last executing test programs: 6.847433027s ago: executing program 2 (id=537): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080), 0x1, 0x4cf, &(0x7f0000000500)="$eJzs3c1rG2caAPBHUuzYjnfzscuSZGETyEL2g1j+YIm9u7DsaXcPgaWBXlpIXVtxU8uWseQ0Njk47S2HHkpLC6WH3vsX9NKcGgql55ZeSw8lpU1daAsFFY2kxB+S46aO5Hh+P5ho5h1lnveVeF7PvDOjCSC1Ttf+yUQMRsRHEXG4vrjxDafrL2t3r0/VpkxUqxe/yiTvqy0339r8f4ciYjUi+iLiif9EPJvZGre8vDI7WSwWFhvL+crcQr68vHLuytzkTGGmMD8yfn5iYnx4bHRi19p68+Xnb15493+973z30p3br7z/Xq1ag41169uxm+pN74mj68oORMQ/H0WwLsg12tPf7YrwUGrf328i4kyS/4cjl3ybQBpUq9Xqj9WD7VavVoF9K5vsA2eyQxFRn89mh4bq+/C/jYFssVSu/PVyaWl+ur6vfCR6spevFAvDjWOFI9GTqS2PJPP3l0c3LY9FJPvAr+b6k+WhqVJxurNdHbDJoU35/22unv9ASjjkh/SS/5Be8h/SS/5Desl/SC/5D+kl/yG95D+kl/yH9JL/kF7b5X9vB+sBdNT/L1yoTdXm/e/TV5eXZktXz00XyrNDc0tTQ1OlxYWhmVJpJrlnZ+5B2yuWSgsjf4ula/lKoVzJl5dXLs2VluYrl5L7+i8VejrSKmAnjp669UkmIlb/3p9Mse5PvlyF/a1azUS370EGuiPX7Q4I6BpD/5BeP+MYv+2PhAGPtxY/0btBX+vif8XCIwkHdEC22xUAuubsCef/IK2M/0N6Gf+H9LKPDzzk+H88aPxf/wJ7l/F/SK/BNs//+tW6Z3cNR8SvI+LjXM/B5rO+gP0g+0Wmsf9/9vAfBzev7c18n5wi6I2IF968+Pq1yUplcaRW/vW98sobjfLRbtQf2KlmnjbzGABIr7W716eaUyfjfvnv+kUIW+MfaIxN9iXnEAbWMhuuVcjs0rULqzci4nir+JnG887rZz4G1nJb4h9rvGbqm0jqeyB5bnpn4p9YF/8P6+Kf/MWfCqTDrVr/M9wq/7JJTse9/NvY/wzu0rnN9v1f9l7/l2vT/53asKXVtjGee+vFz9vGvxFxsmX8Zry+JNbm+LW6nd1hG+88/eTv2q2rvl3fTqv4TbW5fGVuIV9eXjmX/I7cTGF+ZPz8xMT48NjoRD4Zo843R6q3+sfxD29v1/6BNvHr7f20ZftrZX/eYft/+P0HT53eJv6fzrT+/o8lr60///6I+MsO438z+tkz7dbV4k+3aX92m/i1srEdxi+/9l/3DgPAHlJeXpmdLBYLi2b2/kz/3qiGmTTMPKjnaH+8CTwe7id9t2sCAAAAAAAAAAAA7FQnLifudhsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPaDnwIAAP//J4fYHQ==") prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r0 = socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netstat\x00') read$FUSE(r2, &(0x7f0000000640)={0x2020}, 0x2020) epoll_create1(0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000080)={0x0, 0x8000, 0x3}, 0x8) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, 0x0) quotactl$Q_QUOTAOFF(0xffffffff80000700, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0xee00, 0x8cffffff00000000) 6.220188776s ago: executing program 2 (id=539): socket$nl_sock_diag(0x10, 0x3, 0x4) bind$tipc(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) fsmount(r1, 0x0, 0x8) read$FUSE(0xffffffffffffffff, &(0x7f0000004000)={0x2020}, 0x2020) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r2, 0x0, 0x0) accept(r2, 0x0, 0x0) 6.019600883s ago: executing program 1 (id=545): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r3) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, r4, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x48050}, 0x0) 5.621312695s ago: executing program 2 (id=546): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x80) r0 = socket$kcm(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x6, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f00000004c0), 0xce, r2}, 0x38) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x20040004) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000280)={0x4000}, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x12, 0xa01, 0x0, 0x0, {0x0, 0x0, 0x2}}, 0x14}}, 0x0) socket$unix(0x1, 0x5, 0x0) r5 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000100)={0x84, @local, 0x4e21, 0x3, 'sed\x00', 0x0, 0xa7e, 0x3f}, 0x2c) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000000600)={0xffffffffffffffff, r1, 0x400, 0x0, &(0x7f0000000180), 0x9, 0xe0, 0x6, 0xf84, 0x9, 0x3, 0x1d60, 'syz1\x00'}) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000300)={{0x84, @empty, 0x4f28, 0x3, 'nq\x00', 0x5, 0x8, 0x78}, {@dev={0xac, 0x14, 0x14, 0x30}, 0x4e24, 0x3, 0x6, 0x1, 0x1}}, 0x44) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000006c0)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x4, 0x0, 0x0, @broadcast=0x100e000, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private, @empty}}}}}}, 0x0) 5.584540626s ago: executing program 1 (id=547): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x2, &(0x7f0000000080), 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r4}, &(0x7f00000006c0), &(0x7f0000000380)=r3}, 0x20) shutdown(r2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x0) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) ioctl$DRM_IOCTL_PANTHOR_BO_QUERY_INFO(0xffffffffffffffff, 0xc0106450, &(0x7f00000004c0)={0x0, 0x1, 0x2}) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(r0, 0xc0186445, &(0x7f0000000500)={0x4f6}) 5.370914243s ago: executing program 2 (id=549): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000180)={0x50, r1, 0x1, 0xfffffffd, 0xfffffffd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SEC_DEVKEY={0x34, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0002}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x4}, @NL802154_DEVKEY_ATTR_ID={0x1c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8}, @NL802154_KEY_ID_ATTR_INDEX={0x5}]}]}]}, 0x50}}, 0x0) 5.246882847s ago: executing program 1 (id=550): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080), 0x1, 0x4cf, &(0x7f0000000500)="$eJzs3c1rG2caAPBHUuzYjnfzscuSZGETyEL2g1j+YIm9u7DsaXcPgaWBXlpIXVtxU8uWseQ0Njk47S2HHkpLC6WH3vsX9NKcGgql55ZeSw8lpU1daAsFFY2kxB+S46aO5Hh+P5ho5h1lnveVeF7PvDOjCSC1Ttf+yUQMRsRHEXG4vrjxDafrL2t3r0/VpkxUqxe/yiTvqy0339r8f4ciYjUi+iLiif9EPJvZGre8vDI7WSwWFhvL+crcQr68vHLuytzkTGGmMD8yfn5iYnx4bHRi19p68+Xnb15493+973z30p3br7z/Xq1ag41169uxm+pN74mj68oORMQ/H0WwLsg12tPf7YrwUGrf328i4kyS/4cjl3ybQBpUq9Xqj9WD7VavVoF9K5vsA2eyQxFRn89mh4bq+/C/jYFssVSu/PVyaWl+ur6vfCR6spevFAvDjWOFI9GTqS2PJPP3l0c3LY9FJPvAr+b6k+WhqVJxurNdHbDJoU35/22unv9ASjjkh/SS/5Be8h/SS/5Desl/SC/5D+kl/yG95D+kl/yH9JL/kF7b5X9vB+sBdNT/L1yoTdXm/e/TV5eXZktXz00XyrNDc0tTQ1OlxYWhmVJpJrlnZ+5B2yuWSgsjf4ula/lKoVzJl5dXLs2VluYrl5L7+i8VejrSKmAnjp669UkmIlb/3p9Mse5PvlyF/a1azUS370EGuiPX7Q4I6BpD/5BeP+MYv+2PhAGPtxY/0btBX+vif8XCIwkHdEC22xUAuubsCef/IK2M/0N6Gf+H9LKPDzzk+H88aPxf/wJ7l/F/SK/BNs//+tW6Z3cNR8SvI+LjXM/B5rO+gP0g+0Wmsf9/9vAfBzev7c18n5wi6I2IF968+Pq1yUplcaRW/vW98sobjfLRbtQf2KlmnjbzGABIr7W716eaUyfjfvnv+kUIW+MfaIxN9iXnEAbWMhuuVcjs0rULqzci4nir+JnG887rZz4G1nJb4h9rvGbqm0jqeyB5bnpn4p9YF/8P6+Kf/MWfCqTDrVr/M9wq/7JJTse9/NvY/wzu0rnN9v1f9l7/l2vT/53asKXVtjGee+vFz9vGvxFxsmX8Zry+JNbm+LW6nd1hG+88/eTv2q2rvl3fTqv4TbW5fGVuIV9eXjmX/I7cTGF+ZPz8xMT48NjoRD4Zo843R6q3+sfxD29v1/6BNvHr7f20ZftrZX/eYft/+P0HT53eJv6fzrT+/o8lr60///6I+MsO438z+tkz7dbV4k+3aX92m/i1srEdxi+/9l/3DgPAHlJeXpmdLBYLi2b2/kz/3qiGmTTMPKjnaH+8CTwe7id9t2sCAAAAAAAAAAAA7FQnLifudhsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPaDnwIAAP//J4fYHQ==") prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r0 = socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netstat\x00') read$FUSE(r2, &(0x7f0000000640)={0x2020}, 0x2020) epoll_create1(0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000080)={0x0, 0x8000, 0x3}, 0x8) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, 0x0) quotactl$Q_QUOTAOFF(0xffffffff80000700, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0xee00, 0x8cffffff00000000) 5.044693223s ago: executing program 2 (id=552): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0xaf51, 0x28400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000006c0)={0x0, &(0x7f0000000600)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r0, 0xc01864b0, &(0x7f0000000780)={r1, 0x0, 0x4, 0x101, 0x81}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x1, 0x0, 'syz1\x00', &(0x7f0000000180)=['-[\'\x00'], 0x4}) r5 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000001180)='cgroup.clone_children\x00', 0x2, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendfile(r5, r6, 0x0, 0x38) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r6, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x28, 0x1411, 0x100, 0x70bd2a, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x2}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b9a48f10b1134200c9070102030109022400010100100009041302028367160009050402000200fa000905810b40"], 0x0) ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) pread64(0xffffffffffffffff, &(0x7f0000000040)=""/21, 0x15, 0x9) sendmsg$nl_route_sched(r2, 0x0, 0x850) 4.013605175s ago: executing program 1 (id=557): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x6, 0x8, 0xfbee}, 0x1, 0x0, 0x3, 0x5, 0xe, 0x4, 0xd, 0x18, 0x5, 0x2, {0x6, 0x8, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 3.486602641s ago: executing program 0 (id=559): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x3, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x40}, 0x1, 0x0, 0x0, 0x40001}, 0xc000) close(0x3) 3.299791327s ago: executing program 4 (id=561): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x8000000) fanotify_mark(0xffffffffffffffff, 0x265, 0x26, 0xffffffffffffffff, 0x0) faccessat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x40) read$FUSE(0xffffffffffffffff, &(0x7f0000001d80)={0x2020}, 0x2020) 3.048815585s ago: executing program 0 (id=562): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@setlink={0x20, 0x13, 0x1, 0x2000000, 0x25dfdbff}, 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) getsockopt(r1, 0x200000000114, 0x2717, 0x0, &(0x7f00000001c0)) 2.995922427s ago: executing program 1 (id=564): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) listen(0xffffffffffffffff, 0xffff7ffc) socket$netlink(0x10, 0x3, 0x4) syz_io_uring_setup(0x370a, 0x0, &(0x7f00000004c0), &(0x7f0000000000), 0x0) r3 = userfaultfd(0x80801) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x430}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000800000/0x800000)=nil, &(0x7f000022a000/0x4000)=nil, 0x800000}) 2.848590371s ago: executing program 0 (id=565): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x0, 0x20000000, 0xb2, 0xa8}, 0x38}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4894}, 0x2) close(r4) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r6, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0000004008002500000088125ce882cbf400930bf4533f00429c65112a093bbf60b85bcb06", 0x2e}], 0x1}, 0x4005) 2.782265013s ago: executing program 3 (id=566): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010040000000000002034400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000000000000000001c005a80180001"], 0x4c}, 0x1, 0x0, 0x0, 0x40010}, 0x4090) 2.59024381s ago: executing program 3 (id=567): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080), 0x1, 0x4cf, &(0x7f0000000500)="$eJzs3c1rG2caAPBHUuzYjnfzscuSZGETyEL2g1j+YIm9u7DsaXcPgaWBXlpIXVtxU8uWseQ0Njk47S2HHkpLC6WH3vsX9NKcGgql55ZeSw8lpU1daAsFFY2kxB+S46aO5Hh+P5ho5h1lnveVeF7PvDOjCSC1Ttf+yUQMRsRHEXG4vrjxDafrL2t3r0/VpkxUqxe/yiTvqy0339r8f4ciYjUi+iLiif9EPJvZGre8vDI7WSwWFhvL+crcQr68vHLuytzkTGGmMD8yfn5iYnx4bHRi19p68+Xnb15493+973z30p3br7z/Xq1ag41169uxm+pN74mj68oORMQ/H0WwLsg12tPf7YrwUGrf328i4kyS/4cjl3ybQBpUq9Xqj9WD7VavVoF9K5vsA2eyQxFRn89mh4bq+/C/jYFssVSu/PVyaWl+ur6vfCR6spevFAvDjWOFI9GTqS2PJPP3l0c3LY9FJPvAr+b6k+WhqVJxurNdHbDJoU35/22unv9ASjjkh/SS/5Be8h/SS/5Desl/SC/5D+kl/yG95D+kl/yH9JL/kF7b5X9vB+sBdNT/L1yoTdXm/e/TV5eXZktXz00XyrNDc0tTQ1OlxYWhmVJpJrlnZ+5B2yuWSgsjf4ula/lKoVzJl5dXLs2VluYrl5L7+i8VejrSKmAnjp669UkmIlb/3p9Mse5PvlyF/a1azUS370EGuiPX7Q4I6BpD/5BeP+MYv+2PhAGPtxY/0btBX+vif8XCIwkHdEC22xUAuubsCef/IK2M/0N6Gf+H9LKPDzzk+H88aPxf/wJ7l/F/SK/BNs//+tW6Z3cNR8SvI+LjXM/B5rO+gP0g+0Wmsf9/9vAfBzev7c18n5wi6I2IF968+Pq1yUplcaRW/vW98sobjfLRbtQf2KlmnjbzGABIr7W716eaUyfjfvnv+kUIW+MfaIxN9iXnEAbWMhuuVcjs0rULqzci4nir+JnG887rZz4G1nJb4h9rvGbqm0jqeyB5bnpn4p9YF/8P6+Kf/MWfCqTDrVr/M9wq/7JJTse9/NvY/wzu0rnN9v1f9l7/l2vT/53asKXVtjGee+vFz9vGvxFxsmX8Zry+JNbm+LW6nd1hG+88/eTv2q2rvl3fTqv4TbW5fGVuIV9eXjmX/I7cTGF+ZPz8xMT48NjoRD4Zo843R6q3+sfxD29v1/6BNvHr7f20ZftrZX/eYft/+P0HT53eJv6fzrT+/o8lr60///6I+MsO438z+tkz7dbV4k+3aX92m/i1srEdxi+/9l/3DgPAHlJeXpmdLBYLi2b2/kz/3qiGmTTMPKjnaH+8CTwe7id9t2sCAAAAAAAAAAAA7FQnLifudhsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPaDnwIAAP//J4fYHQ==") prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r0 = socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netstat\x00') read$FUSE(r2, &(0x7f0000000640)={0x2020}, 0x2020) epoll_create1(0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000080)={0x0, 0x8000, 0x3}, 0x8) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, 0x0) quotactl$Q_QUOTAOFF(0xffffffff80000700, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0xee00, 0x8cffffff00000000) 2.536704541s ago: executing program 0 (id=568): bind$xdp(0xffffffffffffffff, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000100)={r0}) r2 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000340)={r2}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_to_hsr\x00', 0x0}) bind$xdp(r3, &(0x7f00000005c0)={0x2d, 0x0, r5, 0xc}, 0x10) bind$xdp(r1, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r6, 0x84, 0x77, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="07000015"], 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0x3, &(0x7f0000000000)=ANY=[], &(0x7f0000000480)='GPL\x00'}, 0x94) r7 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_SIOCSIFBR(r7, 0x8941, &(0x7f0000000080)=@add_del={0x2, &(0x7f0000000040)='nr0\x00'}) 2.300942579s ago: executing program 4 (id=569): socket$nl_sock_diag(0x10, 0x3, 0x4) bind$tipc(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) fsmount(r3, 0x0, 0x8) read$FUSE(0xffffffffffffffff, &(0x7f0000004000)={0x2020}, 0x2020) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r4, 0x0, 0x0) accept(r4, 0x0, 0x0) 1.630455409s ago: executing program 4 (id=570): r0 = socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x44, 0x6, 0x3e8, 0x130, 0x98, 0x1f0, 0x130, 0x98, 0x350, 0x350, 0x350, 0x350, 0x350, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'veth1_to_batadv\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x69}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0xb}, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@ttl={{0x28}, {0x2, 0x81}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'dummy0\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x8, 0x8, 0x6}}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x3, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x448) r2 = fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r3, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) setrlimit(0x40000000000008, &(0x7f0000000000)={0x4848, 0xfffffffffffff006}) mlock2(&(0x7f0000006000/0x4000)=nil, 0x4000, 0x0) mlock(&(0x7f0000007000/0x2000)=nil, 0x2000) poll(&(0x7f00000011c0)=[{r3, 0x2}], 0x1, 0x3) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, 0x0, &(0x7f0000000080)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NFC_CMD_LLC_GET_PARAMS(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010029bd7000fedbdf250f0000", @ANYRES32=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20010}, 0x8000) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = dup(r6) write$UHID_INPUT(r7, &(0x7f0000002080)={0x200f, {"20e30a30ed0d09f91b5e070987f70e06d038e7ff7fc6e5539b0d3e0e8b089b3f363063030890e0879b0af8c6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c526db51b1b5b31070d0773090acd3b78130daa61d8e8040001000000b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19300305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f6709000000a141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a027d5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf050000008000000000f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b3f3f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7af1d0e54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c01008e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2f5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d21488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e1a63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e09d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a603336c00000077cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046ca5b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe6531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e6586df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59555e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0d8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb601203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f900000930dedf800", 0x1000}}, 0x1006) 1.433410246s ago: executing program 0 (id=571): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) write$tun(r0, &(0x7f0000000440)={@val={0x0, 0x6005}, @void, @eth={@multicast, @multicast, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x6, 0x0, 0x6}}, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x3, 0x3, 0x24, 0x64, 0x0, 0x8, 0x21, 0x0, @empty, @multicast2}, {{0x4e24, 0x4e21, 0x4, 0x1, 0x0, 0x0, 0x0, 0x6, 0x2, "6d85ea", 0x1e, "e908f9"}}}}}}}, 0x3e) 1.432645086s ago: executing program 1 (id=572): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0xaf51, 0x28400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000006c0)={0x0, &(0x7f0000000600)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r0, 0xc01864b0, &(0x7f0000000780)={r1, 0x0, 0x4, 0x101, 0x81}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x1, 0x0, 'syz1\x00', &(0x7f0000000180)=['-[\'\x00'], 0x4}) r5 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000001180)='cgroup.clone_children\x00', 0x2, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendfile(r5, r6, 0x0, 0x38) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r6, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x28, 0x1411, 0x100, 0x70bd2a, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x2}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r7 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r7, 0x976be000) syz_usb_connect(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b9a48f10b1134200c9070102030109022400010100100009041302028367160009050402000200fa000905810b40"], 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$KVM_CHECK_EXTENSION(r8, 0xae03, 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) pread64(r7, &(0x7f0000000040)=""/21, 0x15, 0x9) sendmsg$nl_route_sched(r2, 0x0, 0x850) 1.311768829s ago: executing program 3 (id=573): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x2, &(0x7f0000000080), 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r6}, &(0x7f00000006c0), &(0x7f0000000380)=r5}, 0x20) shutdown(r4, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x0) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) ioctl$DRM_IOCTL_PANTHOR_BO_QUERY_INFO(0xffffffffffffffff, 0xc0106450, &(0x7f00000004c0)={0x0, 0x1, 0x2}) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(r0, 0xc0186445, &(0x7f0000000500)={0x4f6}) 1.28474816s ago: executing program 2 (id=574): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=@srh={0x73, 0x2, 0x4, 0x1, 0x80, 0x40, 0x1, [@loopback]}, 0x18) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e21, 0x44, @remote, 0x5}]}, &(0x7f0000000100)=0x10) 652.80798ms ago: executing program 0 (id=575): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001800)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmmsg(r0, &(0x7f0000007380)=[{{0x0, 0x0, &(0x7f0000002a40)=[{&(0x7f0000000300)=""/131, 0x83}, {&(0x7f0000000400)=""/230, 0xe6}, {&(0x7f00000006c0)=""/170, 0xaa}, {&(0x7f0000001840)=""/4096, 0x1000}, {&(0x7f0000000000)=""/206, 0xce}, {&(0x7f0000002940)=""/246, 0xf6}], 0x6, &(0x7f0000002ac0)=""/5, 0x5}, 0x5fb5}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0xff}, {{0x0, 0x0, 0x0}, 0x3ff}, {{0x0, 0x0, 0x0}, 0xf3cd}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x4000000}, {{0x0, 0x0, 0x0}, 0x7f}], 0x8, 0x100, 0x0) 441.615137ms ago: executing program 3 (id=576): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0xffff}, {0xffff, 0xffff}, {0x2, 0x10}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x1, 0x0, 0xf, 0x11, 0x7, 0x4, 0xa, 0xf, 0x6, 0x3, 0x7, 0x2, 0x4, 0xa, 0x4], 0x3, [0xb, 0x3, 0x1, 0x2002, 0x1, 0x4, 0x2, 0xd09, 0x1, 0x4, 0xb, 0x3, 0x5, 0x2, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x34ae, 0x1, 0x9, 0x3ff, 0x2, 0xc, 0x43, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x4}, {0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x6, 0x2, 0x8, 0x2, 0x0, 0x1, 0x8, 0x1, 0x10, 0x4], 0x3, [0xc, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x6, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x2a, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x48040, &(0x7f00000001c0)={0x11, 0x7, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) 424.274797ms ago: executing program 4 (id=577): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendto$packet(0xffffffffffffffff, &(0x7f0000000180)="44c3", 0x2, 0x870, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010829bd7000000000000b00000008000300", @ANYRES32=r2, @ANYBLOB="60005080110001004abee339084eeef16f162471f4000000080003000aac0f00050002"], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x0) 330.14555ms ago: executing program 4 (id=578): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x18, 0x140b, 0xddc7ec68a2052e43, 0x70bd28, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x20000010) 232.663703ms ago: executing program 4 (id=579): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shutdown(0xffffffffffffffff, 0x0) syz_80211_inject_frame(&(0x7f0000000300), &(0x7f0000000380)=@mgmt_frame=@auth={{{0x0, 0x0, 0xb, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, {0x8}, @device_a, @broadcast, @random="239e2ce8e00a", {0x9, 0x8}, @value=@ver_80211n={0x0, 0x3, 0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x0, 0xfffd, 0x4e, @val={0x10, 0x1, 0x8d}, [{0xdd, 0xb, "b782758ad4d59746457e0f"}]}, 0x32) 203.706474ms ago: executing program 3 (id=580): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29e}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x884}, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000440)=@xdp={0x2c, 0x8, r6, 0x5}, 0x80, &(0x7f0000000b00)=[{&(0x7f0000000180)="a9", 0x1}, {&(0x7f0000000300)="d9e1d68ce5eb8efe0cb15499bae554b55a", 0x11}, {&(0x7f0000000c00)="0d4284685aac01bdeaf19afc0483edb4", 0x10}], 0x3}, 0x20008110) 0s ago: executing program 3 (id=581): socket$alg(0x26, 0x5, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x40040}], 0x1, 0x8040) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x23, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000c80)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000340)='\x00', 0x1, 0x4c001, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x8012, 0x0, 0xfffffffffffffe2d) recvfrom$inet(r0, &(0x7f0000000040), 0xffffffffffffffbc, 0xc9100120, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.112' (ED25519) to the list of known hosts. [ 57.833399][ T4176] cgroup: Unknown subsys name 'net' [ 57.959924][ T4176] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 59.163666][ T4176] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 60.567019][ T4199] chnl_net:caif_netlink_parms(): no params data found [ 60.599188][ T4190] chnl_net:caif_netlink_parms(): no params data found [ 60.669292][ T4189] chnl_net:caif_netlink_parms(): no params data found [ 60.735310][ T4188] chnl_net:caif_netlink_parms(): no params data found [ 60.745480][ T4199] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.752555][ T4199] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.761094][ T4199] device bridge_slave_0 entered promiscuous mode [ 60.773462][ T4199] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.780676][ T4199] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.788466][ T4199] device bridge_slave_1 entered promiscuous mode [ 60.819792][ T4198] chnl_net:caif_netlink_parms(): no params data found [ 60.835436][ T4190] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.842514][ T4190] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.850659][ T4190] device bridge_slave_0 entered promiscuous mode [ 60.877167][ T4199] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.886465][ T4190] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.893526][ T4190] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.901446][ T4190] device bridge_slave_1 entered promiscuous mode [ 60.921395][ T4199] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.970181][ T4190] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.999851][ T4190] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.013955][ T4189] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.021833][ T4189] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.029591][ T4189] device bridge_slave_0 entered promiscuous mode [ 61.040782][ T4199] team0: Port device team_slave_0 added [ 61.057105][ T4188] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.064181][ T4188] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.072416][ T4188] device bridge_slave_0 entered promiscuous mode [ 61.080333][ T4189] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.087627][ T4189] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.096454][ T4189] device bridge_slave_1 entered promiscuous mode [ 61.104438][ T4199] team0: Port device team_slave_1 added [ 61.129318][ T4188] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.136423][ T4188] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.144026][ T4188] device bridge_slave_1 entered promiscuous mode [ 61.166853][ T4198] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.173999][ T4198] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.181810][ T4198] device bridge_slave_0 entered promiscuous mode [ 61.191749][ T4190] team0: Port device team_slave_0 added [ 61.217881][ T4199] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 61.224939][ T4199] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 61.250915][ T4199] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 61.262657][ T4198] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.270090][ T4198] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.277859][ T4198] device bridge_slave_1 entered promiscuous mode [ 61.285958][ T4190] team0: Port device team_slave_1 added [ 61.299215][ T4188] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.310123][ T4189] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.319877][ T4199] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 61.326936][ T4199] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 61.353415][ T4199] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 61.382932][ T4188] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.393797][ T4189] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.418432][ T4198] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.445642][ T4190] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 61.452615][ T4190] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 61.478631][ T4190] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 61.491045][ T4198] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.516979][ T4199] device hsr_slave_0 entered promiscuous mode [ 61.523700][ T4199] device hsr_slave_1 entered promiscuous mode [ 61.531843][ T4190] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 61.538970][ T4190] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 61.564949][ T4190] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 61.586742][ T4188] team0: Port device team_slave_0 added [ 61.594831][ T4189] team0: Port device team_slave_0 added [ 61.618798][ T4188] team0: Port device team_slave_1 added [ 61.625882][ T4189] team0: Port device team_slave_1 added [ 61.650702][ T4198] team0: Port device team_slave_0 added [ 61.677437][ T4190] device hsr_slave_0 entered promiscuous mode [ 61.687567][ T4190] device hsr_slave_1 entered promiscuous mode [ 61.694320][ T4190] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 61.702206][ T4190] Cannot create hsr debugfs directory [ 61.724198][ T4198] team0: Port device team_slave_1 added [ 61.742716][ T4188] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 61.749882][ T4188] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 61.775900][ T4188] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 61.793592][ T4188] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 61.800906][ T4188] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 61.827451][ T4188] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 61.848361][ T4189] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 61.855428][ T4189] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 61.881461][ T4189] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 61.904383][ T4198] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 61.911491][ T4198] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 61.937808][ T4198] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 61.949347][ T4189] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 61.956557][ T4189] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 61.982833][ T4189] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 62.006299][ T4198] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 62.013267][ T4198] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 62.039493][ T4198] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 62.096526][ T4189] device hsr_slave_0 entered promiscuous mode [ 62.103294][ T4189] device hsr_slave_1 entered promiscuous mode [ 62.110302][ T4189] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 62.117912][ T4189] Cannot create hsr debugfs directory [ 62.164953][ T4188] device hsr_slave_0 entered promiscuous mode [ 62.171826][ T4188] device hsr_slave_1 entered promiscuous mode [ 62.179023][ T4188] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 62.186785][ T4188] Cannot create hsr debugfs directory [ 62.219852][ T4198] device hsr_slave_0 entered promiscuous mode [ 62.226554][ T4198] device hsr_slave_1 entered promiscuous mode [ 62.232969][ T4198] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 62.240757][ T4198] Cannot create hsr debugfs directory [ 62.301822][ T21] Bluetooth: hci3: command 0x0409 tx timeout [ 62.304710][ T4200] Bluetooth: hci4: command 0x0409 tx timeout [ 62.309681][ T21] Bluetooth: hci2: command 0x0409 tx timeout [ 62.324779][ T4200] Bluetooth: hci1: command 0x0409 tx timeout [ 62.333296][ T21] Bluetooth: hci0: command 0x0409 tx timeout [ 62.482998][ T4199] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 62.495166][ T4199] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 62.504428][ T4199] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 62.518139][ T4199] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 62.559568][ T4190] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 62.576182][ T4190] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 62.594899][ T4190] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 62.606753][ T4190] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 62.618375][ T4189] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 62.646801][ T4189] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 62.657124][ T4189] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 62.674976][ T4189] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 62.748568][ T4188] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 62.764483][ T4190] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.787019][ T4199] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.793827][ T4188] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 62.805245][ T4188] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 62.814179][ T4188] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 62.851169][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 62.861354][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 62.889911][ T4199] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.899682][ T4198] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 62.909104][ T4198] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 62.919024][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 62.927600][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 62.948253][ T4190] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.955670][ T4198] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 62.967122][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 62.976780][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 62.986194][ T397] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.993351][ T397] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.002499][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 63.012801][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 63.022066][ T397] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.029170][ T397] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.040837][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 63.050696][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 63.066970][ T4198] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 63.094765][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 63.103412][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 63.112280][ T397] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.119389][ T397] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.130096][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 63.139258][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 63.148399][ T397] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.155495][ T397] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.164106][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 63.189249][ T4189] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.200012][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 63.208383][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 63.217700][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 63.227449][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 63.237058][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 63.245842][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 63.254345][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 63.263441][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 63.280844][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 63.289438][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 63.299530][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 63.310794][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 63.326681][ T4189] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.339090][ T4190] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 63.351312][ T4190] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 63.359616][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 63.367767][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 63.376862][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 63.384495][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 63.394013][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 63.412682][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 63.422592][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 63.431668][ T397] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.438758][ T397] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.448110][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 63.457255][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 63.470308][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 63.479116][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 63.488236][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 63.498424][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 63.507978][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 63.522240][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 63.531127][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 63.539625][ T397] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.546702][ T397] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.554476][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 63.575338][ T4199] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 63.596869][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 63.616663][ T4188] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.635410][ T4188] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.650253][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 63.678395][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 63.691360][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 63.712453][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 63.722147][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 63.731246][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 63.740125][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 63.749060][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 63.757854][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.764964][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.773006][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 63.781273][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 63.792508][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 63.803354][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 63.823033][ T4189] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 63.845963][ T4189] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 63.878599][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 63.888087][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 63.904078][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.911223][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.922350][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 63.932245][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 63.940977][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 63.959465][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 63.969607][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 63.987141][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 64.005642][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 64.024274][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 64.032937][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 64.040859][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 64.050639][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 64.064426][ T4198] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.075136][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 64.083680][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 64.100440][ T4190] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.118673][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 64.130837][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 64.144445][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 64.152920][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 64.171012][ T4199] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.186654][ T4188] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 64.197752][ T4198] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.208948][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 64.217347][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 64.256073][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 64.270626][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 64.279960][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.287106][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.301802][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 64.309588][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 64.317242][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 64.326081][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 64.334688][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 64.343214][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 64.351927][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.359052][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.367601][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 64.385140][ T4231] Bluetooth: hci0: command 0x041b tx timeout [ 64.394937][ T4231] Bluetooth: hci2: command 0x041b tx timeout [ 64.411325][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 64.414927][ T4231] Bluetooth: hci1: command 0x041b tx timeout [ 64.421072][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 64.434803][ T4231] Bluetooth: hci4: command 0x041b tx timeout [ 64.438689][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 64.440934][ T4231] Bluetooth: hci3: command 0x041b tx timeout [ 64.455798][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 64.470734][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 64.481184][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 64.512168][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 64.520447][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 64.529102][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 64.537983][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 64.547395][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 64.555124][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.562911][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 64.575554][ T4190] device veth0_vlan entered promiscuous mode [ 64.588327][ T4189] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.597218][ T4199] device veth0_vlan entered promiscuous mode [ 64.609761][ T4188] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.621367][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 64.631648][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 64.647808][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 64.662945][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 64.672416][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.680561][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 64.693289][ T4190] device veth1_vlan entered promiscuous mode [ 64.720698][ T4198] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 64.731913][ T4198] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 64.749876][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 64.759575][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 64.769131][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 64.778894][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 64.789680][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 64.802203][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 64.811187][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 64.828692][ T4199] device veth1_vlan entered promiscuous mode [ 64.885353][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 64.894159][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 64.909879][ T4190] device veth0_macvtap entered promiscuous mode [ 64.931280][ T4189] device veth0_vlan entered promiscuous mode [ 64.943257][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.951722][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 64.961168][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 64.970404][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 64.980009][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 64.991639][ T4190] device veth1_macvtap entered promiscuous mode [ 65.004489][ T4189] device veth1_vlan entered promiscuous mode [ 65.017923][ T4199] device veth0_macvtap entered promiscuous mode [ 65.033406][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 65.044546][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 65.053185][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 65.062529][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 65.093453][ T4190] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.104341][ T4190] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.120077][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 65.128533][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 65.139680][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 65.148631][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 65.156781][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 65.164189][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 65.173346][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 65.182991][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 65.192855][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 65.203447][ T4199] device veth1_macvtap entered promiscuous mode [ 65.217893][ T4198] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.241352][ T4190] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.252010][ T4190] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.261254][ T4190] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.270225][ T4190] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.291368][ T4199] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.303179][ T4199] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.314461][ T4199] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.329372][ T4188] device veth0_vlan entered promiscuous mode [ 65.348845][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 65.358403][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 65.368755][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 65.378155][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 65.387319][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 65.396736][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 65.405086][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 65.413642][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 65.424838][ T4199] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 65.435941][ T4199] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.447324][ T4199] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.464301][ T4188] device veth1_vlan entered promiscuous mode [ 65.482575][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 65.490657][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 65.499747][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 65.508117][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 65.517034][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 65.525824][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 65.534165][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 65.551612][ T4198] device veth0_vlan entered promiscuous mode [ 65.559854][ T4199] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.569214][ T4199] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.579187][ T4199] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.588792][ T4199] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.601769][ T4189] device veth0_macvtap entered promiscuous mode [ 65.613769][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 65.622762][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 65.633328][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 65.642527][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 65.650546][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 65.678290][ T4189] device veth1_macvtap entered promiscuous mode [ 65.696792][ T4188] device veth0_macvtap entered promiscuous mode [ 65.704124][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 65.713497][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 65.721542][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 65.730946][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 65.740417][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 65.763092][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.779023][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.789132][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.799839][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.810845][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.840991][ T4198] device veth1_vlan entered promiscuous mode [ 65.849918][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 65.859178][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 65.868749][ T4188] device veth1_macvtap entered promiscuous mode [ 65.878187][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 65.889308][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.900257][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 65.910948][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.923291][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.946289][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.955897][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.962213][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 65.972437][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 65.982062][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.000193][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.011529][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.022535][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.035832][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.045759][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.057793][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.069565][ T4188] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.097264][ T4189] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.106826][ T4189] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.117000][ T4189] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.126378][ T4189] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.137376][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 66.146487][ T397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 66.161566][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.173149][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.185521][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.196231][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.206330][ T4188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.217440][ T4188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.229509][ T4188] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.264962][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 66.273716][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 66.283841][ T4236] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.283958][ T4188] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.300998][ T4236] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.306875][ T4188] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.318035][ T4188] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.327167][ T4188] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.347655][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.361613][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 66.364988][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.404048][ T4198] device veth0_macvtap entered promiscuous mode [ 66.419589][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.432179][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 66.443652][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 66.455091][ T7] Bluetooth: hci4: command 0x040f tx timeout [ 66.461181][ T7] Bluetooth: hci1: command 0x040f tx timeout [ 66.461421][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 66.488498][ T7] Bluetooth: hci2: command 0x040f tx timeout [ 66.494655][ T7] Bluetooth: hci0: command 0x040f tx timeout [ 66.505660][ T4198] device veth1_macvtap entered promiscuous mode [ 66.528087][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.546428][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.547689][ T4231] Bluetooth: hci3: command 0x040f tx timeout [ 66.554176][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 66.569398][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 66.793453][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.805644][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.822197][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.001565][ T9] Bluetooth: hci5: Frame reassembly failed (-84) [ 67.155996][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.401726][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.420782][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.433054][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.446307][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.488531][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.509450][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.528221][ T4198] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.560114][ T4273] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 67.648629][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 67.713206][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 67.721950][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 67.736006][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 67.751441][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.762077][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 67.772798][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.782642][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 67.793105][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.803235][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 67.814023][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.825525][ T4198] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.860604][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 67.870433][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 67.883925][ T4198] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.893178][ T4198] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.902636][ T4198] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.911637][ T4198] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.930095][ T4236] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.948706][ T4236] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.980130][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 68.015643][ T4236] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.024213][ T4236] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.044516][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 68.063019][ T1312] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.073898][ T1312] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.119548][ T1312] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 68.148292][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.168736][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.193342][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 68.220632][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.239117][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.265894][ T4284] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 68.402734][ T4271] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 69.016765][ T26] Bluetooth: hci5: command 0x1003 tx timeout [ 69.133355][ T146] Bluetooth: hci5: sending frame failed (-49) [ 69.180000][ T4231] Bluetooth: hci0: command 0x0419 tx timeout [ 69.186124][ T4231] Bluetooth: hci2: command 0x0419 tx timeout [ 69.192153][ T4231] Bluetooth: hci1: command 0x0419 tx timeout [ 69.198535][ T4231] Bluetooth: hci4: command 0x0419 tx timeout [ 69.206500][ T4262] Bluetooth: hci3: command 0x0419 tx timeout [ 69.544454][ T4302] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8'. [ 70.210531][ T4304] ======================================================= [ 70.210531][ T4304] WARNING: The mand mount option has been deprecated and [ 70.210531][ T4304] and is ignored by this kernel. Remove the mand [ 70.210531][ T4304] option from the mount to silence this warning. [ 70.210531][ T4304] ======================================================= [ 70.275941][ T4305] overlayfs: overlapping lowerdir path [ 70.428275][ T4298] loop2: detected capacity change from 0 to 32768 [ 70.524096][ T4298] JBD2: Ignoring recovery information on journal [ 70.553756][ T4301] loop3: detected capacity change from 0 to 32768 [ 70.678438][ T4301] (syz.3.4,4301,1):ocfs2_parse_options:1459 ERROR: Invalid heartbeat mount options [ 70.679323][ T4298] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 70.711823][ T4301] (syz.3.4,4301,1):ocfs2_fill_super:1177 ERROR: status = -22 [ 70.942340][ T4189] ocfs2: Unmounting device (7,2) on (node local) [ 71.174971][ T4233] Bluetooth: hci5: command 0x1001 tx timeout [ 71.189404][ T146] Bluetooth: hci5: sending frame failed (-49) [ 71.258183][ T1432] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.265766][ T1432] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.403263][ T4323] loop3: detected capacity change from 0 to 64 [ 71.556298][ T4327] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 71.732596][ T4323] attempt to access beyond end of device [ 71.732596][ T4323] loop3: rw=0, want=1026, limit=64 [ 71.914415][ T4323] Buffer I/O error on dev loop3, logical block 512, async page read [ 72.020688][ T4323] attempt to access beyond end of device [ 72.020688][ T4323] loop3: rw=0, want=113154, limit=64 [ 72.156701][ T4323] Buffer I/O error on dev loop3, logical block 56576, async page read [ 72.366116][ T4329] syz.4.16 uses obsolete (PF_INET,SOCK_PACKET) [ 72.774706][ T4232] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 72.937979][ T4341] loop1: detected capacity change from 0 to 512 [ 72.988867][ T4341] EXT4-fs (loop1): mounted filesystem without journal. Opts: resgid=0x0000000000000000,noload,noblock_validity,,errors=continue. Quota mode: none. [ 73.022236][ T4341] EXT4-fs warning (device loop1): dx_probe:869: inode #2: comm syz.1.20: Unimplemented hash flags: 0x0001 [ 73.061517][ T4341] EXT4-fs warning (device loop1): dx_probe:966: inode #2: comm syz.1.20: Corrupt directory, running e2fsck is recommended [ 73.081792][ T4341] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 3: comm syz.1.20: path /3/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=4294967295, rec_len=7, size=1024 fake=0 [ 73.259741][ T4229] Bluetooth: hci5: command 0x1009 tx timeout [ 73.434742][ T4232] usb 3-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 73.444103][ T4232] usb 3-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 73.498815][ T4232] usb 3-1: Product: syz [ 73.498856][ T4232] usb 3-1: Manufacturer: syz [ 73.498871][ T4232] usb 3-1: SerialNumber: syz [ 73.580169][ T4232] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 73.721974][ T4348] loop3: detected capacity change from 0 to 512 [ 73.895903][ T4348] EXT4-fs (loop3): Test dummy encryption mode enabled [ 73.918783][ T4348] EXT4-fs error (device loop3): ext4_orphan_get:1406: inode #15: comm syz.3.23: inode has both inline data and extents flags [ 73.951558][ T4348] EXT4-fs error (device loop3): ext4_orphan_get:1411: comm syz.3.23: couldn't read orphan inode 15 (err -117) [ 73.973266][ T4348] EXT4-fs (loop3): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: writeback. [ 74.024795][ T4232] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 74.037306][ T4232] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 74.302446][ T4348] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 74.339624][ T4232] usb 3-1: USB disconnect, device number 2 [ 75.353508][ T4370] loop3: detected capacity change from 0 to 512 [ 75.424777][ T4231] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 75.750659][ T4231] usb 3-1: Using ep0 maxpacket: 8 [ 75.875299][ T4231] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 75.927123][ T4231] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 76.030225][ T4231] usb 3-1: config 1 has no interface number 0 [ 76.219913][ T4375] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 76.294863][ T4231] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 76.303944][ T4231] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.534182][ T4231] usb 3-1: Product: syz [ 77.538649][ T4231] usb 3-1: Manufacturer: syz [ 77.543289][ T4231] usb 3-1: SerialNumber: syz [ 77.930479][ T4231] snd-usb-audio: probe of 3-1:1.1 failed with error -22 [ 77.953193][ T4231] usb 3-1: USB disconnect, device number 3 [ 78.002670][ T4180] udevd[4180]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 78.084720][ T4229] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 78.296553][ T4393] netlink: 12 bytes leftover after parsing attributes in process `syz.4.32'. [ 78.344798][ T4229] usb 2-1: Using ep0 maxpacket: 16 [ 78.465373][ T4229] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 78.483765][ T4229] usb 2-1: config 1 has no interface number 0 [ 78.519906][ T4229] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 78.534896][ T4229] usb 2-1: config 1 interface 19 has no altsetting 0 [ 78.695382][ T4229] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 78.710385][ T4229] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.724825][ T4229] usb 2-1: Product: syz [ 78.730796][ T4229] usb 2-1: Manufacturer: syz [ 78.735885][ T4229] usb 2-1: SerialNumber: syz [ 78.924861][ T4399] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 78.970047][ T4406] netlink: 16211 bytes leftover after parsing attributes in process `syz.3.34'. [ 78.980877][ T4229] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 79.004794][ T144] usb 2-1: Failed to submit usb control message: -71 [ 79.044632][ T144] usb 2-1: unable to send the bmi data to the device: -71 [ 79.051787][ T144] usb 2-1: unable to get target info from device [ 79.077039][ T4229] usb 2-1: USB disconnect, device number 2 [ 79.109592][ T4408] TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 79.123702][ T144] usb 2-1: could not get target info (-71) [ 79.182361][ T144] usb 2-1: could not probe fw (-71) [ 79.239222][ T4410] loop3: detected capacity change from 0 to 2048 [ 79.313763][ T4412] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 79.326817][ T4410] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 79.336579][ T4410] UDF-fs: Scanning with blocksize 512 failed [ 79.357126][ T4410] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 79.626880][ T4418] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 79.639800][ T4418] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 80.433631][ T4425] loop1: detected capacity change from 0 to 64 [ 80.501184][ T4425] hfs: get root inode failed [ 81.634568][ C1] sched: RT throttling activated [ 82.309710][ T4449] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 82.621222][ T4454] netlink: 12 bytes leftover after parsing attributes in process `syz.2.48'. [ 82.742734][ T4459] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 83.036872][ T4468] netlink: 12 bytes leftover after parsing attributes in process `syz.2.55'. [ 83.139924][ T4232] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 83.243931][ T4472] Zero length message leads to an empty skb [ 83.410274][ T4232] usb 2-1: Using ep0 maxpacket: 16 [ 83.554855][ T4232] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 83.573482][ T4232] usb 2-1: config 1 has no interface number 0 [ 83.583412][ T4232] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 83.683589][ T4232] usb 2-1: config 1 interface 19 has no altsetting 0 [ 84.035738][ T4232] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 84.118625][ T4232] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.253623][ T4232] usb 2-1: Product: syz [ 84.264604][ T4232] usb 2-1: Manufacturer: syz [ 84.269233][ T4232] usb 2-1: SerialNumber: syz [ 84.431779][ T4232] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 84.590400][ T4232] usb 2-1: USB disconnect, device number 3 [ 84.617982][ T1312] usb 2-1: Failed to submit usb control message: -71 [ 84.626266][ T1312] usb 2-1: unable to send the bmi data to the device: -71 [ 84.633480][ T1312] usb 2-1: unable to get target info from device [ 84.640354][ T1312] usb 2-1: could not get target info (-71) [ 84.647172][ T1312] usb 2-1: could not probe fw (-71) [ 84.679154][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805f3c3c00: rx timeout, send abort [ 85.173951][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805f3c2800: rx timeout, send abort [ 85.188373][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805f3c3c00: abort rx timeout. Force session deactivation [ 85.405674][ T4505] tipc: Started in network mode [ 85.410858][ T4505] tipc: Node identity 1622ab8df49e, cluster identity 4711 [ 85.459548][ T4505] tipc: Enabled bearer , priority 0 [ 85.533623][ T4512] device syzkaller0 entered promiscuous mode [ 85.544961][ T4511] device syzkaller1 entered promiscuous mode [ 85.567860][ T4515] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 85.633422][ T4504] tipc: Resetting bearer [ 85.664792][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807d387400: rx timeout, send abort [ 85.673441][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88807d387400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 85.688713][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805f3c2800: abort rx timeout. Force session deactivation [ 85.721897][ T4504] tipc: Disabling bearer [ 85.820683][ T4519] device syzkaller1 entered promiscuous mode [ 85.847719][ T4519] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 85.865908][ C0] vkms_vblank_simulate: vblank timer overrun [ 85.935406][ T4523] device syzkaller0 entered promiscuous mode [ 86.895887][ T1108] cfg80211: failed to load regulatory.db [ 88.087871][ T4550] netlink: 104 bytes leftover after parsing attributes in process `syz.3.84'. [ 88.541913][ T4559] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 89.606896][ T4567] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=none:owns=io+mem [ 90.091558][ T4581] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 90.101739][ T4581] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 90.124225][ T4581] netlink: 67 bytes leftover after parsing attributes in process `syz.4.96'. [ 90.138322][ T4581] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 90.156025][ T4581] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 90.642850][ T4595] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 92.262401][ C1] vxcan1: j1939_tp_rxtimer: 0xffff8880615b7000: rx timeout, send abort [ 93.702891][ T4620] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.711998][ T4620] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.720855][ T4620] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.729646][ T4620] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.806267][ T4620] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 93.815487][ T4620] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 93.824362][ T4620] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 93.833299][ T4620] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 93.947315][ T4630] netlink: 20 bytes leftover after parsing attributes in process `syz.3.115'. [ 94.001018][ T4623] netlink: 9 bytes leftover after parsing attributes in process `syz.1.112'. [ 95.094598][ T4648] device syzkaller0 entered promiscuous mode [ 95.579311][ T4643] crypto_alloc_aead failed rc=-2 [ 95.793593][ T4678] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 96.125147][ T4669] netlink: 4 bytes leftover after parsing attributes in process `syz.4.122'. [ 96.461537][ T4669] device veth1_to_team entered promiscuous mode [ 96.546876][ T4669] device gretap0 entered promiscuous mode [ 96.558668][ T4669] device hsr1 entered promiscuous mode [ 96.779082][ T4669] syz.4.122 (4669) used greatest stack depth: 20816 bytes left [ 96.818493][ T4691] netlink: 164 bytes leftover after parsing attributes in process `syz.2.127'. [ 97.994598][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 98.014585][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 98.024580][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 98.034581][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 98.044584][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 98.054583][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 98.064583][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 98.074584][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 98.084581][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 98.094581][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 99.615097][ T1332] hid-generic 0005:0007:0007.0001: hidraw0: BLUETOOTH HID v0.03 Device [syz0] on aa:aa:aa:aa:aa:aa [ 100.876845][ T4727] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 101.092373][ T4719] fido_id[4719]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci4/hci4:200/report_descriptor': No such file or directory [ 102.088908][ T4762] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 102.404970][ T4233] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 104.344679][ T4233] usb 2-1: Using ep0 maxpacket: 16 [ 105.217927][ T4233] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 105.227475][ T4233] usb 2-1: config 1 has no interface number 0 [ 105.237769][ T4233] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.248986][ T4233] usb 2-1: config 1 interface 19 has no altsetting 0 [ 105.283209][ T4799] netlink: 8 bytes leftover after parsing attributes in process `syz.1.148'. [ 105.294831][ T4233] usb 2-1: string descriptor 0 read error: -71 [ 105.301168][ T4233] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 105.351744][ T4803] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 106.124072][ T4233] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.151293][ T4808] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 106.161269][ T4233] usb 2-1: can't set config #1, error -71 [ 106.180166][ T4233] usb 2-1: USB disconnect, device number 4 [ 106.383846][ T4817] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 106.747222][ T4826] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 107.882786][ T4816] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 108.064087][ T4843] netlink: 1192 bytes leftover after parsing attributes in process `syz.2.158'. [ 109.880603][ T4872] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=none,decodes=none:owns=io+mem [ 110.003578][ T4877] overlayfs: missing 'workdir' [ 110.039071][ T4878] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 111.480250][ T4397] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 111.534857][ T4887] sctp: failed to load transform for md5: -4 [ 111.554088][ T4906] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 112.465120][ T4200] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 112.594619][ T4397] usb 5-1: Using ep0 maxpacket: 16 [ 112.774949][ T4397] usb 5-1: config 1 has an invalid interface number: 19 but max is 0 [ 112.801078][ T4397] usb 5-1: config 1 has no interface number 0 [ 112.824706][ T4397] usb 5-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 112.834725][ T4200] usb 1-1: Using ep0 maxpacket: 16 [ 112.856423][ T4397] usb 5-1: config 1 interface 19 has no altsetting 0 [ 113.054856][ T4397] usb 5-1: string descriptor 0 read error: -71 [ 113.069875][ T4397] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 113.236407][ T4397] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.590838][ T4929] netlink: 1192 bytes leftover after parsing attributes in process `syz.1.173'. [ 113.600269][ T4397] usb 5-1: can't set config #1, error -71 [ 113.614943][ T4200] usb 1-1: config 1 has an invalid interface number: 19 but max is 0 [ 113.620427][ T4397] usb 5-1: USB disconnect, device number 2 [ 113.629449][ T4200] usb 1-1: config 1 has no interface number 0 [ 113.657469][ T4933] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=none,decodes=none:owns=io+mem [ 113.674636][ T4200] usb 1-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 113.793610][ T4200] usb 1-1: config 1 interface 19 has no altsetting 0 [ 113.841449][ T4941] overlayfs: missing 'workdir' [ 114.673548][ T4200] usb 1-1: string descriptor 0 read error: -71 [ 114.960531][ T4200] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 115.004817][ T4200] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.154742][ T4200] usb 1-1: can't set config #1, error -71 [ 115.253487][ T4200] usb 1-1: USB disconnect, device number 2 [ 116.134385][ T4968] loop3: detected capacity change from 0 to 512 [ 116.143286][ T4964] netlink: 'syz.1.183': attribute type 1 has an invalid length. [ 116.179793][ T4971] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 116.889702][ T4964] 8021q: adding VLAN 0 to HW filter on device bond1 [ 117.084668][ T4397] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 117.224308][ T4978] bond1: (slave geneve2): making interface the new active one [ 117.250352][ T4978] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 117.275520][ T4271] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 117.319919][ T4978] syz.1.183 (4978) used greatest stack depth: 19416 bytes left [ 117.344811][ T4397] usb 3-1: Using ep0 maxpacket: 16 [ 117.635601][ T5003] overlayfs: missing 'workdir' [ 117.661788][ T4397] usb 3-1: config 1 has an invalid interface number: 19 but max is 0 [ 117.683857][ T4397] usb 3-1: config 1 has no interface number 0 [ 118.345070][ T5007] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 118.357762][ T4397] usb 3-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 118.526491][ T4397] usb 3-1: config 1 interface 19 has no altsetting 0 [ 118.640632][ T5018] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 118.705372][ T4397] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 118.748022][ T4397] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.824798][ T4233] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 118.848965][ T4397] usb 3-1: Product: syz [ 118.895333][ T4397] usb 3-1: Manufacturer: syz [ 118.901071][ T5021] netlink: 1192 bytes leftover after parsing attributes in process `syz.3.193'. [ 118.943631][ T4397] usb 3-1: SerialNumber: syz [ 119.084847][ T4233] usb 2-1: Using ep0 maxpacket: 16 [ 119.198541][ T4397] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 119.208518][ T4233] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 119.242799][ T4233] usb 2-1: config 1 has no interface number 0 [ 119.338973][ T4233] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 119.414859][ T4684] usb 3-1: Failed to submit usb control message: -71 [ 119.422025][ T4684] usb 3-1: unable to send the bmi data to the device: -71 [ 119.486101][ T4233] usb 2-1: config 1 interface 19 has no altsetting 0 [ 119.495491][ T4684] usb 3-1: unable to get target info from device [ 119.599007][ T4684] usb 3-1: could not get target info (-71) [ 119.617929][ T4684] usb 3-1: could not probe fw (-71) [ 119.662799][ T4397] usb 3-1: USB disconnect, device number 4 [ 120.649458][ T5039] loop4: detected capacity change from 0 to 512 [ 121.184872][ T4233] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 121.202342][ T4233] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.221662][ T4233] usb 2-1: Product: syz [ 121.355059][ T4233] usb 2-1: can't set config #1, error -71 [ 121.468586][ T4233] usb 2-1: USB disconnect, device number 5 [ 121.524318][ T5049] loop3: detected capacity change from 0 to 512 [ 123.330126][ T5049] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 123.361274][ T5049] ext4 filesystem being mounted at /47/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 123.630682][ T5069] overlayfs: missing 'workdir' [ 124.256015][ T5072] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 124.564315][ T5079] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 125.961702][ T5090] loop3: detected capacity change from 0 to 512 [ 126.014970][ T26] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 126.254830][ T26] usb 2-1: Using ep0 maxpacket: 16 [ 126.374815][ T26] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 126.382937][ T26] usb 2-1: config 1 has no interface number 0 [ 126.451057][ T26] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 126.545209][ T26] usb 2-1: config 1 interface 19 has no altsetting 0 [ 126.734764][ T26] usb 2-1: string descriptor 0 read error: -71 [ 126.741075][ T26] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 126.888040][ T26] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.204724][ T26] usb 2-1: can't set config #1, error -71 [ 128.224748][ T26] usb 2-1: USB disconnect, device number 6 [ 128.362393][ T5118] overlayfs: missing 'workdir' [ 129.023032][ T5128] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=none,decodes=none:owns=io+mem [ 129.966683][ T5135] loop0: detected capacity change from 0 to 512 [ 130.838460][ T5145] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 133.526182][ T5165] overlayfs: missing 'workdir' [ 133.532562][ T1432] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.558622][ T1432] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.118417][ T5181] netlink: 'syz.2.233': attribute type 1 has an invalid length. [ 134.126199][ T5181] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 134.133734][ T5181] IPv6: NLM_F_CREATE should be set when creating new route [ 134.141017][ T5181] IPv6: NLM_F_CREATE should be set when creating new route [ 134.351029][ T5178] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=none,decodes=none:owns=io+mem [ 134.935117][ T5186] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 135.014700][ T5190] loop2: detected capacity change from 0 to 512 [ 135.138178][ T5195] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 135.945022][ T5197] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 136.617035][ T5207] overlayfs: missing 'workdir' [ 138.599823][ T5231] netlink: 'syz.3.249': attribute type 1 has an invalid length. [ 138.607585][ T5231] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 138.614844][ T5231] IPv6: NLM_F_CREATE should be set when creating new route [ 138.622045][ T5231] IPv6: NLM_F_CREATE should be set when creating new route [ 138.877714][ T5233] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=none,decodes=none:owns=io+mem [ 139.067187][ T5239] loop4: detected capacity change from 0 to 512 [ 139.094039][ T5241] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 140.056566][ T5242] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 143.863688][ T5286] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 145.219311][ T5288] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=none,decodes=none:owns=io+mem [ 145.594849][ T5294] loop1: detected capacity change from 0 to 512 [ 147.792528][ T5318] loop0: detected capacity change from 0 to 512 [ 147.958962][ T5318] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 147.998036][ T5318] ext4 filesystem being mounted at /32/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 149.010595][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88802378d800: rx timeout, send abort [ 149.440388][ T5332] pci 0000:00:05.0: vgaarb: changed VGA decodes: olddecodes=none,decodes=none:owns=io+mem [ 149.454004][ T5334] loop4: detected capacity change from 0 to 512 [ 149.520722][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88802378d800: abort rx timeout. Force session deactivation [ 149.675280][ T5344] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 150.784772][ T4231] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 151.064959][ T4231] usb 5-1: Using ep0 maxpacket: 16 [ 151.195158][ T4231] usb 5-1: config 1 has an invalid interface number: 19 but max is 0 [ 151.244336][ T4231] usb 5-1: config 1 has no interface number 0 [ 151.431880][ T4231] usb 5-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 151.574459][ T4231] usb 5-1: config 1 interface 19 has no altsetting 0 [ 151.586612][ T5359] loop2: detected capacity change from 0 to 512 [ 152.305071][ T4231] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 152.473193][ T5359] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 152.628918][ T5359] ext4 filesystem being mounted at /64/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 152.802926][ T5379] loop0: detected capacity change from 0 to 512 [ 153.596218][ T4231] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.604258][ T4231] usb 5-1: Product: syz [ 153.608483][ T4231] usb 5-1: Manufacturer: syz [ 153.613094][ T4231] usb 5-1: SerialNumber: syz [ 153.654765][ T4231] usb 5-1: can't set config #1, error -71 [ 153.664300][ T4231] usb 5-1: USB disconnect, device number 3 [ 154.258489][ C1] vcan0: j1939_tp_rxtimer: 0xffff888060304000: rx timeout, send abort [ 154.279535][ T5385] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 154.766797][ C1] vcan0: j1939_tp_rxtimer: 0xffff888060304000: abort rx timeout. Force session deactivation [ 156.118723][ T5411] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 156.252285][ T5423] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 157.037359][ T5425] loop4: detected capacity change from 0 to 512 [ 157.278588][ T1108] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 157.292274][ T5430] loop1: detected capacity change from 0 to 512 [ 157.996787][ T5425] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 158.027983][ T5425] ext4 filesystem being mounted at /69/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 158.115592][ T1108] usb 1-1: Using ep0 maxpacket: 16 [ 159.255255][ T1108] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 159.291882][ T1108] usb 1-1: can't read configurations, error -71 [ 159.692432][ T4396] nci: nci_rsp_packet: unsupported rsp opcode 0xf00 [ 161.653674][ T5484] loop0: detected capacity change from 0 to 512 [ 161.812065][ T5490] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 162.094620][ T1108] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 162.344634][ T1108] usb 2-1: Using ep0 maxpacket: 16 [ 162.438532][ T5459] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 162.464709][ T1108] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 162.472862][ T1108] usb 2-1: config 1 has no interface number 0 [ 162.504899][ T1108] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 162.524758][ T1108] usb 2-1: config 1 interface 19 has no altsetting 0 [ 162.592356][ T5498] loop0: detected capacity change from 0 to 512 [ 162.700376][ T5501] netlink: 1192 bytes leftover after parsing attributes in process `syz.4.327'. [ 162.744872][ T1108] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 162.764410][ T1108] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.790304][ T1108] usb 2-1: Product: syz [ 162.812516][ T5498] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 162.825156][ T5498] ext4 filesystem being mounted at /45/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 162.825475][ T1108] usb 2-1: Manufacturer: syz [ 162.840579][ T1108] usb 2-1: SerialNumber: syz [ 163.965624][ T1108] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 163.985119][ T4684] usb 2-1: Failed to submit usb control message: -71 [ 164.000789][ T4684] usb 2-1: unable to send the bmi data to the device: -71 [ 164.142487][ T4684] usb 2-1: unable to get target info from device [ 164.155264][ T1108] usb 2-1: USB disconnect, device number 7 [ 164.172828][ T4684] usb 2-1: could not get target info (-71) [ 164.218666][ T4684] usb 2-1: could not probe fw (-71) [ 165.211043][ T5537] loop1: detected capacity change from 0 to 512 [ 165.318483][ T5539] netlink: 'syz.3.337': attribute type 1 has an invalid length. [ 165.391192][ T5539] 8021q: adding VLAN 0 to HW filter on device bond1 [ 165.477871][ T5543] bond1: (slave ip6erspan0): making interface the new active one [ 165.526589][ T5543] bond1: (slave ip6erspan0): Enslaving as an active interface with an up link [ 165.547104][ T4682] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 165.661218][ T5545] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 165.718618][ T5545] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 167.135537][ T5567] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 167.512029][ T5568] netlink: 1192 bytes leftover after parsing attributes in process `syz.2.345'. [ 169.253317][ T5583] loop0: detected capacity change from 0 to 512 [ 169.273169][ T5584] device syzkaller0 entered promiscuous mode [ 169.635484][ T5594] loop3: detected capacity change from 0 to 512 [ 169.914946][ T4271] Bluetooth: hci5: Frame reassembly failed (-84) [ 170.235818][ T5594] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 170.255212][ T5594] ext4 filesystem being mounted at /84/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 171.396822][ T5626] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 172.150473][ T21] Bluetooth: hci5: command 0x1003 tx timeout [ 172.166125][ T146] Bluetooth: hci5: sending frame failed (-49) [ 173.399668][ T5638] netlink: 1192 bytes leftover after parsing attributes in process `syz.1.362'. [ 173.508087][ T4231] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 174.184769][ T4231] usb 4-1: Using ep0 maxpacket: 16 [ 174.214890][ T4397] Bluetooth: hci5: command 0x1001 tx timeout [ 174.221005][ T146] Bluetooth: hci5: sending frame failed (-49) [ 174.233248][ T5649] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 174.358950][ T5648] xt_hashlimit: size too large, truncated to 1048576 [ 174.664845][ T4231] usb 4-1: unable to read config index 0 descriptor/all [ 174.685076][ T4231] usb 4-1: can't read configurations, error -71 [ 176.494135][ T4397] Bluetooth: hci5: command 0x1009 tx timeout [ 176.687686][ T5673] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 176.764410][ T5675] netlink: 1192 bytes leftover after parsing attributes in process `syz.0.374'. [ 176.916010][ T5682] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 177.414687][ T4397] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 177.996682][ T5695] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 178.018985][ T5694] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 178.037808][ T4397] usb 2-1: Using ep0 maxpacket: 16 [ 178.155368][ T4397] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 178.163656][ T4397] usb 2-1: config 1 has no interface number 0 [ 178.170706][ T4397] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 178.171344][ T4397] usb 2-1: config 1 interface 19 has no altsetting 0 [ 178.325210][ T4397] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 178.355305][ T4397] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.412386][ T4397] usb 2-1: Product: syz [ 178.447036][ T4397] usb 2-1: Manufacturer: syz [ 178.483793][ T4397] usb 2-1: SerialNumber: syz [ 178.751151][ T4397] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 178.864422][ T4397] usb 2-1: USB disconnect, device number 8 [ 178.874844][ T4682] usb 2-1: Failed to submit usb control message: -71 [ 178.881805][ T4682] usb 2-1: unable to send the bmi data to the device: -71 [ 178.896181][ T4682] usb 2-1: unable to get target info from device [ 178.902613][ T4682] usb 2-1: could not get target info (-71) [ 178.920492][ T4682] usb 2-1: could not probe fw (-71) [ 179.023579][ T5702] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.530909][ T5723] netlink: 1192 bytes leftover after parsing attributes in process `syz.2.388'. [ 181.182207][ T5737] loop1: detected capacity change from 0 to 512 [ 181.202257][ T5735] netlink: 8 bytes leftover after parsing attributes in process `syz.4.392'. [ 181.212011][ T5735] netlink: 12 bytes leftover after parsing attributes in process `syz.4.392'. [ 181.265432][ T5735] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 181.274235][ T5735] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 181.283212][ T5735] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 181.291973][ T5735] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 181.333832][ T5737] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 181.416065][ T5745] netlink: 'syz.3.391': attribute type 1 has an invalid length. [ 181.423852][ T5745] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 181.540855][ T5735] netlink: 8 bytes leftover after parsing attributes in process `syz.4.392'. [ 181.556145][ T5737] ext4 filesystem being mounted at /76/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 181.575409][ T5735] netlink: 12 bytes leftover after parsing attributes in process `syz.4.392'. [ 183.442694][ T9] Bluetooth: hci5: Frame reassembly failed (-84) [ 183.459318][ T9] Bluetooth: hci5: Frame reassembly failed (-84) [ 183.594920][ T5767] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 184.871652][ T5780] netlink: 1192 bytes leftover after parsing attributes in process `syz.0.406'. [ 185.646668][ T1332] Bluetooth: hci5: command 0x1003 tx timeout [ 185.652856][ T4191] Bluetooth: hci5: sending frame failed (-49) [ 185.975400][ T26] Bluetooth: hci0: command 0x0406 tx timeout [ 186.004449][ T26] Bluetooth: hci3: command 0x0406 tx timeout [ 186.094995][ T26] Bluetooth: hci2: command 0x0406 tx timeout [ 186.227988][ T4232] Bluetooth: hci1: command 0x0406 tx timeout [ 186.784172][ T5811] netlink: 'syz.4.414': attribute type 1 has an invalid length. [ 186.792103][ T5811] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 186.799385][ T5811] IPv6: NLM_F_CREATE should be set when creating new route [ 186.806632][ T5811] IPv6: NLM_F_CREATE should be set when creating new route [ 187.891266][ T1332] Bluetooth: hci5: command 0x1001 tx timeout [ 188.301577][ T4191] Bluetooth: hci5: sending frame failed (-49) [ 188.583969][ T5822] netlink: 1192 bytes leftover after parsing attributes in process `syz.3.421'. [ 189.514643][ T5834] loop0: detected capacity change from 0 to 512 [ 189.829946][ T5834] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 189.861160][ T5834] ext4 filesystem being mounted at /69/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 190.267262][ T4682] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x10 [ 190.710178][ T1332] Bluetooth: hci5: command 0x1009 tx timeout [ 191.889353][ T5864] netlink: 1192 bytes leftover after parsing attributes in process `syz.2.433'. [ 192.554843][ T5873] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1303 [ 192.738995][ T5880] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 192.765260][ T5883] netlink: 16 bytes leftover after parsing attributes in process `syz.2.439'. [ 192.819681][ T5887] loop2: detected capacity change from 0 to 512 [ 192.857190][ T5888] netlink: 'syz.4.438': attribute type 1 has an invalid length. [ 192.865130][ T5888] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 192.911421][ T5887] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 192.935104][ T5887] ext4 filesystem being mounted at /91/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 193.044608][ T4233] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 193.294590][ T4233] usb 1-1: Using ep0 maxpacket: 16 [ 193.414802][ T4233] usb 1-1: config 1 has an invalid interface number: 19 but max is 0 [ 193.433222][ T4233] usb 1-1: config 1 has no interface number 0 [ 193.439822][ T4233] usb 1-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 193.471262][ T4233] usb 1-1: config 1 interface 19 has no altsetting 0 [ 193.634908][ T4233] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 193.883154][ T4233] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.966888][ T4233] usb 1-1: Product: syz [ 193.971402][ T4233] usb 1-1: Manufacturer: syz [ 193.977266][ T4233] usb 1-1: SerialNumber: syz [ 194.034426][ T4233] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 194.144614][ T1432] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.151981][ T1432] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.255517][ T1332] usb 1-1: USB disconnect, device number 5 [ 194.301998][ T4684] usb 1-1: Failed to submit usb control message: -71 [ 194.526864][ T4684] usb 1-1: unable to send the bmi data to the device: -71 [ 194.957962][ T4684] usb 1-1: unable to get target info from device [ 194.966497][ T4684] usb 1-1: could not get target info (-71) [ 194.972532][ T4684] usb 1-1: could not probe fw (-71) [ 195.271710][ T5909] netlink: 1192 bytes leftover after parsing attributes in process `syz.3.446'. [ 195.678880][ T5914] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 195.922892][ T5923] netlink: 8 bytes leftover after parsing attributes in process `syz.1.450'. [ 196.074825][ T1332] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 196.471138][ T4396] Bluetooth: hci5: Frame reassembly failed (-84) [ 196.524804][ T4396] Bluetooth: hci5: Frame reassembly failed (-84) [ 197.044819][ T1332] usb 3-1: Using ep0 maxpacket: 16 [ 197.091630][ T5943] device syzkaller0 entered promiscuous mode [ 197.475114][ T1332] usb 3-1: config 1 has an invalid interface number: 19 but max is 0 [ 197.488795][ T5951] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 197.510505][ T1332] usb 3-1: config 1 has no interface number 0 [ 197.617296][ T1332] usb 3-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 197.755023][ T1332] usb 3-1: config 1 interface 19 has no altsetting 0 [ 197.935410][ T1332] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 197.935480][ T1332] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.935530][ T1332] usb 3-1: Product: syz [ 197.935582][ T1332] usb 3-1: Manufacturer: syz [ 197.935634][ T1332] usb 3-1: SerialNumber: syz [ 198.024786][ T4397] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 198.050327][ T1332] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 198.198680][ T1332] usb 3-1: USB disconnect, device number 5 [ 198.204943][ T4684] usb 3-1: Failed to submit usb control message: -71 [ 198.211916][ T4684] usb 3-1: unable to send the bmi data to the device: -71 [ 198.238758][ T4684] usb 3-1: unable to get target info from device [ 198.259410][ T4684] usb 3-1: could not get target info (-71) [ 198.270721][ T4684] usb 3-1: could not probe fw (-71) [ 198.276296][ T4397] usb 4-1: Using ep0 maxpacket: 16 [ 198.411737][ T4397] usb 4-1: config 1 has an invalid interface number: 19 but max is 0 [ 198.420519][ T4397] usb 4-1: config 1 has no interface number 0 [ 198.434063][ T4397] usb 4-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 198.446046][ T4397] usb 4-1: config 1 interface 19 has no altsetting 0 [ 198.534742][ T13] Bluetooth: hci5: command 0x1003 tx timeout [ 198.543136][ T4191] Bluetooth: hci5: sending frame failed (-49) [ 198.674769][ T4397] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 198.684026][ T4397] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.692065][ T4397] usb 4-1: Product: syz [ 198.696773][ T4397] usb 4-1: Manufacturer: syz [ 198.701433][ T4397] usb 4-1: SerialNumber: syz [ 198.747296][ T5971] netlink: 'syz.1.464': attribute type 1 has an invalid length. [ 198.755239][ T5971] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 198.762494][ T5971] IPv6: NLM_F_CREATE should be set when creating new route [ 198.769778][ T5971] IPv6: NLM_F_CREATE should be set when creating new route [ 198.814409][ T4397] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 198.959821][ T4232] usb 4-1: USB disconnect, device number 4 [ 198.975164][ T9] usb 4-1: Failed to submit usb control message: -71 [ 199.000822][ T9] usb 4-1: could not get target info (-71) [ 199.023507][ T9] usb 4-1: could not probe fw (-71) [ 199.250777][ T5984] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.614591][ T4232] Bluetooth: hci5: command 0x1001 tx timeout [ 200.620745][ T4191] Bluetooth: hci5: sending frame failed (-49) [ 200.923869][ T6002] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 202.482857][ T6025] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 202.779937][ T13] Bluetooth: hci5: command 0x1009 tx timeout [ 202.934914][ T13] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 203.174674][ T13] usb 2-1: Using ep0 maxpacket: 16 [ 203.295935][ T13] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 203.334898][ T13] usb 2-1: config 1 has no interface number 0 [ 203.344487][ T13] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 203.689363][ T13] usb 2-1: config 1 interface 19 has no altsetting 0 [ 203.888847][ C1] hrtimer: interrupt took 47030 ns [ 204.300374][ T13] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 204.312874][ T6058] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 204.322831][ T13] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.330901][ T13] usb 2-1: Product: syz [ 204.335758][ T13] usb 2-1: Manufacturer: syz [ 204.340360][ T13] usb 2-1: SerialNumber: syz [ 204.703043][ T13] ath10k_warn: 2 callbacks suppressed [ 204.703062][ T13] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 204.768210][ T4684] usb 2-1: Failed to submit usb control message: -71 [ 204.784053][ T4231] usb 2-1: USB disconnect, device number 9 [ 204.803975][ T4684] usb 2-1: unable to send the bmi data to the device: -71 [ 204.830264][ T4684] usb 2-1: unable to get target info from device [ 204.857245][ T4684] usb 2-1: could not get target info (-71) [ 204.863132][ T4684] usb 2-1: could not probe fw (-71) [ 204.874779][ T6080] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.622351][ T6135] loop3: detected capacity change from 0 to 512 [ 206.654932][ T4191] Bluetooth: hci4: link tx timeout [ 206.660296][ T4191] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 206.669570][ T4191] Bluetooth: hci4: link tx timeout [ 206.675522][ T4191] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 207.024947][ T4197] Bluetooth: hci4: link tx timeout [ 207.030201][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 207.056080][ T4197] Bluetooth: hci4: link tx timeout [ 207.061294][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 207.193293][ T6135] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 207.237426][ T6135] ext4 filesystem being mounted at /126/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 207.265985][ T4197] Bluetooth: hci4: link tx timeout [ 207.271193][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 207.585414][ T4228] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 207.768466][ T4197] Bluetooth: hci4: link tx timeout [ 207.773629][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 207.841691][ T6161] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 208.234621][ T4228] usb 2-1: Using ep0 maxpacket: 16 [ 208.267625][ T6167] device syzkaller0 entered promiscuous mode [ 208.312298][ T4197] Bluetooth: hci4: link tx timeout [ 208.318504][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 208.365727][ T4228] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 208.387480][ T4228] usb 2-1: config 1 has no interface number 0 [ 208.397449][ T4228] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 208.584608][ T4228] usb 2-1: config 1 interface 19 has no altsetting 0 [ 208.594930][ T4197] Bluetooth: hci4: link tx timeout [ 208.600690][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 208.694746][ T4200] Bluetooth: hci4: command 0x0406 tx timeout [ 208.805447][ T4228] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 208.829507][ T4228] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.879153][ T4228] usb 2-1: Product: syz [ 208.883376][ T4228] usb 2-1: Manufacturer: syz [ 208.913351][ T4228] usb 2-1: SerialNumber: syz [ 209.112804][ T6209] device syzkaller0 entered promiscuous mode [ 209.129678][ T4197] Bluetooth: hci4: link tx timeout [ 209.135084][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 209.160675][ T4228] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 209.209240][ T4682] usb 2-1: Failed to submit usb control message: -71 [ 209.219084][ T4682] usb 2-1: unable to send the bmi data to the device: -71 [ 209.222510][ T4228] usb 2-1: USB disconnect, device number 10 [ 209.226320][ T4682] usb 2-1: unable to get target info from device [ 209.226365][ T4682] usb 2-1: could not get target info (-71) [ 209.226409][ T4682] usb 2-1: could not probe fw (-71) [ 209.228273][ T6214] loop2: detected capacity change from 0 to 512 [ 209.274352][ T6216] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 209.340582][ T6219] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 209.389599][ T6214] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 209.413410][ T6214] ext4 filesystem being mounted at /112/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 209.658825][ T6216] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 209.777455][ T4197] Bluetooth: hci4: link tx timeout [ 209.782637][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 210.679567][ T6253] device syzkaller0 entered promiscuous mode [ 210.861351][ T6256] loop1: detected capacity change from 0 to 512 [ 210.903577][ T6258] netlink: 4 bytes leftover after parsing attributes in process `syz.4.551'. [ 210.997086][ T6261] netlink: 4 bytes leftover after parsing attributes in process `syz.4.551'. [ 211.057303][ T6263] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 211.174163][ T6256] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 211.220161][ T6256] ext4 filesystem being mounted at /96/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 211.434590][ T4200] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 211.760114][ T6274] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 212.242152][ T4197] Bluetooth: hci4: link tx timeout [ 212.242222][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 212.566614][ T6285] device syzkaller0 entered promiscuous mode [ 212.954754][ T4200] usb 3-1: Using ep0 maxpacket: 16 [ 213.025939][ T6296] device syzkaller0 entered promiscuous mode [ 213.094718][ T4200] usb 3-1: config 1 has an invalid interface number: 19 but max is 0 [ 213.107142][ T4200] usb 3-1: config 1 has no interface number 0 [ 213.117131][ T4200] usb 3-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 213.132297][ T4200] usb 3-1: config 1 interface 19 has no altsetting 0 [ 213.183874][ T6302] device syzkaller0 entered promiscuous mode [ 213.325205][ T4200] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 213.348249][ T4200] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.389354][ T4200] usb 3-1: Product: syz [ 213.419265][ T4200] usb 3-1: Manufacturer: syz [ 213.453224][ T4200] usb 3-1: SerialNumber: syz [ 213.503876][ T6308] loop3: detected capacity change from 0 to 512 [ 213.541630][ T4200] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 213.735041][ T144] usb 3-1: Failed to submit usb control message: -71 [ 213.745871][ T4200] usb 3-1: USB disconnect, device number 6 [ 213.758104][ T144] usb 3-1: unable to send the bmi data to the device: -71 [ 213.788733][ T6308] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 213.840987][ T4197] Bluetooth: hci4: link tx timeout [ 213.846564][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 213.870415][ T144] usb 3-1: unable to get target info from device [ 214.300038][ T144] usb 3-1: could not get target info (-71) [ 214.313376][ T6308] ext4 filesystem being mounted at /136/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 214.332064][ T144] usb 3-1: could not probe fw (-71) [ 214.579513][ T4197] Bluetooth: hci4: link tx timeout [ 214.584690][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 214.631415][ T6327] netlink: 8 bytes leftover after parsing attributes in process `syz.0.571'. [ 214.735499][ T6331] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 214.760399][ T6332] snd_dummy snd_dummy.0: control 0:0:8:syz0:0 is already present [ 215.501304][ T5111] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 215.585942][ T6343] device syzkaller0 entered promiscuous mode [ 215.673985][ T4197] Bluetooth: hci4: link tx timeout [ 215.679236][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 215.764652][ T5111] usb 2-1: Using ep0 maxpacket: 16 [ 215.863376][ T6353] device syzkaller0 entered promiscuous mode [ 215.876166][ T6351] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 215.924789][ T5111] usb 2-1: config 1 has an invalid interface number: 19 but max is 0 [ 215.935941][ T5111] usb 2-1: config 1 has no interface number 0 [ 215.942039][ T5111] usb 2-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 215.954399][ T5111] usb 2-1: config 1 interface 19 has no altsetting 0 [ 215.994323][ C1] ================================================================== [ 216.002647][ C1] BUG: KASAN: use-after-free in __nft_trace_packet+0x135/0x150 [ 216.010200][ C1] Read of size 2 at addr ffff88801b1f8800 by task syz.3.581/6356 [ 216.017900][ C1] [ 216.020221][ C1] CPU: 1 PID: 6356 Comm: syz.3.581 Not tainted syzkaller #0 [ 216.027493][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 216.037587][ C1] Call Trace: [ 216.040881][ C1] [ 216.043740][ C1] dump_stack_lvl+0x188/0x250 [ 216.048431][ C1] ? show_regs_print_info+0x20/0x20 [ 216.053644][ C1] ? _printk+0xda/0x130 [ 216.057787][ C1] ? __nft_trace_packet+0x135/0x150 [ 216.062973][ C1] ? load_image+0x400/0x400 [ 216.067459][ C1] ? nft_synproxy_do_eval+0x304/0x570 [ 216.072816][ C1] print_address_description+0x60/0x2d0 [ 216.078358][ C1] ? __nft_trace_packet+0x135/0x150 [ 216.083577][ C1] kasan_report+0xdf/0x130 [ 216.088016][ C1] ? __nft_trace_packet+0x135/0x150 [ 216.093233][ C1] __nft_trace_packet+0x135/0x150 [ 216.098272][ C1] nft_do_chain+0x12a5/0x14f0 [ 216.102970][ C1] ? nft_fwd_dup_netdev_offload+0x120/0x120 [ 216.108998][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 216.115024][ C1] ? nft_meta_set_eval+0x13a/0x3a0 [ 216.120180][ C1] ? nf_nat_inet_fn+0x8a3/0xad0 [ 216.125084][ C1] nft_do_chain_inet+0x25c/0x340 [ 216.130046][ C1] ? nft_do_chain_arp+0xf0/0xf0 [ 216.134934][ C1] ? nf_nat_ipv4_local_in+0x209/0x5b0 [ 216.140328][ C1] ? nft_do_chain_arp+0xf0/0xf0 [ 216.145200][ C1] nf_hook_slow+0xb9/0x200 [ 216.149638][ C1] ? NF_HOOK+0x390/0x390 [ 216.153888][ C1] NF_HOOK+0x1f2/0x390 [ 216.156673][ T6364] loop2: detected capacity change from 0 to 512 [ 216.157963][ C1] ? NF_HOOK+0x390/0x390 [ 216.168447][ C1] ? ip_local_deliver+0x1a0/0x1a0 [ 216.173477][ C1] ? ip_rcv_finish_core+0xd8b/0x1bc0 [ 216.178772][ C1] ? NF_HOOK+0x390/0x390 [ 216.183026][ C1] ? ip_local_deliver+0x11e/0x1a0 [ 216.188069][ C1] ? ip_rcv_core+0xb60/0xb60 [ 216.192666][ C1] NF_HOOK+0x303/0x390 [ 216.196729][ C1] ? ip_rcv_core+0xb60/0xb60 [ 216.201320][ C1] ? ip_local_deliver+0x1a0/0x1a0 [ 216.206331][ C1] ? ip_rcv_core+0xb60/0xb60 [ 216.210907][ C1] ? ip_local_deliver_finish+0x320/0x320 [ 216.216524][ C1] ? ip_local_deliver_finish+0x320/0x320 [ 216.222158][ C1] __netif_receive_skb+0xcc/0x290 [ 216.227169][ C1] process_backlog+0x370/0x790 [ 216.231925][ C1] ? rps_trigger_softirq+0x210/0x210 [ 216.237208][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 216.243172][ C1] ? lock_chain_count+0x20/0x20 [ 216.248020][ C1] __napi_poll+0xc0/0x430 [ 216.252353][ C1] ? net_rx_action+0x307/0xa10 [ 216.257100][ C1] net_rx_action+0x4d4/0xa10 [ 216.261672][ C1] ? net_tx_action+0x880/0x880 [ 216.266421][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 216.272389][ C1] ? lock_chain_count+0x20/0x20 [ 216.277234][ C1] handle_softirqs+0x339/0x830 [ 216.281984][ C1] ? do_softirq+0x142/0x210 [ 216.286469][ C1] ? do_softirq+0x210/0x210 [ 216.290957][ C1] do_softirq+0x142/0x210 [ 216.295273][ C1] [ 216.298204][ C1] [ 216.301143][ C1] ? __local_bh_enable_ip+0x1c0/0x1c0 [ 216.306501][ C1] ? lockdep_hardirqs_on_prepare+0x770/0x770 [ 216.312473][ C1] ? __local_bh_enable_ip+0xd7/0x1c0 [ 216.317769][ C1] ? lockdep_hardirqs_off+0x70/0x100 [ 216.323042][ C1] ? local_bh_enable+0x5/0x20 [ 216.327794][ C1] __local_bh_enable_ip+0x180/0x1c0 [ 216.332989][ C1] ? _local_bh_enable+0xa0/0xa0 [ 216.337950][ C1] ? ip_finish_output2+0x8f7/0x10a0 [ 216.343162][ C1] ip_finish_output2+0xd50/0x10a0 [ 216.348194][ C1] ? ip_fragment+0x210/0x210 [ 216.352789][ C1] ? ip_skb_dst_mtu+0x584/0x9b0 [ 216.357629][ C1] ? ip_finish_output+0x3e8/0x4b0 [ 216.362644][ C1] ip_output+0x2c0/0x3e0 [ 216.366893][ C1] __ip_queue_xmit+0x11c1/0x1c00 [ 216.371831][ C1] __tcp_transmit_skb+0x1d11/0x3200 [ 216.377026][ C1] ? __tcp_send_ack+0x5d0/0x5d0 [ 216.381861][ C1] ? seqcount_lockdep_reader_access+0x18d/0x1d0 [ 216.388104][ C1] ? memset+0x1e/0x40 [ 216.392096][ C1] ? tcp_rbtree_insert+0x114/0x170 [ 216.397220][ C1] ? tcp_connect+0x1fc1/0x4970 [ 216.402000][ C1] tcp_connect+0x21ac/0x4970 [ 216.406633][ C1] tcp_v4_connect+0x103e/0x1a80 [ 216.411518][ C1] ? tcp_twsk_unique+0x990/0x990 [ 216.416478][ C1] ? mark_lock+0x94/0x320 [ 216.420828][ C1] __inet_stream_connect+0x244/0xd70 [ 216.426131][ C1] ? lock_chain_count+0x20/0x20 [ 216.430998][ C1] ? lockdep_hardirqs_on_prepare+0x770/0x770 [ 216.436972][ C1] ? __local_bh_enable_ip+0x136/0x1c0 [ 216.442332][ C1] ? inet_dgram_connect+0x360/0x360 [ 216.447530][ C1] ? __local_bh_enable_ip+0x136/0x1c0 [ 216.452910][ C1] ? _local_bh_enable+0xa0/0xa0 [ 216.457749][ C1] inet_stream_connect+0x62/0xa0 [ 216.462672][ C1] ? __inet_stream_connect+0xd70/0xd70 [ 216.468114][ C1] __sys_connect+0x3cb/0x450 [ 216.472699][ C1] ? __sys_connect_file+0x170/0x170 [ 216.477890][ C1] ? vtime_user_exit+0x2c8/0x3e0 [ 216.482824][ C1] __x64_sys_connect+0x76/0x80 [ 216.487592][ C1] do_syscall_64+0x4c/0xa0 [ 216.491992][ C1] ? clear_bhb_loop+0x30/0x80 [ 216.496657][ C1] ? clear_bhb_loop+0x30/0x80 [ 216.501336][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 216.507222][ C1] RIP: 0033:0x7fd43cb98e59 [ 216.511621][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 216.531208][ C1] RSP: 002b:00007fd43adf2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 216.539615][ C1] RAX: ffffffffffffffda RBX: 00007fd43ce11fa0 RCX: 00007fd43cb98e59 [ 216.547577][ C1] RDX: 0000000000000010 RSI: 0000200000000c80 RDI: 0000000000000004 [ 216.555553][ C1] RBP: 00007fd43cc2ed6f R08: 0000000000000000 R09: 0000000000000000 [ 216.563513][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 216.571486][ C1] R13: 00007fd43ce12038 R14: 00007fd43ce11fa0 R15: 00007ffd5df89278 [ 216.579451][ C1] [ 216.582451][ C1] [ 216.584756][ C1] Allocated by task 6356: [ 216.589089][ C1] __kasan_slab_alloc+0x9c/0xd0 [ 216.593929][ C1] slab_post_alloc_hook+0x4c/0x380 [ 216.599029][ C1] kmem_cache_alloc_node+0x12d/0x2d0 [ 216.604312][ C1] __alloc_skb+0xf4/0x750 [ 216.608623][ C1] synproxy_send_client_synack+0x16f/0xde0 [ 216.614438][ C1] nft_synproxy_eval_v4+0x347/0x4e0 [ 216.619620][ C1] nft_synproxy_do_eval+0x304/0x570 [ 216.624800][ C1] nft_do_chain+0x48c/0x14f0 [ 216.629379][ C1] nft_do_chain_inet+0x25c/0x340 [ 216.634302][ C1] nf_hook_slow+0xb9/0x200 [ 216.638709][ C1] NF_HOOK+0x1f2/0x390 [ 216.642761][ C1] NF_HOOK+0x303/0x390 [ 216.646830][ C1] __netif_receive_skb+0xcc/0x290 [ 216.651862][ C1] process_backlog+0x370/0x790 [ 216.656625][ C1] __napi_poll+0xc0/0x430 [ 216.660938][ C1] net_rx_action+0x4d4/0xa10 [ 216.665513][ C1] handle_softirqs+0x339/0x830 [ 216.670261][ C1] do_softirq+0x142/0x210 [ 216.674574][ C1] __local_bh_enable_ip+0x180/0x1c0 [ 216.679753][ C1] ip_finish_output2+0xd50/0x10a0 [ 216.684759][ C1] ip_output+0x2c0/0x3e0 [ 216.688981][ C1] __ip_queue_xmit+0x11c1/0x1c00 [ 216.693899][ C1] __tcp_transmit_skb+0x1d11/0x3200 [ 216.699086][ C1] tcp_connect+0x21ac/0x4970 [ 216.703681][ C1] tcp_v4_connect+0x103e/0x1a80 [ 216.708530][ C1] __inet_stream_connect+0x244/0xd70 [ 216.713812][ C1] inet_stream_connect+0x62/0xa0 [ 216.718734][ C1] __sys_connect+0x3cb/0x450 [ 216.723311][ C1] __x64_sys_connect+0x76/0x80 [ 216.728070][ C1] do_syscall_64+0x4c/0xa0 [ 216.732466][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 216.738345][ C1] [ 216.740648][ C1] Freed by task 6356: [ 216.744605][ C1] kasan_set_track+0x4b/0x70 [ 216.749202][ C1] kasan_set_free_info+0x1f/0x40 [ 216.754151][ C1] ____kasan_slab_free+0xd5/0x110 [ 216.759185][ C1] slab_free_freelist_hook+0xea/0x170 [ 216.764556][ C1] kmem_cache_free+0x8f/0x210 [ 216.769213][ C1] nft_synproxy_eval_v4+0x34f/0x4e0 [ 216.774394][ C1] nft_synproxy_do_eval+0x304/0x570 [ 216.779583][ C1] nft_do_chain+0x48c/0x14f0 [ 216.784153][ C1] nft_do_chain_inet+0x25c/0x340 [ 216.789070][ C1] nf_hook_slow+0xb9/0x200 [ 216.793468][ C1] NF_HOOK+0x1f2/0x390 [ 216.797524][ C1] NF_HOOK+0x303/0x390 [ 216.801593][ C1] __netif_receive_skb+0xcc/0x290 [ 216.806614][ C1] process_backlog+0x370/0x790 [ 216.811357][ C1] __napi_poll+0xc0/0x430 [ 216.815663][ C1] net_rx_action+0x4d4/0xa10 [ 216.820230][ C1] handle_softirqs+0x339/0x830 [ 216.824972][ C1] do_softirq+0x142/0x210 [ 216.829276][ C1] __local_bh_enable_ip+0x180/0x1c0 [ 216.834451][ C1] ip_finish_output2+0xd50/0x10a0 [ 216.839457][ C1] ip_output+0x2c0/0x3e0 [ 216.843703][ C1] __ip_queue_xmit+0x11c1/0x1c00 [ 216.848626][ C1] __tcp_transmit_skb+0x1d11/0x3200 [ 216.853824][ C1] tcp_connect+0x21ac/0x4970 [ 216.858399][ C1] tcp_v4_connect+0x103e/0x1a80 [ 216.863225][ C1] __inet_stream_connect+0x244/0xd70 [ 216.868490][ C1] inet_stream_connect+0x62/0xa0 [ 216.873412][ C1] __sys_connect+0x3cb/0x450 [ 216.877983][ C1] __x64_sys_connect+0x76/0x80 [ 216.882729][ C1] do_syscall_64+0x4c/0xa0 [ 216.886030][ T4197] Bluetooth: hci4: link tx timeout [ 216.887127][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 216.887150][ C1] [ 216.887155][ C1] The buggy address belongs to the object at ffff88801b1f8780 [ 216.887155][ C1] which belongs to the cache skbuff_head_cache of size 232 [ 216.887170][ C1] The buggy address is located 128 bytes inside of [ 216.887170][ C1] 232-byte region [ffff88801b1f8780, ffff88801b1f8868) [ 216.887186][ C1] The buggy address belongs to the page: [ 216.887211][ C1] page:ffffea00006c7e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88801b1f8000 pfn:0x1b1f8 [ 216.892287][ T4197] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 216.898154][ C1] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 216.898187][ C1] raw: 00fff00000000200 ffffea0000a7a240 0000000700000005 ffff888144bf2140 [ 216.898201][ C1] raw: ffff88801b1f8000 00000000800c0006 00000001ffffffff 0000000000000000 [ 216.898208][ C1] page dumped because: kasan: bad access detected [ 216.898220][ C1] page_owner tracks the page as allocated [ 216.898225][ C1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3573, ts 24894960354, free_ts 24761584518 [ 216.898246][ C1] get_page_from_freelist+0x1bbd/0x1ca0 [ 216.898265][ C1] __alloc_pages+0x1ee/0x480 [ 216.898281][ C1] new_slab+0xc0/0x4b0 [ 216.898296][ C1] ___slab_alloc+0x80a/0xdd0 [ 216.898310][ C1] kmem_cache_alloc_node+0x1c3/0x2d0 [ 216.898324][ C1] __alloc_skb+0xf4/0x750 [ 216.898340][ C1] alloc_skb_with_frags+0xa7/0x730 [ 216.898354][ C1] sock_alloc_send_pskb+0x87f/0x9a0 [ 217.044230][ C1] unix_dgram_sendmsg+0x5fc/0x18a0 [ 217.049334][ C1] sock_write_iter+0x2a6/0x3a0 [ 217.054096][ C1] vfs_write+0x745/0xd60 [ 217.058320][ C1] ksys_write+0x152/0x260 [ 217.062628][ C1] do_syscall_64+0x4c/0xa0 [ 217.067021][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 217.072892][ C1] page last free stack trace: [ 217.077540][ C1] free_unref_page_prepare+0x637/0x6c0 [ 217.082978][ C1] free_unref_page+0x8f/0x2a0 [ 217.087638][ C1] __unfreeze_partials+0x1a5/0x200 [ 217.092738][ C1] put_cpu_partial+0x12d/0x190 [ 217.097490][ C1] qlist_free_all+0x35/0x90 [ 217.101991][ C1] kasan_quarantine_reduce+0x150/0x160 [ 217.107428][ C1] __kasan_slab_alloc+0x2f/0xd0 [ 217.112257][ C1] slab_post_alloc_hook+0x4c/0x380 [ 217.117345][ C1] kmem_cache_alloc_node+0x12d/0x2d0 [ 217.122608][ C1] __alloc_skb+0xf4/0x750 [ 217.126924][ C1] netlink_sendmsg+0x654/0xbe0 [ 217.131667][ C1] ____sys_sendmsg+0x5b7/0x8f0 [ 217.136408][ C1] ___sys_sendmsg+0x236/0x2e0 [ 217.141064][ C1] __se_sys_sendmsg+0x1af/0x290 [ 217.145904][ C1] do_syscall_64+0x4c/0xa0 [ 217.150328][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 217.156228][ C1] [ 217.158539][ C1] Memory state around the buggy address: [ 217.164152][ C1] ffff88801b1f8700: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 217.172208][ C1] ffff88801b1f8780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 217.180298][ C1] >ffff88801b1f8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 217.188359][ C1] ^ [ 217.192412][ C1] ffff88801b1f8880: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 217.200470][ C1] ffff88801b1f8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 217.208545][ C1] ================================================================== [ 217.216596][ C1] Disabling lock debugging due to kernel taint [ 217.222784][ C1] vkms_vblank_simulate: vblank timer overrun [ 217.228837][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 217.236020][ C1] CPU: 1 PID: 6356 Comm: syz.3.581 Tainted: G B syzkaller #0 [ 217.244677][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 217.254715][ C1] Call Trace: [ 217.257983][ C1] [ 217.260810][ C1] dump_stack_lvl+0x188/0x250 [ 217.265469][ C1] ? show_regs_print_info+0x20/0x20 [ 217.270649][ C1] ? load_image+0x400/0x400 [ 217.275132][ C1] panic+0x2e5/0x810 [ 217.279013][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 217.283642][ C1] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 217.289528][ C1] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 217.295405][ C1] ? _raw_spin_unlock+0x40/0x40 [ 217.300237][ C1] ? print_memory_metadata+0x314/0x400 [ 217.305677][ C1] ? __nft_trace_packet+0x135/0x150 [ 217.310855][ C1] check_panic_on_warn+0x80/0xa0 [ 217.315776][ C1] ? __nft_trace_packet+0x135/0x150 [ 217.320953][ C1] end_report+0x6d/0xf0 [ 217.325090][ C1] kasan_report+0x102/0x130 [ 217.329568][ C1] ? __nft_trace_packet+0x135/0x150 [ 217.334746][ C1] __nft_trace_packet+0x135/0x150 [ 217.339765][ C1] nft_do_chain+0x12a5/0x14f0 [ 217.344448][ C1] ? nft_fwd_dup_netdev_offload+0x120/0x120 [ 217.350321][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 217.356289][ C1] ? nft_meta_set_eval+0x13a/0x3a0 [ 217.361391][ C1] ? nf_nat_inet_fn+0x8a3/0xad0 [ 217.366228][ C1] nft_do_chain_inet+0x25c/0x340 [ 217.371148][ C1] ? nft_do_chain_arp+0xf0/0xf0 [ 217.375982][ C1] ? nf_nat_ipv4_local_in+0x209/0x5b0 [ 217.381341][ C1] ? nft_do_chain_arp+0xf0/0xf0 [ 217.386171][ C1] nf_hook_slow+0xb9/0x200 [ 217.390568][ C1] ? NF_HOOK+0x390/0x390 [ 217.394789][ C1] NF_HOOK+0x1f2/0x390 [ 217.398831][ C1] ? NF_HOOK+0x390/0x390 [ 217.403051][ C1] ? ip_local_deliver+0x1a0/0x1a0 [ 217.408052][ C1] ? ip_rcv_finish_core+0xd8b/0x1bc0 [ 217.413316][ C1] ? NF_HOOK+0x390/0x390 [ 217.417537][ C1] ? ip_local_deliver+0x11e/0x1a0 [ 217.422535][ C1] ? ip_rcv_core+0xb60/0xb60 [ 217.427101][ C1] NF_HOOK+0x303/0x390 [ 217.431147][ C1] ? ip_rcv_core+0xb60/0xb60 [ 217.435721][ C1] ? ip_local_deliver+0x1a0/0x1a0 [ 217.440747][ C1] ? ip_rcv_core+0xb60/0xb60 [ 217.445316][ C1] ? ip_local_deliver_finish+0x320/0x320 [ 217.450925][ C1] ? ip_local_deliver_finish+0x320/0x320 [ 217.456534][ C1] __netif_receive_skb+0xcc/0x290 [ 217.461545][ C1] process_backlog+0x370/0x790 [ 217.466314][ C1] ? rps_trigger_softirq+0x210/0x210 [ 217.471575][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 217.477538][ C1] ? lock_chain_count+0x20/0x20 [ 217.482369][ C1] __napi_poll+0xc0/0x430 [ 217.486680][ C1] ? net_rx_action+0x307/0xa10 [ 217.491422][ C1] net_rx_action+0x4d4/0xa10 [ 217.495996][ C1] ? net_tx_action+0x880/0x880 [ 217.500735][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 217.506696][ C1] ? lock_chain_count+0x20/0x20 [ 217.511526][ C1] handle_softirqs+0x339/0x830 [ 217.516268][ C1] ? do_softirq+0x142/0x210 [ 217.520751][ C1] ? do_softirq+0x210/0x210 [ 217.525233][ C1] do_softirq+0x142/0x210 [ 217.529546][ C1] [ 217.532472][ C1] [ 217.535402][ C1] ? __local_bh_enable_ip+0x1c0/0x1c0 [ 217.540777][ C1] ? lockdep_hardirqs_on_prepare+0x770/0x770 [ 217.546769][ C1] ? __local_bh_enable_ip+0xd7/0x1c0 [ 217.552055][ C1] ? lockdep_hardirqs_off+0x70/0x100 [ 217.557342][ C1] ? local_bh_enable+0x5/0x20 [ 217.562022][ C1] __local_bh_enable_ip+0x180/0x1c0 [ 217.567222][ C1] ? _local_bh_enable+0xa0/0xa0 [ 217.572078][ C1] ? ip_finish_output2+0x8f7/0x10a0 [ 217.577278][ C1] ip_finish_output2+0xd50/0x10a0 [ 217.582306][ C1] ? ip_fragment+0x210/0x210 [ 217.586901][ C1] ? ip_skb_dst_mtu+0x584/0x9b0 [ 217.591756][ C1] ? ip_finish_output+0x3e8/0x4b0 [ 217.596793][ C1] ip_output+0x2c0/0x3e0 [ 217.601045][ C1] __ip_queue_xmit+0x11c1/0x1c00 [ 217.605972][ C1] __tcp_transmit_skb+0x1d11/0x3200 [ 217.611157][ C1] ? __tcp_send_ack+0x5d0/0x5d0 [ 217.615986][ C1] ? seqcount_lockdep_reader_access+0x18d/0x1d0 [ 217.622216][ C1] ? memset+0x1e/0x40 [ 217.626201][ C1] ? tcp_rbtree_insert+0x114/0x170 [ 217.631336][ C1] ? tcp_connect+0x1fc1/0x4970 [ 217.636094][ C1] tcp_connect+0x21ac/0x4970 [ 217.640694][ C1] tcp_v4_connect+0x103e/0x1a80 [ 217.645541][ C1] ? tcp_twsk_unique+0x990/0x990 [ 217.650472][ C1] ? mark_lock+0x94/0x320 [ 217.654800][ C1] __inet_stream_connect+0x244/0xd70 [ 217.660074][ C1] ? lock_chain_count+0x20/0x20 [ 217.664909][ C1] ? lockdep_hardirqs_on_prepare+0x770/0x770 [ 217.670884][ C1] ? __local_bh_enable_ip+0x136/0x1c0 [ 217.676242][ C1] ? inet_dgram_connect+0x360/0x360 [ 217.681428][ C1] ? __local_bh_enable_ip+0x136/0x1c0 [ 217.686786][ C1] ? _local_bh_enable+0xa0/0xa0 [ 217.691638][ C1] inet_stream_connect+0x62/0xa0 [ 217.696560][ C1] ? __inet_stream_connect+0xd70/0xd70 [ 217.702004][ C1] __sys_connect+0x3cb/0x450 [ 217.706585][ C1] ? __sys_connect_file+0x170/0x170 [ 217.711768][ C1] ? vtime_user_exit+0x2c8/0x3e0 [ 217.716689][ C1] __x64_sys_connect+0x76/0x80 [ 217.721437][ C1] do_syscall_64+0x4c/0xa0 [ 217.725832][ C1] ? clear_bhb_loop+0x30/0x80 [ 217.730487][ C1] ? clear_bhb_loop+0x30/0x80 [ 217.735145][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 217.741040][ C1] RIP: 0033:0x7fd43cb98e59 [ 217.745439][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.765028][ C1] RSP: 002b:00007fd43adf2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 217.773448][ C1] RAX: ffffffffffffffda RBX: 00007fd43ce11fa0 RCX: 00007fd43cb98e59 [ 217.781400][ C1] RDX: 0000000000000010 RSI: 0000200000000c80 RDI: 0000000000000004 [ 217.789383][ C1] RBP: 00007fd43cc2ed6f R08: 0000000000000000 R09: 0000000000000000 [ 217.797342][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 217.805297][ C1] R13: 00007fd43ce12038 R14: 00007fd43ce11fa0 R15: 00007ffd5df89278 [ 217.806337][ T4197] Bluetooth: hci4: link tx timeout [ 217.813256][ C1] [ 217.813490][ C1] Kernel Offset: disabled [ 217.825869][ C1] Rebooting in 86400 seconds..