack+0x2c/0x3c [ 54.577267][ T4049] __dump_stack+0x30/0x40 [ 54.577982][ T4049] dump_stack_lvl+0xf8/0x160 [ 54.578721][ T4049] dump_stack+0x1c/0x5c [ 54.579401][ T4049] sysfs_create_dir_ns+0x22c/0x24c [ 54.580108][ T4049] kobject_add_internal+0x590/0xc54 [ 54.580910][ T4049] kobject_add+0x134/0x1f8 [ 54.581650][ T4049] device_add+0x3f0/0xf94 [ 54.582354][ T4049] hci_conn_add_sysfs+0xbc/0x1cc [ 54.583100][ T4049] le_conn_complete_evt+0x9a4/0x11bc [ 54.583940][ T4049] hci_le_meta_evt+0x85c/0x3010 [ 54.584665][ T4049] hci_event_packet+0xd10/0x11bc [ 54.585400][ T4049] hci_rx_work+0x1cc/0x880 [ 54.586084][ T4049] process_one_work+0x79c/0x1140 [ 54.586837][ T4049] worker_thread+0x8f4/0x101c [ 54.587556][ T4049] kthread+0x374/0x454 [ 54.588212][ T4049] ret_from_fork+0x10/0x20 [ 54.589337][ T4049] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 54.591699][ T4049] Bluetooth: hci4: failed to register connection device [ 54.783368][ T3625] Bluetooth: hci2: command 0x0406 tx timeout [ 54.907429][ T4600] netlink: 52 bytes leftover after parsing attributes in process `syz.1.160'. [ 55.748320][ T4600] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.749960][ T4600] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.947191][ T4623] udc-core: couldn't find an available UDC or it's busy [ 55.948396][ T4623] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 56.206104][ T4628] udc-core: couldn't find an available UDC or it's busy [ 56.207225][ T4628] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 56.360386][ T4634] netlink: 16 bytes leftover after parsing attributes in process `syz.2.162'. [ 56.430290][ T3625] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 56.519902][ T4045] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 56.521419][ T4045] CPU: 0 PID: 4045 Comm: kworker/u5:1 Not tainted 5.15.189-syzkaller #0 [ 56.522764][ T4045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 56.524303][ T4045] Workqueue: hci4 hci_rx_work [ 56.524974][ T4045] Call trace: [ 56.525455][ T4045] dump_backtrace+0x0/0x43c [ 56.526078][ T4045] show_stack+0x2c/0x3c [ 56.526732][ T4045] __dump_stack+0x30/0x40 [ 56.527360][ T4045] dump_stack_lvl+0xf8/0x160 [ 56.528000][ T4045] dump_stack+0x1c/0x5c [ 56.528620][ T4045] sysfs_create_dir_ns+0x22c/0x24c [ 56.529374][ T4045] kobject_add_internal+0x590/0xc54 [ 56.530138][ T4045] kobject_add+0x134/0x1f8 [ 56.530875][ T4045] device_add+0x3f0/0xf94 [ 56.531592][ T4045] hci_conn_add_sysfs+0xbc/0x1cc [ 56.532414][ T4045] le_conn_complete_evt+0x9a4/0x11bc [ 56.533343][ T4045] hci_le_meta_evt+0x85c/0x3010 [ 56.534149][ T4045] hci_event_packet+0xd10/0x11bc [ 56.534890][ T4045] hci_rx_work+0x1cc/0x880 [ 56.535552][ T4045] process_one_work+0x79c/0x1140 [ 56.536354][ T4045] worker_thread+0x8f4/0x101c [ 56.537130][ T4045] kthread+0x374/0x454 [ 56.537807][ T4045] ret_from_fork+0x10/0x20 [ 56.541989][ T4045] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 56.544226][ T4045] Bluetooth: hci4: failed to register connection device [ 56.959353][ T3625] usb 1-1: Using ep0 maxpacket: 32 [ 56.997746][ T4642] udc-core: couldn't find an available UDC or it's busy [ 56.999370][ T4642] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 57.119202][ T3625] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 57.120965][ T3625] usb 1-1: config 0 has no interfaces? [ 57.121817][ T3625] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1c09, bcdDevice= 0.00 [ 57.123541][ T3625] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.126451][ T3625] usb 1-1: config 0 descriptor?? [ 57.531697][ T4664] netlink: 'syz.4.183': attribute type 10 has an invalid length. [ 57.547287][ T4664] team0: Port device dummy0 added [ 57.593368][ T4666] udc-core: couldn't find an available UDC or it's busy [ 57.594725][ T4666] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 57.911342][ T4088] usb 1-1: USB disconnect, device number 3 [ 59.130988][ T4045] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 59.133484][ T4045] CPU: 1 PID: 4045 Comm: kworker/u5:1 Not tainted 5.15.189-syzkaller #0 [ 59.134702][ T4045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 59.136205][ T4045] Workqueue: hci3 hci_rx_work [ 59.136908][ T4045] Call trace: [ 59.137381][ T4045] dump_backtrace+0x0/0x43c [ 59.138046][ T4045] show_stack+0x2c/0x3c [ 59.138658][ T4045] __dump_stack+0x30/0x40 [ 59.139238][ T4045] dump_stack_lvl+0xf8/0x160 [ 59.139970][ T4045] dump_stack+0x1c/0x5c [ 59.140688][ T4045] sysfs_create_dir_ns+0x22c/0x24c [ 59.141558][ T4045] kobject_add_internal+0x590/0xc54 [ 59.142431][ T4045] kobject_add+0x134/0x1f8 [ 59.143158][ T4045] device_add+0x3f0/0xf94 [ 59.143882][ T4045] hci_conn_add_sysfs+0xbc/0x1cc [ 59.144629][ T4045] le_conn_complete_evt+0x9a4/0x11bc [ 59.145457][ T4045] hci_le_meta_evt+0x85c/0x3010 [ 59.146224][ T4045] hci_event_packet+0xd10/0x11bc [ 59.147080][ T4045] hci_rx_work+0x1cc/0x880 [ 59.147801][ T4045] process_one_work+0x79c/0x1140 [ 59.148629][ T4045] worker_thread+0x8f4/0x101c [ 59.149453][ T4045] kthread+0x374/0x454 [ 59.150109][ T4045] ret_from_fork+0x10/0x20 [ 59.152220][ T4045] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 59.154332][ T4045] Bluetooth: hci3: failed to register connection device [ 59.767451][ T4101] Bluetooth: hci3: command 0x0406 tx timeout [ 60.145191][ T4049] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 60.147841][ T4049] CPU: 1 PID: 4049 Comm: kworker/u5:2 Not tainted 5.15.189-syzkaller #0 [ 60.149067][ T4049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 60.150553][ T4049] Workqueue: hci3 hci_rx_work [ 60.151290][ T4049] Call trace: [ 60.151783][ T4049] dump_backtrace+0x0/0x43c [ 60.152514][ T4049] show_stack+0x2c/0x3c [ 60.153234][ T4049] __dump_stack+0x30/0x40 [ 60.153924][ T4049] dump_stack_lvl+0xf8/0x160 [ 60.154621][ T4049] dump_stack+0x1c/0x5c [ 60.155369][ T4049] sysfs_create_dir_ns+0x22c/0x24c [ 60.156247][ T4049] kobject_add_internal+0x590/0xc54 [ 60.157107][ T4049] kobject_add+0x134/0x1f8 [ 60.157868][ T4049] device_add+0x3f0/0xf94 [ 60.158582][ T4049] hci_conn_add_sysfs+0xbc/0x1cc [ 60.159387][ T4049] le_conn_complete_evt+0x9a4/0x11bc [ 60.160191][ T4049] hci_le_meta_evt+0x85c/0x3010 [ 60.160926][ T4049] hci_event_packet+0xd10/0x11bc [ 60.161696][ T4049] hci_rx_work+0x1cc/0x880 [ 60.162393][ T4049] process_one_work+0x79c/0x1140 [ 60.163240][ T4049] worker_thread+0x8f4/0x101c [ 60.163998][ T4049] kthread+0x374/0x454 [ 60.164638][ T4049] ret_from_fork+0x10/0x20 [ 60.177619][ T4049] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 60.181407][ T4049] Bluetooth: hci3: failed to register connection device [ 60.810520][ T4049] ================================================================== [ 60.811957][ T4049] BUG: KASAN: use-after-free in l2cap_sock_new_connection_cb+0x224/0x304 [ 60.813315][ T4049] Read of size 8 at addr ffff0000d72fd548 by task kworker/u5:2/4049 [ 60.814597][ T4049] [ 60.814997][ T4049] CPU: 0 PID: 4049 Comm: kworker/u5:2 Not tainted 5.15.189-syzkaller #0 [ 60.816247][ T4049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 60.817928][ T4049] Workqueue: hci3 hci_rx_work [ 60.818675][ T4049] Call trace: [ 60.819213][ T4049] dump_backtrace+0x0/0x43c [ 60.819967][ T4049] show_stack+0x2c/0x3c [ 60.820618][ T4049] __dump_stack+0x30/0x40 [ 60.821298][ T4049] dump_stack_lvl+0xf8/0x160 [ 60.822050][ T4049] print_address_description+0x78/0x30c [ 60.822930][ T4049] kasan_report+0xec/0x15c [ 60.823707][ T4049] __asan_report_load8_noabort+0x44/0x50 [ 60.824713][ T4049] l2cap_sock_new_connection_cb+0x224/0x304 [ 60.825695][ T4049] l2cap_connect_cfm+0x2d4/0xd64 [ 60.826538][ T4049] le_conn_complete_evt+0xa7c/0x11bc [ 60.827494][ T4049] hci_le_meta_evt+0x85c/0x3010 [ 60.828278][ T4049] hci_event_packet+0xd10/0x11bc [ 60.829114][ T4049] hci_rx_work+0x1cc/0x880 [ 60.829800][ T4049] process_one_work+0x79c/0x1140 [ 60.830703][ T4049] worker_thread+0x8f4/0x101c [ 60.831467][ T4049] kthread+0x374/0x454 [ 60.832113][ T4049] ret_from_fork+0x10/0x20 [ 60.832776][ T4049] [ 60.833159][ T4049] Allocated by task 4049: [ 60.833906][ T4049] __kasan_kmalloc+0xb0/0xf0 [ 60.834716][ T4049] __kmalloc+0x298/0x44c [ 60.835370][ T4049] sk_prot_alloc+0xc4/0x1f0 [ 60.836040][ T4049] sk_alloc+0x40/0x388 [ 60.836730][ T4049] l2cap_sock_new_connection_cb+0xe0/0x304 [ 60.837764][ T4049] l2cap_connect_cfm+0x2d4/0xd64 [ 60.838640][ T4049] le_conn_complete_evt+0xa7c/0x11bc [ 60.839598][ T4049] hci_le_meta_evt+0x85c/0x3010 [ 60.840437][ T4049] hci_event_packet+0xd10/0x11bc [ 60.841277][ T4049] hci_rx_work+0x1cc/0x880 [ 60.842040][ T4049] process_one_work+0x79c/0x1140 [ 60.842830][ T4049] worker_thread+0x8f4/0x101c [ 60.843610][ T4049] kthread+0x374/0x454 [ 60.844292][ T4049] ret_from_fork+0x10/0x20 [ 60.845009][ T4049] [ 60.845380][ T4049] Freed by task 4733: [ 60.845976][ T4049] kasan_set_track+0x4c/0x84 [ 60.846661][ T4049] kasan_set_free_info+0x28/0x4c [ 60.847392][ T4049] ____kasan_slab_free+0x118/0x164 [ 60.848173][ T4049] __kasan_slab_free+0x18/0x28 [ 60.848927][ T4049] slab_free_freelist_hook+0x128/0x1e8 [ 60.849767][ T4049] kfree+0x170/0x40c [ 60.850368][ T4049] __sk_destruct+0x41c/0x604 [ 60.851064][ T4049] __sk_free+0x320/0x430 [ 60.851680][ T4049] sk_free+0x68/0xdc [ 60.852305][ T4049] l2cap_sock_kill+0x114/0x228 [ 60.853008][ T4049] l2cap_sock_cleanup_listen+0xf4/0x28c [ 60.853787][ T4049] l2cap_sock_release+0x5c/0x1ac [ 60.854550][ T4049] sock_close+0xb4/0x1f8 [ 60.855167][ T4049] __fput+0x1c0/0x7f8 [ 60.855805][ T4049] ____fput+0x20/0x30 [ 60.856449][ T4049] task_work_run+0x12c/0x1e0 [ 60.857120][ T4049] get_signal+0x1240/0x1340 [ 60.857803][ T4049] do_notify_resume+0x35c/0x3128 [ 60.858492][ T4049] el0_svc+0xf0/0x1e0 [ 60.859077][ T4049] el0t_64_sync_handler+0xcc/0xe4 [ 60.859910][ T4049] el0t_64_sync+0x1a0/0x1a4 [ 60.860696][ T4049] [ 60.861152][ T4049] The buggy address belongs to the object at ffff0000d72fd000 [ 60.861152][ T4049] which belongs to the cache kmalloc-2k of size 2048 [ 60.863332][ T4049] The buggy address is located 1352 bytes inside of [ 60.863332][ T4049] 2048-byte region [ffff0000d72fd000, ffff0000d72fd800) [ 60.865611][ T4049] The buggy address belongs to the page: [ 60.866561][ T4049] page:000000003a688b9a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1172f8 [ 60.868265][ T4049] head:000000003a688b9a order:3 compound_mapcount:0 compound_pincount:0 [ 60.869670][ T4049] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 60.870981][ T4049] raw: 05ffc00000010200 fffffc000305de00 0000000300000003 ffff0000c0002900 [ 60.872465][ T4049] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 60.873878][ T4049] page dumped because: kasan: bad access detected [ 60.874991][ T4049] [ 60.875393][ T4049] Memory state around the buggy address: [ 60.876331][ T4049] ffff0000d72fd400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.877768][ T4049] ffff0000d72fd480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.879072][ T4049] >ffff0000d72fd500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.880338][ T4049] ^ [ 60.881352][ T4049] ffff0000d72fd580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.882532][ T4049] ffff0000d72fd600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.883820][ T4049] ================================================================== [ 60.884987][ T4049] Disabling lock debugging due to kernel taint [ 60.890861][ T4049] ------------[ cut here ]------------ [ 60.891744][ T4049] refcount_t: addition on 0; use-after-free. [ 60.892812][ T4049] WARNING: CPU: 0 PID: 4049 at lib/refcount.c:25 refcount_warn_saturate+0x134/0x1f8 [ 60.894243][ T4049] Modules linked in: [ 60.894810][ T4049] CPU: 0 PID: 4049 Comm: kworker/u5:2 Tainted: G B 5.15.189-syzkaller #0 [ 60.896279][ T4049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 60.897802][ T4049] Workqueue: hci3 hci_rx_work [ 60.898537][ T4049] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 60.899728][ T4049] pc : refcount_warn_saturate+0x134/0x1f8 [ 60.900608][ T4049] lr : refcount_warn_saturate+0x134/0x1f8 [ 60.901460][ T4049] sp : ffff80001f637480 [ 60.902081][ T4049] x29: ffff80001f637480 x28: dfff800000000000 x27: 0000000000000000 [ 60.903261][ T4049] x26: 1fffe000182ef607 x25: 1fffe0001a13d800 x24: dfff800000000000 [ 60.904504][ T4049] x23: ffff0000ee828021 x22: 00000000ffffffff x21: ffff0000c177b03f [ 60.905901][ T4049] x20: ffff0000c177b018 x19: ffff8000165b2000 x18: 0000000000000001 [ 60.907162][ T4049] x17: 0000000000000000 x16: ffff8000083020fc x15: 00000000ffffffff [ 60.908591][ T4049] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 60.909978][ T4049] x11: 0000000000000000 x10: 0000000000000000 x9 : bc4e8cd2c3c67100 [ 60.911311][ T4049] x8 : bc4e8cd2c3c67100 x7 : 0000000000000001 x6 : 0000000000000001 [ 60.912625][ T4049] x5 : ffff80001f636d78 x4 : ffff80001424f400 x3 : ffff80000830220c [ 60.913908][ T4049] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000002a [ 60.915260][ T4049] Call trace: [ 60.915820][ T4049] refcount_warn_saturate+0x134/0x1f8 [ 60.916736][ T4049] l2cap_chan_hold+0xa4/0x13c [ 60.917531][ T4049] __l2cap_chan_add+0x278/0x6e4 [ 60.918311][ T4049] l2cap_connect_cfm+0x380/0xd64 [ 60.919148][ T4049] le_conn_complete_evt+0xa7c/0x11bc [ 60.920036][ T4049] hci_le_meta_evt+0x85c/0x3010 [ 60.920821][ T4049] hci_event_packet+0xd10/0x11bc [ 60.921602][ T4049] hci_rx_work+0x1cc/0x880 [ 60.922315][ T4049] process_one_work+0x79c/0x1140 [ 60.923118][ T4049] worker_thread+0x8f4/0x101c [ 60.923888][ T4049] kthread+0x374/0x454 [ 60.924521][ T4049] ret_from_fork+0x10/0x20 [ 60.925204][ T4049] irq event stamp: 4532 [ 60.925889][ T4049] hardirqs last enabled at (4531): [] finish_lock_switch+0xb0/0x1c4 [ 60.927461][ T4049] hardirqs last disabled at (4532): [] _raw_spin_lock_irqsave+0xfc/0x14c [ 60.929181][ T4049] softirqs last enabled at (4528): [] release_sock+0x1d0/0x258 [ 60.930695][ T4049] softirqs last disabled at (4524): [] release_sock+0x34/0x258 [ 60.932170][ T4049] ---[ end trace f0ced86f0acff3fd ]--- [ 60.952314][ T4743] netlink: 20 bytes leftover after parsing attributes in process `syz.3.209'. [ 60.962263][ T4049] ------------[ cut here ]------------ [ 60.963193][ T4049] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x90 [ 60.965247][ T4049] WARNING: CPU: 1 PID: 4049 at lib/debugobjects.c:521 debug_print_object+0x148/0x1d4 [ 60.966748][ T4049] Modules linked in: [ 60.967377][ T4049] CPU: 1 PID: 4049 Comm: kworker/u5:2 Tainted: G B W 5.15.189-syzkaller #0 [ 60.968828][ T4049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 60.970488][ T4049] Workqueue: hci3 hci_rx_work [ 60.971277][ T4049] pstate: 624000c5 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 60.972505][ T4049] pc : debug_print_object+0x148/0x1d4 [ 60.973321][ T4049] lr : debug_print_object+0x148/0x1d4 [ 60.974212][ T4049] sp : ffff80001f6371e0 [ 60.974940][ T4049] x29: ffff80001f6371e0 x28: 1fffe000182ef606 x27: 0000000000000000 [ 60.976317][ T4049] x26: ffff800014170000 x25: ffff80000837e25c x24: dfff800000000000 [ 60.977720][ T4049] x23: 0000000000000000 x22: ffff8000081e85f0 x21: ffff8000117c8f60 [ 60.979021][ T4049] x20: ffff800011332ce0 x19: ffff8000117c8aa0 x18: 0000000000000001 [ 60.980354][ T4049] x17: 0000000000000000 x16: ffff8000111bc798 x15: 00000000ffffffff [ 60.981681][ T4049] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 60.983015][ T4049] x11: 0000000000000000 x10: 0000000000000000 x9 : bc4e8cd2c3c67100 [ 60.984365][ T4049] x8 : bc4e8cd2c3c67100 x7 : 0000000000000001 x6 : 0000000000000001 [ 60.985614][ T4049] x5 : ffff80001f636ad8 x4 : ffff80001424f400 x3 : ffff80000850433c [ 60.986902][ T4049] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000006f [ 60.988173][ T4049] Call trace: [ 60.988720][ T4049] debug_print_object+0x148/0x1d4 [ 60.989553][ T4049] debug_object_assert_init+0x24c/0x2c4 [ 60.990400][ T4049] del_timer+0x48/0x1e4 [ 60.991009][ T4049] try_to_grab_pending+0xa4/0x66c [ 60.991760][ T4049] __cancel_work+0x44/0x224 [ 60.992529][ T4049] cancel_delayed_work+0x24/0x38 [ 60.993351][ T4049] l2cap_le_start+0x3dc/0x131c [ 60.994088][ T4049] l2cap_connect_cfm+0x578/0xd64 [ 60.994891][ T4049] le_conn_complete_evt+0xa7c/0x11bc [ 60.995783][ T4049] hci_le_meta_evt+0x85c/0x3010 [ 60.996566][ T4049] hci_event_packet+0xd10/0x11bc [ 60.997332][ T4049] hci_rx_work+0x1cc/0x880 [ 60.998049][ T4049] process_one_work+0x79c/0x1140 [ 60.998881][ T4049] worker_thread+0x8f4/0x101c [ 60.999608][ T4049] kthread+0x374/0x454 [ 61.000251][ T4049] ret_from_fork+0x10/0x20 [ 61.000958][ T4049] irq event stamp: 4532 [ 61.001655][ T4049] hardirqs last enabled at (4531): [] finish_lock_switch+0xb0/0x1c4 [ 61.003220][ T4049] hardirqs last disabled at (4532): [] _raw_spin_lock_irqsave+0xfc/0x14c [ 61.004765][ T4049] softirqs last enabled at (4528): [] release_sock+0x1d0/0x258 [ 61.006239][ T4049] softirqs last disabled at (4524): [] release_sock+0x34/0x258 [ 61.007678][ T4049] ---[ end trace f0ced86f0acff3fe ]--- [ 61.011249][ T4049] Unable to handle kernel paging request at virtual address dfff800000000011 [ 61.012713][ T4049] Mem abort info: [ 61.013285][ T4049] ESR = 0x0000000096000006 [ 61.014047][ T4049] EC = 0x25: DABT (current EL), IL = 32 bits [ 61.015105][ T4049] SET = 0, FnV = 0 [ 61.015715][ T4049] EA = 0, S1PTW = 0 [ 61.016370][ T4049] FSC = 0x06: level 2 translation fault [ 61.017319][ T4049] Data abort info: [ 61.017906][ T4049] ISV = 0, ISS = 0x00000006 [ 61.018632][ T4049] CM = 0, WnR = 0 [ 61.019262][ T4049] [dfff800000000011] address between user and kernel address ranges [ 61.020539][ T4049] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ 61.021612][ T4049] Modules linked in: [ 61.022186][ T4049] CPU: 0 PID: 4049 Comm: kworker/u5:2 Tainted: G B W 5.15.189-syzkaller #0 [ 61.023700][ T4049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 61.025168][ T4049] Workqueue: hci3 hci_rx_work [ 61.025854][ T4049] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 61.026955][ T4049] pc : do_raw_spin_lock+0x80/0x2f0 [ 61.027698][ T4049] lr : _raw_spin_lock_bh+0x11c/0x1b4 [ 61.028464][ T4049] sp : ffff80001f637240 [ 61.029166][ T4049] x29: ffff80001f6372d0 x28: 1fffe000182ef606 x27: dfff800000000000 [ 61.030548][ T4049] x26: ffff700003ec6e84 x25: 1fffe000182ef600 x24: dfff800000000000 [ 61.031776][ T4049] x23: dfff800000000000 x22: 1ffff00003ec6e4c x21: ffff8000167a8000 [ 61.032929][ T4049] x20: 000000000000008c x19: 0000000000000088 x18: 0000000000000001 [ 61.034153][ T4049] x17: 0000000000000000 x16: ffff8000082d5f6c x15: 00000000ffffffff [ 61.035428][ T4049] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 61.036723][ T4049] x11: ffff80001f637260 x10: ffff800013a7cc50 x9 : f3f3f304f1f1f1f1 [ 61.038014][ T4049] x8 : 0000000000000011 x7 : 0000000000000000 x6 : ffff80000f69f014 [ 61.039253][ T4049] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 [ 61.040426][ T4049] x2 : 0000000000000000 x1 : ffff8000117c8460 x0 : 0000000000000088 [ 61.041563][ T4049] Call trace: [ 61.042036][ T4049] do_raw_spin_lock+0x80/0x2f0 [ 61.042702][ T4049] _raw_spin_lock_bh+0x11c/0x1b4 [ 61.043396][ T4049] lock_sock_nested+0xf4/0x1d4 [ 61.044073][ T4049] l2cap_sock_ready_cb+0x4c/0x130 [ 61.044896][ T4049] l2cap_le_start+0x56c/0x131c [ 61.045647][ T4049] l2cap_connect_cfm+0x578/0xd64 [ 61.046416][ T4049] le_conn_complete_evt+0xa7c/0x11bc [ 61.047208][ T4049] hci_le_meta_evt+0x85c/0x3010 [ 61.047984][ T4049] hci_event_packet+0xd10/0x11bc [ 61.048703][ T4049] hci_rx_work+0x1cc/0x880 [ 61.049486][ T4049] process_one_work+0x79c/0x1140 [ 61.050362][ T4049] worker_thread+0x8f4/0x101c [ 61.051141][ T4049] kthread+0x374/0x454 [ 61.051807][ T4049] ret_from_fork+0x10/0x20 [ 61.052532][ T4049] Code: f2de6089 aa0003f3 f2fe7e69 f8376ac9 (38f76908) [ 61.053612][ T4049] ---[ end trace f0ced86f0acff3ff ]--- [ 61.272227][ T4049] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 61.273370][ T4049] SMP: stopping secondary CPUs [ 61.274040][ T4049] Kernel Offset: disabled [ 61.274664][ T4049] CPU features: 0x8,000003c1,7d33ffd9 [ 61.275441][ T4049] Memory Limit: none [ 61.484199][ T4049] Rebooting in 86400 seconds..