last executing test programs: 52.905547098s ago: executing program 3 (id=1192): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xac055000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x2a1, 0x21, &(0x7f0000000240)={0x0, 0x6, 0xd, 0x360}, 0x8, 0x7, 0x7f, 0x0, 0x1, 0x101, 0x0}) 51.959724793s ago: executing program 3 (id=1203): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000580)="240000001e005f031400ff01000000f80700b3586ff606c2e553797c080008e467dc00", 0x23) 51.868290924s ago: executing program 3 (id=1208): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006880)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x4, 0xa}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 51.423189616s ago: executing program 3 (id=1211): add_key(0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0xe0000000, 0x5e4b0422, 0x3, 0xffff, 0x5, 0x9, 0x0, 0x0, 0x80, 0x80000001}}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) ioctl(0xffffffffffffffff, 0x8b2a, &(0x7f0000000040)) 51.359700137s ago: executing program 3 (id=1212): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) prlimit64(0x0, 0xa, &(0x7f00000001c0)={0x8, 0x400}, &(0x7f00000002c0)) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) chdir(0x0) openat$incfs(0xffffffffffffff9c, 0x0, 0x1812c1, 0x0) set_mempolicy(0x6005, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') pread64(r3, &(0x7f0000002c00)=""/4082, 0xff2, 0x7) 51.208653388s ago: executing program 3 (id=1214): pipe2$9p(&(0x7f0000000240), 0x80800) r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x842) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000340)='.\x00', &(0x7f0000000040), 0x800000, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) 35.55127197s ago: executing program 32 (id=1214): pipe2$9p(&(0x7f0000000240), 0x80800) r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x842) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000340)='.\x00', &(0x7f0000000040), 0x800000, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) 9.276694226s ago: executing program 4 (id=1513): bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000000c0)={@local}, 0x14) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000000)={@empty}, 0x14) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) setsockopt$inet6_mreq(r5, 0x29, 0x1c, &(0x7f00000001c0)={@remote, r6}, 0x14) getsockopt$inet6_buf(r0, 0x29, 0xca, 0x0, 0xfffffffffffffffe) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0xe, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="1802000080100000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r7 = socket$inet_icmp(0x2, 0x2, 0x1) sendmmsg$inet(r7, &(0x7f00000053c0)=[{{&(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000140)='\b\x00\x00\x00(\x00\x00\x00', 0x8}], 0x1}}], 0x1, 0x4800) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0xa02) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffa, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x3}) io_uring_enter(0xffffffffffffffff, 0xdb4, 0x0, 0x9, 0x0, 0x0) recvfrom(r7, 0x0, 0x0, 0x40000040, 0x0, 0x0) 8.41720862s ago: executing program 4 (id=1523): bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$inet6(0xa, 0x80002, 0x0) r3 = syz_io_uring_setup(0x110, &(0x7f00000003c0)={0x0, 0xfad6, 0x100, 0x1}, &(0x7f0000000040)=0x0, &(0x7f0000002a00)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x3}) io_uring_enter(r3, 0xdb4, 0x0, 0x9, 0x0, 0x0) 7.264385357s ago: executing program 4 (id=1530): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003c00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_IMMEDIATE_DATA={0x14, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xd, 0x1, "834f07fb9d64f104c2"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xd4}}, 0x0) 7.156294908s ago: executing program 4 (id=1535): syz_usb_connect(0x0, 0x48, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e2b, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7ff}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000002940)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}}], 0x800008d, 0x0) 5.894922866s ago: executing program 5 (id=1543): bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r3 = syz_io_uring_setup(0x110, &(0x7f00000003c0)={0x0, 0xfad6, 0x100, 0x1}, &(0x7f0000000040)=0x0, &(0x7f0000002a00)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x3}) io_uring_enter(r3, 0xdb4, 0x0, 0x9, 0x0, 0x0) 5.097565921s ago: executing program 1 (id=1547): syz_open_procfs(0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x8, 0x3032, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, 0x0) r3 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r3, 0x101, 0x0, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) 4.985842101s ago: executing program 5 (id=1549): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000003c0)={0x1c, &(0x7f0000000280)={0x20, 0x3}, 0x0, 0x0}) 4.128415006s ago: executing program 1 (id=1550): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0xd, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) syz_emit_vhci(&(0x7f0000001800)=ANY=[], 0xf) move_pages(0x0, 0xfffffffffffffd3c, 0x0, 0x0, 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x240048c1) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0x3e, &(0x7f0000000100)=r6, 0x4) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x7101}) r8 = socket$unix(0x1, 0x1, 0x0) syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f00000000c0)) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) close_range(r0, 0xffffffffffffffff, 0x0) 4.044913337s ago: executing program 0 (id=1552): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, 0x0, 0x0) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000100)="89e7ee2c78dad9b4b473fec988cafb", 0xf}, {&(0x7f0000000500)="e98314d58ce4b24ee137cea9c243c233bfa2f5fee778bbfc11a66c5fc8d3e63588056401261b11905fabd4af", 0x2c}], 0x2) 4.000654097s ago: executing program 0 (id=1553): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES32=r1], 0x20}}, 0x2000e844) 3.626143369s ago: executing program 0 (id=1556): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) socket$nl_generic(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-160\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x800) recvmmsg$unix(r3, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) 3.540387539s ago: executing program 2 (id=1557): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB="340000001000390400"/20, @ANYRES32=0x0, @ANYBLOB="000000000003284eb5636802a13eaf9e39623eac2100000014001280"], 0x34}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000001780)=ANY=[@ANYBLOB="020000000400000006000000050000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = timerfd_create(0x9, 0x0) timerfd_gettime(r6, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000040)=@ethtool_link_settings={0x2, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4c, 0xf3, 0x8, [0x0, 0x0, 0x0, 0xc, 0x5, 0x0, 0x0, 0x40000002]}}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000001000010025bd7000fbdbdf2500000000", @ANYRES32=r7, @ANYBLOB="10080400030a000008003a"], 0x30}}, 0x4000014) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48011}, 0x4000000) 3.50819344s ago: executing program 1 (id=1558): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000e40)=@raw={'raw\x00', 0x3c1, 0x3, 0x4c0, 0x0, 0x18c, 0x203, 0x8000000, 0x19030000, 0x3f0, 0x2e0, 0x2e0, 0x3f0, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {}, {}, {0xfffe}, {}, {}, {}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x520) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001000)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="2400000020000103000000000000000002000008"], 0x24}}, 0x44004) 3.065883402s ago: executing program 5 (id=1559): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x8844) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000080)='sched_switch\x00', 0xffffffffffffffff, 0x0, 0xc8d}, 0x18) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.611921525s ago: executing program 2 (id=1560): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = socket$inet(0x2, 0x1, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) futex(0x0, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) r6 = socket(0x10, 0x803, 0x0) getsockname$packet(r6, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) shutdown(r2, 0x1) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) gettid() fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0xc, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r7, 0x0, 0x10, 0x10, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000001900)={0x2, {0xc, 0x117, 0x5, 0x101, 0x200}}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="710700006020000008001b0000000000"], 0x28}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) 2.610153575s ago: executing program 1 (id=1561): syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448d4, 0x0) 2.122694028s ago: executing program 4 (id=1562): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e020000000000000000000000000000040400000000"], 0x0, 0x37}, 0x28) 2.120725128s ago: executing program 5 (id=1563): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0xc2300, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0x6}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000c40)=@newtfilter={0xbc, 0x2c, 0xd27, 0x70bd25, 0x4, {0x0, 0x0, 0x0, r2, {0x4, 0x2}, {}, {0x1, 0xf}}, [@filter_kind_options=@f_u32={{0x8}, {0x90, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x10, 0x9130c9d1e97f2c2b}}, @TCA_U32_SEL={0x84, 0x5, {0x3, 0x9, 0x8, 0x2, 0x1, 0x2, 0x9, 0x5, [{0x3, 0x5, 0xd1e, 0x2}, {0xd, 0x9, 0xffff, 0x1}, {0xfffffff8, 0x8, 0x2b0, 0x7}, {0x7ff, 0x7, 0x80, 0x1e87}, {0x7, 0x7, 0x9, 0x8a}, {0x4, 0x1, 0x513, 0x1}, {0x97, 0x7, 0x8001, 0x5}]}}]}}]}, 0xbc}}, 0x20040074) 1.601466251s ago: executing program 1 (id=1564): r0 = socket$packet(0x11, 0x3, 0x300) dup(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x5) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r2}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1000) connect$unix(0xffffffffffffffff, &(0x7f000001a300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000001c0), 0x97, 0x20000000) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) read$FUSE(0xffffffffffffffff, &(0x7f0000001080)={0x2020}, 0x2020) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000280)={'wg0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="240000001a00010028bd70000000000002202000000000000000000008000300", @ANYRES32=r5, @ANYBLOB="c5c2ad3372d250c4f52d257c4315d21933ab31f38c81ab0dc0f059903c15e7f89d24b55e3da09e22bce2387bf9b9f7260c7e270e6c6551c878712943b405f91ed8ff9cb33ee52685291840c2fe41417874dae17673f0449e03cd7b60936f95caaee01e0af57ce02c47930cd36fe727dd0a3c7e3b66d46eebab3f9e8e233ebafbe6d79c5b027bd5576918061e4f4eab8c3a766cb924129dd29623b419cdeb5b92b937a93803fae29a3ab1"], 0x24}}, 0x0) 1.525887222s ago: executing program 0 (id=1565): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x200000000000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000000850000008600000018010000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1.467187842s ago: executing program 0 (id=1566): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES32=r1], 0x20}}, 0x2000e844) 1.465887242s ago: executing program 5 (id=1567): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x50a32, 0x823}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8}, @IFLA_BR_MCAST_SNOOPING={0x5, 0x17, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4044064}, 0x40000) 1.461860862s ago: executing program 2 (id=1568): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000bc0)={0x94, r1, 0x1, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME={0x6c, 0x33, @beacon={{{}, {0xde1}, @broadcast, @device_a, @initial, {0x0, 0x200}}, 0x8000003, @random=0x1, 0x1, @void, @val={0x1, 0x4, [{0x36}, {0x30}, {0x1b, 0x1}, {0x5}]}, @val={0x3, 0x1, 0xc}, @void, @val={0x6, 0x2, 0x7}, @val={0x5, 0x3, {0x19, 0x9a, 0x40}}, @val={0x25, 0x3, {0x0, 0x68, 0x7d}}, @val={0x2a, 0x1}, @val={0x3c, 0x4, {0x0, 0x7, 0xb, 0x5}}, @val={0x2d, 0x1a, {0x2, 0x0, 0x3, 0x0, {0xffffffffffffffff, 0xf34, 0x0, 0x5, 0x0, 0x1, 0x1, 0x3}, 0x7, 0x6, 0x8}}, @val={0x72, 0x6}, @void, @void}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0xa, 0xcd, [0x400, 0x2, 0x7]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000080) 1.429385092s ago: executing program 1 (id=1569): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(&(0x7f00000000c0)=[{r0, 0x60}], 0x1, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB="b8c3256cfb8e05b5ab25966a971473d0bf8f9e82"], 0x7) getpid() openat$cgroup(0xffffffffffffffff, &(0x7f00000004c0)='syz1\x00', 0x200002, 0x0) 1.412297242s ago: executing program 2 (id=1570): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYBLOB, @ANYRES32=r1], 0x40}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x30, 0x10, 0x439, 0xfffffffa, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @gre={{0x8}, {0x4}}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40080d5}, 0x0) 1.411151492s ago: executing program 0 (id=1571): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000e40)=@raw={'raw\x00', 0x3c1, 0x3, 0x4c0, 0x0, 0x18c, 0x203, 0x8000000, 0x19030000, 0x3f0, 0x2e0, 0x2e0, 0x3f0, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {}, {}, {0xfffe}, {}, {}, {}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x520) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="2400000020000103000000000000000002000008"], 0x24}}, 0x44004) 1.380557152s ago: executing program 2 (id=1572): r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x5c, r0, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x34, 0x8, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x4}, @WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x404c844}, 0x40000) 1.316373833s ago: executing program 2 (id=1573): r0 = socket(0x10, 0x3, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r1, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001d00)=ANY=[], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r2, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) syz_genetlink_get_family_id$nl80211(0x0, r0) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xaae7f93dc09ae4e3}, 0x4810) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x3f) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r4, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000040)=0x20000, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000400)={'dummy0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000340)={'dummy0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)=ANY=[], 0x50) r10 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x4d8, 0xc002, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r10, 0x0, 0x0) syz_usb_control_io(r10, &(0x7f0000000100)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r8}}, 0x24}, 0x1, 0x0, 0x0, 0x4004091}, 0x0) 1.316098183s ago: executing program 5 (id=1574): ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000540)=@bridge_getvlan={0x18, 0x72, 0x301, 0x4000000}, 0x18}, 0x1, 0xf00}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x3}) bind$802154_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0302}}}, 0x14) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x3}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 0s ago: executing program 4 (id=1575): r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00', 0x19, 0x0, 0xc0, [0x200000000140, 0x0, 0x0, 0x200000000170, 0x2000000001a0], 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000100000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000"]}, 0x138) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e086dd200000006006000aac14140ce0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) kernel console output (not intermixed with test programs): in process `syz.2.79'. [ 48.966803][ T4680] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.968447][ T4680] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.969835][ T4680] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.971287][ T4680] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.617998][ T4750] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.619280][ T4750] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.681852][ T4755] netlink: 60 bytes leftover after parsing attributes in process `syz.1.94'. [ 52.011070][ T4777] No such timeout policy "syz1" [ 52.044640][ T4777] loop2: detected capacity change from 0 to 1024 [ 52.061335][ T4777] EXT4-fs: Ignoring removed nobh option [ 52.070430][ T4777] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 52.155485][ T4777] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 52.176009][ T4777] EXT4-fs error (device loop2): ext4_lookup:1858: inode #15: comm syz.2.101: inode has both inline data and extents flags [ 52.183488][ T4777] EXT4-fs (loop2): Remounting filesystem read-only [ 52.192459][ T4750] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 52.212304][ T4750] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 53.261108][ T4750] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.262651][ T4750] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.264008][ T4750] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.279655][ T4750] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.344159][ T4329] EXT4-fs (loop2): unmounting filesystem. [ 53.731565][ T4807] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.751624][ T4807] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 53.754108][ T4807] netlink: 4 bytes leftover after parsing attributes in process `syz.1.113'. [ 53.764834][ T4807] device macvtap1 entered promiscuous mode [ 53.765866][ T4807] device dummy0 entered promiscuous mode [ 53.781233][ T4807] netlink: 4 bytes leftover after parsing attributes in process `syz.1.113'. [ 53.788467][ T4807] device dummy0 left promiscuous mode [ 55.584511][ T4848] tmpfs: Unknown parameter 'quota' [ 55.629089][ T4848] overlayfs: unrecognized mount option "verity=require:/" or missing value [ 55.681809][ T4844] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.683186][ T4844] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.143916][ T4844] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 56.158906][ T4844] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 56.685338][ T4884] trusted_key: encrypted_key: insufficient parameters specified [ 56.746047][ T4844] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.748212][ T4844] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.749650][ T4844] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.751083][ T4844] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.084323][ T4911] 9pnet_virtio: no channels available for device syz [ 57.319223][ T4922] trusted_key: encrypted_key: insufficient parameters specified [ 57.479262][ T4932] tipc: Started in network mode [ 57.480314][ T4932] tipc: Node identity 9681dad02906, cluster identity 4711 [ 57.482343][ T4932] tipc: Enabled bearer , priority 0 [ 57.485587][ T4931] tipc: Resetting bearer [ 58.148828][ T4952] binder: 4951:4952 unknown command 0 [ 58.149872][ T4952] binder: 4951:4952 ioctl c0306201 20000080 returned -22 [ 58.153100][ T4952] binder: tried to use weak ref as strong ref [ 58.154440][ T4952] binder: 4951:4952 Acquire 1 refcount change on invalid ref 0 ret -22 [ 58.156048][ T4952] binder: 4951:4952 got transaction to invalid handle, 1 [ 58.160159][ T4952] binder: 4952:4951 cannot find target node [ 58.161308][ T4952] binder: 4951:4952 transaction call to 0:0 failed 8/29201/-22, size 104-24 line 3045 [ 58.163329][ T7] binder: undelivered TRANSACTION_ERROR: 29201 [ 58.597809][ T7] tipc: Node number set to 3213351632 [ 58.797258][ T4332] Bluetooth: hci4: command 0x0405 tx timeout [ 59.122195][ T4972] No such timeout policy "syz1" [ 59.126866][ T4972] loop3: detected capacity change from 0 to 1024 [ 59.128256][ T4972] EXT4-fs: Ignoring removed nobh option [ 59.134427][ T4972] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 59.173540][ T4972] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 59.176293][ T4972] EXT4-fs error (device loop3): ext4_lookup:1858: inode #15: comm syz.3.171: inode has both inline data and extents flags [ 59.179581][ T4972] EXT4-fs (loop3): Remounting filesystem read-only [ 59.666584][ T4320] EXT4-fs (loop3): unmounting filesystem. [ 59.880210][ T4985] binder: 4984:4985 unknown command 0 [ 59.881277][ T4985] binder: 4984:4985 ioctl c0306201 20000080 returned -22 [ 59.883136][ T4985] binder: 4984:4985 tried to acquire reference to desc 0, got 1 instead [ 59.885058][ T4985] binder_alloc: 4984: binder_alloc_buf, no vma [ 59.886501][ T4985] binder: cannot allocate buffer: vma cleared, target dead or dying [ 59.886529][ T4985] binder: 4984:4985 transaction call to 4984:0 failed 13/29189/-3, size 104-24 line 3230 [ 59.895141][ T4524] binder: undelivered TRANSACTION_ERROR: 29189 [ 62.806309][ T5019] mmap: syz.3.187 (5019) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 64.479628][ T112] cfg80211: failed to load regulatory.db [ 64.481601][ T2062] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.482591][ T2062] ieee802154 phy1 wpan1: encryption failed: -22 [ 68.229295][ T4931] tipc: Disabling bearer [ 68.286956][ T5048] binder: 5047:5048 tried to acquire reference to desc 0, got 1 instead [ 68.345301][ T5057] binder: cannot allocate buffer [ 68.345327][ T5057] binder: 5047:5057 transaction call to 5047:0 failed 18/29201/-22, size 0-24 line 3230 [ 68.350581][ T4524] binder: undelivered TRANSACTION_ERROR: 29201 [ 68.556396][ T5078] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.558779][ T5078] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 68.570585][ T5078] random: crng reseeded on system resumption [ 69.191637][ T5094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 69.193082][ T5094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 69.512240][ T5107] binder: 5106:5107 unknown command 0 [ 69.513391][ T5107] binder: 5106:5107 ioctl c0306201 20000080 returned -22 [ 69.515520][ T5107] binder: BINDER_SET_CONTEXT_MGR already set [ 69.517112][ T5107] binder: 5106:5107 ioctl 4018620d 20000040 returned -16 [ 70.229386][ T5131] binder: 5125:5131 ioctl 0 20000040 returned -22 [ 70.619144][ T5151] raw_sendmsg: syz.1.233 forgot to set AF_INET. Fix it! [ 70.796662][ T5170] random: crng reseeded on system resumption [ 72.109843][ T5239] No such timeout policy "syz1" [ 72.133956][ T5239] loop3: detected capacity change from 0 to 1024 [ 72.137072][ T5239] EXT4-fs: Ignoring removed nobh option [ 72.194908][ T5239] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 72.382208][ T5239] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 72.386921][ T5234] EXT4-fs error (device loop3): ext4_lookup:1858: inode #15: comm syz.3.253: inode has both inline data and extents flags [ 72.389311][ T5234] EXT4-fs (loop3): Remounting filesystem read-only [ 72.805619][ T4320] EXT4-fs (loop3): unmounting filesystem. [ 72.926825][ T5301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.929592][ T5301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.137028][ T5301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.138733][ T5301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.313347][ T5324] tipc: Started in network mode [ 73.314338][ T5324] tipc: Node identity ac1414aa, cluster identity 4711 [ 73.317007][ T5324] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 73.321623][ T5324] tipc: Enabled bearer , priority 10 [ 73.447580][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 73.548687][ T5330] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 73.549780][ T5330] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 73.558739][ T5330] vhci_hcd vhci_hcd.0: Device attached [ 73.587319][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 73.727336][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 73.837297][ T4868] usb 8-1: new low-speed USB device number 2 using vhci_hcd [ 73.867712][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 73.950969][ T5338] input: syz1 as /devices/virtual/input/input2 [ 74.007286][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 74.147288][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 74.172306][ T5352] tipc: Started in network mode [ 74.176243][ T5352] tipc: Node identity 62a8bcf0e6c6, cluster identity 4711 [ 74.182776][ T5352] tipc: Enabled bearer , priority 0 [ 74.187092][ T5352] device syzkaller0 entered promiscuous mode [ 74.210838][ T5331] vhci_hcd: connection reset by peer [ 74.212810][ T274] vhci_hcd: stop threads [ 74.213776][ T274] vhci_hcd: release socket [ 74.214743][ T274] vhci_hcd: disconnect device [ 74.215649][ T5338] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 74.216685][ T5338] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 74.218747][ T5338] vhci_hcd vhci_hcd.0: Device attached [ 74.220138][ T5355] vhci_hcd: connection closed [ 74.220364][ T274] vhci_hcd: stop threads [ 74.222445][ T274] vhci_hcd: release socket [ 74.224744][ T274] vhci_hcd: disconnect device [ 74.245608][ T5352] tipc: Resetting bearer [ 74.251236][ T5351] tipc: Resetting bearer [ 74.287307][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 74.317649][ T5351] tipc: Disabling bearer [ 74.427295][ T112] tipc: Node number set to 2886997162 [ 74.567316][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 74.637331][ T4374] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 74.779876][ T5367] tipc: Enabling of bearer rejected, already enabled [ 74.819870][ T4374] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 74.822038][ T4374] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 74.823619][ T4374] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.826838][ T4374] usb 1-1: config 0 descriptor?? [ 74.837280][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 74.922451][ T5379] loop8: detected capacity change from 0 to 8 [ 74.929348][ T5379] Dev loop8: unable to read RDB block 8 [ 74.930410][ T5379] loop8: unable to read partition table [ 74.931367][ T5379] loop8: partition table beyond EOD, truncated [ 74.932404][ T5379] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 75.035421][ T4374] usbhid 1-1:0.0: can't add hid device: -71 [ 75.036795][ T4374] usbhid: probe of 1-1:0.0 failed with error -71 [ 75.042114][ T4374] usb 1-1: USB disconnect, device number 2 [ 75.123546][ T5393] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.125027][ T5393] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 75.293493][ T5400] tipc: Started in network mode [ 75.294336][ T5400] tipc: Node identity ac1414aa, cluster identity 4711 [ 75.295527][ T5400] tipc: Enabled bearer , priority 10 [ 75.316255][ T5402] binder: 5401:5402 tried to acquire reference to desc 0, got 1 instead [ 75.365804][ T5406] loop8: detected capacity change from 0 to 8 [ 75.368984][ T5406] Dev loop8: unable to read RDB block 8 [ 75.371769][ T5406] loop8: unable to read partition table [ 75.374226][ T5406] loop8: partition table beyond EOD, truncated [ 75.377885][ T5406] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 75.419114][ T5412] syz.2.299 uses obsolete (PF_INET,SOCK_PACKET) [ 75.507803][ T4374] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 75.593220][ T5425] tipc: Enabled bearer , priority 10 [ 75.619492][ T5428] binder: tried to use weak ref as strong ref [ 75.620684][ T5428] binder: 5427:5428 Acquire 1 refcount change on invalid ref 0 ret -22 [ 75.622245][ T5428] binder: 5427:5428 Acquire 1 refcount change on invalid ref 1 ret -22 [ 75.669760][ T5434] loop8: detected capacity change from 0 to 8 [ 75.672170][ T5434] Dev loop8: unable to read RDB block 8 [ 75.673026][ T5434] loop8: unable to read partition table [ 75.673945][ T5434] loop8: partition table beyond EOD, truncated [ 75.681154][ T5434] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 75.687614][ T4374] usb 1-1: Using ep0 maxpacket: 32 [ 75.691552][ T4374] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 75.693993][ T4374] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 75.696489][ T4374] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.701487][ T4374] usb 1-1: config 0 descriptor?? [ 75.708256][ T4374] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 75.714340][ T4374] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 75.777983][ T5440] netlink: 20 bytes leftover after parsing attributes in process `syz.2.311'. [ 75.822180][ T5443] device lo entered promiscuous mode [ 75.824140][ T5443] device tunl0 entered promiscuous mode [ 75.825568][ T5443] device gre0 entered promiscuous mode [ 75.830981][ T5443] device gretap0 entered promiscuous mode [ 75.833691][ T5443] device erspan0 entered promiscuous mode [ 75.835284][ T5443] device ip_vti0 entered promiscuous mode [ 75.836712][ T5443] device ip6_vti0 entered promiscuous mode [ 75.851095][ T5443] device sit0 entered promiscuous mode [ 75.858914][ T5443] device ip6tnl0 entered promiscuous mode [ 75.871541][ T5443] device ip6gre0 entered promiscuous mode [ 75.877856][ T5443] device syz_tun entered promiscuous mode [ 75.886496][ T5443] device ip6gretap0 entered promiscuous mode [ 75.892169][ T5443] device bridge0 entered promiscuous mode [ 75.937826][ T7] usb 1-1: USB disconnect, device number 3 [ 75.940332][ T7] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 75.955793][ T5443] device vcan0 entered promiscuous mode [ 75.957143][ T5443] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 75.980439][ T5443] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 75.981757][ T5443] device bond0 entered promiscuous mode [ 75.982551][ T5443] device bond_slave_0 entered promiscuous mode [ 75.991152][ T5443] device bond_slave_1 entered promiscuous mode [ 75.994686][ T5443] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.996271][ T5443] device team0 entered promiscuous mode [ 76.005339][ T5443] device team_slave_0 entered promiscuous mode [ 76.006659][ T5443] device team_slave_1 entered promiscuous mode [ 76.015644][ T5443] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.018269][ T5451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.020088][ T5451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.025856][ T5443] device dummy0 entered promiscuous mode [ 76.033604][ T5443] device nlmon0 entered promiscuous mode [ 76.077882][ T5443] device caif0 entered promiscuous mode [ 76.153686][ T5359] ldusb: No device or device unplugged -19 [ 76.155435][ T5446] device wireguard0 entered promiscuous mode [ 76.297274][ T4398] tipc: Node number set to 2886997162 [ 76.622838][ T5457] tipc: Enabling of bearer rejected, already enabled [ 76.776987][ T5465] netlink: 56 bytes leftover after parsing attributes in process `syz.1.319'. [ 77.262083][ T5475] loop8: detected capacity change from 0 to 8 [ 77.278690][ T5478] binder: tried to use weak ref as strong ref [ 77.280304][ T5478] binder: 5477:5478 Acquire 1 refcount change on invalid ref 0 ret -22 [ 77.281617][ T5478] binder: 5477:5478 Acquire 1 refcount change on invalid ref 1 ret -22 [ 77.282656][ T5475] Dev loop8: unable to read RDB block 8 [ 77.291721][ T5475] loop8: unable to read partition table [ 77.292840][ T5475] loop8: partition table beyond EOD, truncated [ 77.325676][ T5475] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 77.353823][ T5479] No such timeout policy "syz1" [ 77.359307][ T5479] loop0: detected capacity change from 0 to 1024 [ 77.360783][ T5479] EXT4-fs: Ignoring removed nobh option [ 77.363273][ T5479] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 77.384371][ T5479] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 77.388625][ T5479] EXT4-fs error (device loop0): ext4_lookup:1858: inode #15: comm syz.0.324: inode has both inline data and extents flags [ 77.390925][ T5479] EXT4-fs (loop0): Remounting filesystem read-only [ 77.451931][ T4325] EXT4-fs (loop0): unmounting filesystem. [ 77.464389][ T5492] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 77.465719][ T5492] vhci_hcd: invalid port number 96 [ 77.466513][ T5492] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 77.470302][ T5491] tipc: Started in network mode [ 77.471219][ T5491] tipc: Node identity ac1414aa, cluster identity 4711 [ 77.472686][ T5491] tipc: Enabled bearer , priority 10 [ 77.903633][ T5514] binder: tried to use weak ref as strong ref [ 77.904800][ T5514] binder: 5513:5514 Acquire 1 refcount change on invalid ref 0 ret -22 [ 77.906079][ T5514] binder: 5513:5514 Acquire 1 refcount change on invalid ref 1 ret -22 [ 78.041563][ T5517] netlink: 8 bytes leftover after parsing attributes in process `syz.4.336'. [ 78.150944][ T4332] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 78.152819][ T4332] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 78.154344][ T4332] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 78.156542][ T4332] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 78.158315][ T4332] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 78.159795][ T4332] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 78.317331][ C1] net_ratelimit: 25 callbacks suppressed [ 78.317344][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 78.317345][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 78.360867][ T5520] chnl_net:caif_netlink_parms(): no params data found [ 78.411569][ T5520] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.414000][ T5520] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.421801][ T5520] device bridge_slave_0 entered promiscuous mode [ 78.427537][ T5520] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.429942][ T5520] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.433393][ T5520] device bridge_slave_1 entered promiscuous mode [ 78.442740][ T5520] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.450726][ T5520] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.457344][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 78.473150][ T5520] team0: Port device team_slave_0 added [ 78.477496][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 78.487704][ T5520] team0: Port device team_slave_1 added [ 78.534881][ T5520] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.535920][ T5520] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.564919][ T5530] Zero length message leads to an empty skb [ 78.568722][ T5520] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.574017][ T5530] binder_alloc: 5529: binder_alloc_buf, no vma [ 78.575061][ T5530] binder: cannot allocate buffer: vma cleared, target dead or dying [ 78.575099][ T5530] binder: 5529:5530 transaction call to 5529:0 failed 35/29189/-3, size 0-0 line 3230 [ 78.583124][ T4374] binder: undelivered TRANSACTION_ERROR: 29189 [ 78.586718][ T5520] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.588192][ T5520] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.597741][ T4374] tipc: Node number set to 2886997162 [ 78.602924][ T5520] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.637335][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 78.662788][ T4616] tipc: Disabling bearer [ 78.664596][ T4616] tipc: Left network mode [ 78.715364][ T5520] device hsr_slave_0 entered promiscuous mode [ 78.737295][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 78.747529][ T5520] device hsr_slave_1 entered promiscuous mode [ 78.767285][ T5520] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.769106][ T5520] Cannot create hsr debugfs directory [ 78.957340][ T4868] vhci_hcd: vhci_device speed not set [ 79.007303][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 79.250251][ T5565] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 79.264300][ T5565] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 79.289168][ T5569] netlink: 12 bytes leftover after parsing attributes in process `syz.4.346'. [ 79.513898][ T5580] 9pnet_virtio: no channels available for device syz [ 79.517360][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 79.537369][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 79.600700][ T5590] binder: BINDER_SET_CONTEXT_MGR already set [ 79.601728][ T5590] binder: 5588:5590 ioctl 4018620d 20000040 returned -16 [ 79.610906][ T5590] binder: 5590:5588 cannot find target node [ 79.611933][ T5590] binder: 5588:5590 transaction call to 0:0 failed 40/29201/-22, size 0-0 line 3045 [ 79.614246][ T4398] binder: undelivered TRANSACTION_ERROR: 29201 [ 79.645936][ T5520] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 79.680767][ T5520] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 79.687327][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 79.940099][ T5602] tipc: Enabled bearer , priority 0 [ 79.941224][ T5520] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.028766][ T5520] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 80.078031][ T4327] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 80.079292][ T4327] Bluetooth: hci0: Injecting HCI hardware error event [ 80.080791][ T4324] Bluetooth: hci0: hardware error 0x00 [ 80.082310][ T5603] device syzkaller0 entered promiscuous mode [ 80.084426][ T5607] tipc: Enabling of bearer rejected, already enabled [ 80.238546][ T4327] Bluetooth: hci2: command 0x0409 tx timeout [ 80.362053][ T5615] tipc: Resetting bearer [ 80.442413][ T5592] tipc: Resetting bearer [ 80.540293][ T5592] tipc: Disabling bearer [ 80.836195][ T5658] No such timeout policy "syz1" [ 80.841443][ T5658] loop3: detected capacity change from 0 to 1024 [ 80.842941][ T5658] EXT4-fs: Ignoring removed nobh option [ 80.845081][ T5658] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 80.936944][ T5658] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 80.941020][ T5658] EXT4-fs error (device loop3): ext4_lookup:1858: inode #15: comm syz.3.358: inode has both inline data and extents flags [ 80.943558][ T5658] EXT4-fs (loop3): Remounting filesystem read-only [ 80.985249][ T5520] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.994502][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 80.996353][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.000294][ T5520] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.003602][ T4520] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.005447][ T4520] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 81.007164][ T4520] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.008381][ T4520] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.070046][ T4520] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 81.073507][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.075009][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 81.082697][ T1663] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.083909][ T1663] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.094210][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 81.095908][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 81.313266][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 81.315081][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 81.316712][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 81.318508][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 81.322396][ T5666] netlink: 4 bytes leftover after parsing attributes in process `syz.0.360'. [ 81.364150][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 81.365888][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 81.367485][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 81.412176][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 81.416761][ T1663] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 81.421150][ T4616] device hsr_slave_0 left promiscuous mode [ 81.458615][ T4616] device hsr_slave_1 left promiscuous mode [ 81.522282][ T4320] EXT4-fs (loop3): unmounting filesystem. [ 81.557435][ T4616] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 81.581293][ T4616] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 81.583969][ T4616] device bridge_slave_1 left promiscuous mode [ 81.585817][ T4616] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.628382][ T4616] device bridge_slave_0 left promiscuous mode [ 81.629474][ T4616] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.631921][ T5673] binder: BINDER_SET_CONTEXT_MGR already set [ 81.632882][ T5673] binder: 5672:5673 ioctl 4018620d 20000040 returned -16 [ 81.634197][ T5673] binder_user_error: 7 callbacks suppressed [ 81.634203][ T5673] binder: tried to use weak ref as strong ref [ 81.636063][ T5673] binder: 5672:5673 Acquire 1 refcount change on invalid ref 0 ret -22 [ 81.658830][ T5673] binder: 5672:5673 got transaction to invalid handle, 1 [ 81.660124][ T5673] binder: 5673:5672 cannot find target node [ 81.661065][ T5673] binder: 5672:5673 transaction call to 0:0 failed 43/29201/-22, size 0-0 line 3045 [ 81.670228][ T4524] binder: undelivered TRANSACTION_ERROR: 29201 [ 81.719906][ T5677] netlink: 92 bytes leftover after parsing attributes in process `syz.0.361'. [ 82.317375][ T4327] Bluetooth: hci2: command 0x041b tx timeout [ 82.318513][ T4324] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 82.608346][ T5699] No such timeout policy "syz1" [ 82.613003][ T5699] loop0: detected capacity change from 0 to 1024 [ 82.614513][ T5699] EXT4-fs: Ignoring removed nobh option [ 82.622252][ T5699] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 82.661982][ T5699] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 82.664583][ T5699] EXT4-fs error (device loop0): ext4_lookup:1858: inode #15: comm syz.0.372: inode has both inline data and extents flags [ 82.667748][ T5699] EXT4-fs (loop0): Remounting filesystem read-only [ 83.310299][ T4325] EXT4-fs (loop0): unmounting filesystem. [ 83.429099][ T4616] team0 (unregistering): Port device team_slave_1 removed [ 83.608683][ T4616] team0 (unregistering): Port device team_slave_0 removed [ 83.677315][ C0] net_ratelimit: 9 callbacks suppressed [ 83.677328][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 83.679457][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 83.768426][ T4616] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 83.837274][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 83.968756][ T4616] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 84.269644][ T5707] 9pnet_virtio: no channels available for device syz [ 84.397351][ T4324] Bluetooth: hci2: command 0x040f tx timeout [ 84.717307][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 84.718549][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 84.887261][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 85.757304][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 85.758656][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 85.917273][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 86.318276][ T4616] bond0 (unregistering): Released all slaves [ 86.477267][ T4327] Bluetooth: hci2: command 0x0419 tx timeout [ 86.519943][ T5520] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 86.527813][ T5680] tipc: Enabling of bearer rejected, already enabled [ 86.575708][ T5717] input: syz1 as /devices/virtual/input/input5 [ 86.578962][ T4324] Bluetooth: hci4: link tx timeout [ 86.579886][ T4324] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 86.667102][ T4520] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 86.668635][ T4520] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 86.674565][ T5520] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.700101][ T5732] binder: BINDER_SET_CONTEXT_MGR already set [ 86.702207][ T5281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 86.702700][ T5732] binder: 5731:5732 ioctl 4018620d 20000100 returned -16 [ 86.704143][ T5281] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 86.724126][ T5520] device veth0_vlan entered promiscuous mode [ 86.733078][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 86.735080][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 86.736598][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 86.741728][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 86.747572][ T5520] device veth1_vlan entered promiscuous mode [ 86.758294][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.759539][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.761605][ T5281] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 86.763134][ T5281] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 86.764594][ T5281] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 86.776825][ T4520] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 86.778737][ T4520] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 86.780501][ T5520] device veth0_macvtap entered promiscuous mode [ 86.797325][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 86.863354][ T5520] device veth1_macvtap entered promiscuous mode [ 86.870404][ T5520] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.872370][ T5520] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.874854][ T5520] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.876294][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 86.880412][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 86.881946][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 86.883994][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 86.887924][ T5520] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.889697][ T5520] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.891904][ T5520] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.894591][ T4520] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 86.896346][ T4520] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 86.899611][ T5520] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.901033][ T5520] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.902313][ T5520] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.903851][ T5520] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.376396][ T5742] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 87.377650][ T5742] vhci_hcd: invalid port number 96 [ 87.378410][ T5742] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 87.691027][ T5281] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.692452][ T5281] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.693674][ T274] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.694925][ T274] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.707630][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 87.709360][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 87.732964][ T5748] tipc: Enabling of bearer rejected, already enabled [ 87.896126][ T5768] binder: BINDER_SET_CONTEXT_MGR already set [ 87.907660][ T5768] binder: 5767:5768 ioctl 4018620d 20000100 returned -16 [ 88.015890][ T5778] input: syz1 as /devices/virtual/input/input6 [ 88.048438][ T5780] tipc: Started in network mode [ 88.049418][ T5780] tipc: Node identity ac1414aa, cluster identity 4711 [ 88.247787][ T5781] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 88.248993][ T5781] vhci_hcd: invalid port number 96 [ 88.249792][ T5781] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 88.394838][ T5780] tipc: Enabled bearer , priority 10 [ 88.559469][ T5787] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 88.638050][ T4327] Bluetooth: hci4: command 0x0406 tx timeout [ 88.752546][ T5795] Bluetooth: MGMT ver 1.22 [ 88.874350][ T5803] binder: 5801:5803 Acquire 1 refcount change on invalid ref 1 ret -22 [ 88.877284][ C0] net_ratelimit: 6 callbacks suppressed [ 88.877294][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 88.879354][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 88.948014][ T5807] MPTCP: addr_signal error, rm_addr=4 [ 88.975344][ T5810] tipc: Enabling of bearer rejected, already enabled [ 89.035246][ T5816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 89.036675][ T5816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 89.047308][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 89.054322][ T5817] input: syz1 as /devices/virtual/input/input7 [ 89.060610][ T4327] Bluetooth: hci1: link tx timeout [ 89.061524][ T4327] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 89.507245][ T4375] tipc: Node number set to 2886997162 [ 89.917480][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 89.918816][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 90.046551][ T5837] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 90.047820][ T5837] vhci_hcd: invalid port number 96 [ 90.048662][ T5837] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 90.087382][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 90.792079][ T5858] tipc: Enabling of bearer rejected, already enabled [ 90.818150][ T5860] MPTCP: addr_signal error, rm_addr=4 [ 90.957321][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 90.959173][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 90.989923][ T5868] input: syz1 as /devices/virtual/input/input8 [ 91.117288][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 91.118748][ T4324] Bluetooth: hci1: command 0x0406 tx timeout [ 91.315296][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.316669][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.321069][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 91.800528][ T5888] devtmpfs: Too few inodes for current use [ 91.870233][ T5892] tipc: Enabling of bearer rejected, already enabled [ 91.990649][ T5898] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 91.994137][ T5898] vhci_hcd: invalid port number 96 [ 91.996746][ T5898] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 91.997629][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 92.108543][ T5897] binder: 5894:5897 ioctl 0 20000040 returned -22 [ 92.328077][ T5906] input: syz1 as /devices/virtual/input/input9 [ 92.342654][ T4324] Bluetooth: hci3: link tx timeout [ 92.343645][ T4324] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 92.528612][ T5911] block nbd3: shutting down sockets [ 93.038488][ T5922] tipc: Enabling of bearer rejected, already enabled [ 93.814507][ T5950] input: syz1 as /devices/virtual/input/input10 [ 93.830347][ T4327] Bluetooth: hci1: link tx timeout [ 93.831227][ T4327] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 94.057026][ T5953] tipc: Enabled bearer , priority 10 [ 94.077340][ C0] net_ratelimit: 5 callbacks suppressed [ 94.077350][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 94.079444][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 94.237325][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 94.364094][ T5970] device syzkaller0 entered promiscuous mode [ 94.390538][ T5970] netlink: 76 bytes leftover after parsing attributes in process `syz.2.465'. [ 94.397299][ T4327] Bluetooth: hci3: command 0x0406 tx timeout [ 94.405242][ T5974] futex_wake_op: syz.1.466 tries to shift op by 32; fix this program [ 94.433359][ T5975] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 94.438366][ T5975] vhci_hcd: invalid port number 96 [ 94.439210][ T5975] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 94.474883][ T5978] netlink: 332 bytes leftover after parsing attributes in process `syz.1.466'. [ 94.477377][ T5978] netlink: 'syz.1.466': attribute type 9 has an invalid length. [ 94.485130][ T5978] netlink: 108 bytes leftover after parsing attributes in process `syz.1.466'. [ 94.489555][ T5978] netlink: 32 bytes leftover after parsing attributes in process `syz.1.466'. [ 94.514044][ T5978] netlink: 'syz.1.466': attribute type 4 has an invalid length. [ 95.117304][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 95.118621][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 95.177258][ T4870] tipc: Node number set to 2221849840 [ 95.277319][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 95.286443][ T5992] input: syz1 as /devices/virtual/input/input11 [ 95.670085][ T6001] device syzkaller1 entered promiscuous mode [ 96.050735][ T6022] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 96.052014][ T6022] vhci_hcd: invalid port number 96 [ 96.052863][ T6022] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 96.157305][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 96.158555][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 96.295057][ T6027] input: syz1 as /devices/virtual/input/input12 [ 96.327287][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 96.402418][ T6031] netlink: 'syz.1.486': attribute type 12 has an invalid length. [ 97.197308][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 97.698621][ T6081] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 97.699866][ T6081] vhci_hcd: invalid port number 96 [ 97.700723][ T6081] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 97.871167][ T6084] process 'syz.1.506' launched './file1' with NULL argv: empty string added [ 98.069971][ T6086] netlink: 'syz.0.507': attribute type 7 has an invalid length. [ 98.581767][ T6107] Driver unsupported XDP return value 0 on prog (id 6) dev N/A, expect packet loss! [ 99.139301][ T6115] binder: 6114:6115 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 99.288108][ C0] net_ratelimit: 5 callbacks suppressed [ 99.288121][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 99.290029][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 99.336752][ T6131] input: syz1 as /devices/virtual/input/input13 [ 99.352010][ T4327] Bluetooth: hci4: link tx timeout [ 99.352838][ T4327] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 99.437309][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 99.606635][ T6139] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.610467][ T6139] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.959331][ T6139] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.962626][ T6139] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 100.187173][ T6148] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 100.188424][ T6148] vhci_hcd: invalid port number 96 [ 100.189224][ T6148] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 100.317538][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 100.318695][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 100.423473][ T6161] autofs4:pid:6161:autofs_fill_super: called with bogus options [ 100.466757][ T6163] input: syz1 as /devices/virtual/input/input14 [ 100.477330][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 100.897175][ T6182] tipc: Enabled bearer , priority 0 [ 100.904430][ T6182] device syzkaller0 entered promiscuous mode [ 100.968669][ T6183] tipc: Resetting bearer [ 100.974523][ T6181] tipc: Resetting bearer [ 101.027715][ T6181] tipc: Disabling bearer [ 101.357487][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 101.357554][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 101.517323][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 101.733977][ T6220] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 101.735320][ T6220] vhci_hcd: invalid port number 96 [ 101.736102][ T6220] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 101.773501][ T6223] tipc: Enabled bearer , priority 0 [ 101.775032][ T6223] device syzkaller0 entered promiscuous mode [ 101.917301][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 101.931711][ T6227] tipc: Resetting bearer [ 101.978186][ T6222] tipc: Resetting bearer [ 102.049016][ T6222] tipc: Disabling bearer [ 102.300620][ T6247] binder: 6246:6247 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 102.892181][ T6266] tipc: Enabled bearer , priority 0 [ 102.899761][ T6266] device syzkaller0 entered promiscuous mode [ 102.968759][ T6268] tipc: Resetting bearer [ 102.976494][ T6265] tipc: Resetting bearer [ 103.104140][ T6265] tipc: Disabling bearer [ 103.151053][ T6277] No such timeout policy "syz1" [ 103.156358][ T6277] loop4: detected capacity change from 0 to 1024 [ 103.157839][ T6277] EXT4-fs: Ignoring removed nobh option [ 103.160999][ T6277] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 103.203981][ T6277] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 103.206740][ T6277] EXT4-fs error (device loop4): ext4_lookup:1858: inode #15: comm syz.4.578: inode has both inline data and extents flags [ 103.212294][ T6277] EXT4-fs (loop4): Remounting filesystem read-only [ 103.513125][ T6296] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 103.537638][ T6296] vhci_hcd: invalid port number 96 [ 103.545944][ T6296] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 104.477278][ C1] net_ratelimit: 9 callbacks suppressed [ 104.477291][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 104.477332][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 104.637293][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 104.822362][ T4333] EXT4-fs (loop4): unmounting filesystem. [ 105.037260][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 105.236770][ T6312] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 105.517287][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 105.517309][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 105.518512][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 105.677313][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 105.823524][ T6331] tipc: Enabled bearer , priority 0 [ 105.831772][ T6331] device syzkaller0 entered promiscuous mode [ 105.875445][ T6331] tipc: Resetting bearer [ 105.900904][ T6330] tipc: Resetting bearer [ 105.929447][ T6330] tipc: Disabling bearer [ 106.077444][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 106.352328][ T6354] tipc: Enabling of bearer rejected, already enabled [ 106.557294][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 106.833347][ T6360] binder: 6356:6360 tried to acquire reference to desc 0, got 1 instead [ 106.834685][ T6360] binder: 6356:6360 got transaction with unaligned buffers size, 31 [ 106.835958][ T6360] binder: 6356:6360 transaction async to 6356:0 failed 57/29201/-22, size 0-0 line 3286 [ 107.152532][ T6367] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 107.162412][ T6367] vhci_hcd: invalid port number 96 [ 107.189350][ T6367] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 107.242172][ T6369] tipc: Enabled bearer , priority 0 [ 107.248298][ T6369] device syzkaller0 entered promiscuous mode [ 107.273293][ T4868] binder: undelivered TRANSACTION_ERROR: 29201 [ 107.283750][ T6369] tipc: Resetting bearer [ 107.324134][ T6368] tipc: Resetting bearer [ 107.448406][ T6368] tipc: Disabling bearer [ 108.031791][ T6392] ªªªªª»: renamed from hsr0 [ 108.369149][ T6400] autofs4:pid:6400:autofs_fill_super: called with bogus options [ 109.062116][ T6415] tipc: Enabled bearer , priority 0 [ 109.063889][ T6415] device syzkaller0 entered promiscuous mode [ 109.075645][ T6415] tipc: Resetting bearer [ 109.078414][ T6414] tipc: Resetting bearer [ 109.118119][ T6414] tipc: Disabling bearer [ 109.196930][ T6424] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 109.203384][ T6424] vhci_hcd: invalid port number 96 [ 109.204403][ T6424] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 109.656070][ T6437] autofs4:pid:6437:autofs_fill_super: called with bogus options [ 109.677292][ C0] net_ratelimit: 14 callbacks suppressed [ 109.677304][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 109.677314][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 109.678447][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 109.837309][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 110.113354][ T6445] lo speed is unknown, defaulting to 1000 [ 110.115145][ T6445] lo speed is unknown, defaulting to 1000 [ 110.124039][ T6445] lo speed is unknown, defaulting to 1000 [ 110.136072][ T6445] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 110.140730][ T6445] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 110.167682][ T6445] lo speed is unknown, defaulting to 1000 [ 110.169345][ T6445] lo speed is unknown, defaulting to 1000 [ 110.170615][ T6445] lo speed is unknown, defaulting to 1000 [ 110.174258][ T6445] lo speed is unknown, defaulting to 1000 [ 110.180928][ T6445] lo speed is unknown, defaulting to 1000 [ 110.237284][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 110.527597][ T6466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 110.532304][ T6466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 110.587922][ T6468] autofs4:pid:6468:autofs_fill_super: called with bogus options [ 110.717304][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 110.717308][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 110.717394][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 110.877302][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 111.098490][ T6477] binder: 6476:6477 got transaction to invalid handle, 1 [ 111.100897][ T6477] binder: 6477:6476 cannot find target node [ 111.101838][ T6477] binder: 6476:6477 transaction call to 0:0 failed 61/29201/-22, size 104-24 line 3045 [ 111.109637][ T4869] binder: undelivered TRANSACTION_ERROR: 29201 [ 111.277302][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 111.452215][ T6494] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 111.454688][ T6494] vhci_hcd: invalid port number 96 [ 111.455529][ T6494] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 111.510043][ T6498] autofs4:pid:6498:autofs_fill_super: called with bogus options [ 111.667075][ T6505] binder: 6504:6505 got transaction to invalid handle, 1 [ 111.671834][ T6505] binder: 6505:6504 cannot find target node [ 111.672745][ T6505] binder: 6504:6505 transaction call to 0:0 failed 65/29201/-22, size 104-24 line 3045 [ 111.682275][ T4375] binder: undelivered TRANSACTION_ERROR: 29201 [ 112.185904][ T6519] No such timeout policy "syz1" [ 112.254289][ T6519] loop2: detected capacity change from 0 to 1024 [ 112.262476][ T6519] EXT4-fs: Ignoring removed nobh option [ 112.627706][ T6519] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 112.692678][ T6519] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 112.697483][ T6517] EXT4-fs error (device loop2): ext4_lookup:1858: inode #15: comm syz.2.662: inode has both inline data and extents flags [ 112.702337][ T6517] EXT4-fs (loop2): Remounting filesystem read-only [ 112.787058][ T6533] autofs4:pid:6533:autofs_fill_super: called with bogus options [ 112.880368][ T4329] EXT4-fs (loop2): unmounting filesystem. [ 112.893631][ T6544] binder: 6542:6544 got transaction to invalid handle, 1 [ 112.896887][ T6544] binder: 6544:6542 cannot find target node [ 112.898011][ T6544] binder: 6542:6544 transaction call to 0:0 failed 69/29201/-22, size 104-24 line 3045 [ 112.899866][ T4869] binder: undelivered TRANSACTION_ERROR: 29201 [ 113.420513][ T6567] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 113.421704][ T6567] vhci_hcd: invalid port number 96 [ 113.422433][ T6567] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 114.193426][ T6572] autofs4:pid:6572:autofs_fill_super: called with bogus options [ 114.423146][ T6584] No such timeout policy "syz1" [ 114.445170][ T6584] loop0: detected capacity change from 0 to 1024 [ 114.448825][ T6584] EXT4-fs: Ignoring removed nobh option [ 114.455607][ T6584] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 114.638401][ T6584] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 114.643245][ T6582] EXT4-fs error (device loop0): ext4_lookup:1858: inode #15: comm syz.0.682: inode has both inline data and extents flags [ 114.645704][ T6582] EXT4-fs (loop0): Remounting filesystem read-only [ 114.877315][ C0] net_ratelimit: 15 callbacks suppressed [ 114.877329][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 114.879447][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 114.887301][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 115.037394][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 115.119667][ T4325] EXT4-fs (loop0): unmounting filesystem. [ 115.142230][ T6589] binder: 6588:6589 got transaction to invalid handle, 1 [ 115.143325][ T6589] binder: 6589:6588 cannot find target node [ 115.144435][ T6589] binder: 6588:6589 transaction call to 0:0 failed 73/29201/-22, size 104-24 line 3045 [ 115.146234][ T4375] binder: undelivered TRANSACTION_ERROR: 29201 [ 115.437283][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 115.917282][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 115.917306][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 115.919495][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 116.077277][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 116.477255][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 120.077255][ C1] net_ratelimit: 15 callbacks suppressed [ 120.077269][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 120.077282][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 120.080428][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 120.247258][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 120.637258][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 121.117247][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 121.117300][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 121.119487][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 121.277287][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 121.677265][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 124.511569][ T6565] netlink: 8 bytes leftover after parsing attributes in process `syz.2.676'. [ 124.516717][ T6591] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 124.646699][ T6607] lo speed is unknown, defaulting to 1000 [ 125.192939][ T6623] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 125.196994][ T6623] vhci_hcd: invalid port number 96 [ 125.202642][ T6623] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 125.277358][ C0] net_ratelimit: 15 callbacks suppressed [ 125.277372][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 125.279325][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 125.287254][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 125.412994][ T6626] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.420438][ T6626] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.437317][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 125.717115][ T6630] No such timeout policy "syz1" [ 125.739506][ T6630] loop3: detected capacity change from 0 to 1024 [ 125.742334][ T6630] EXT4-fs: Ignoring removed nobh option [ 125.791464][ T6630] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 125.837270][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 125.918719][ T2062] ieee802154 phy0 wpan0: encryption failed: -22 [ 125.919737][ T2062] ieee802154 phy1 wpan1: encryption failed: -22 [ 125.977128][ T6630] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 125.982132][ T6629] EXT4-fs error (device loop3): ext4_lookup:1858: inode #15: comm syz.3.694: inode has both inline data and extents flags [ 125.984282][ T6629] EXT4-fs (loop3): Remounting filesystem read-only [ 126.317296][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 126.318550][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 126.327266][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 126.417097][ T4320] EXT4-fs (loop3): unmounting filesystem. [ 126.477275][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 126.877291][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 130.477260][ C1] net_ratelimit: 15 callbacks suppressed [ 130.477273][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 130.477312][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 130.637270][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 131.037270][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 131.517261][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 131.517268][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 131.517332][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 131.677272][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 132.077269][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 132.557257][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 135.677249][ C1] net_ratelimit: 14 callbacks suppressed [ 135.677262][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 135.677267][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 135.677333][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 135.847267][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 136.237257][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 136.717298][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 136.718503][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 136.727249][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 136.877276][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 137.277248][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 137.653350][ T6661] netlink: 8 bytes leftover after parsing attributes in process `syz.1.697'. [ 137.709646][ T6672] netlink: 4 bytes leftover after parsing attributes in process `syz.4.705'. [ 137.711215][ T6672] device bridge_slave_1 left promiscuous mode [ 137.712265][ T6672] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.749779][ T6672] device bridge_slave_0 left promiscuous mode [ 137.751347][ T6672] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.066133][ T6687] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 138.067325][ T6687] vhci_hcd: invalid port number 96 [ 138.068092][ T6687] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 138.777099][ T6706] netlink: 'syz.2.712': attribute type 24 has an invalid length. [ 138.976992][ T27] audit: type=1326 audit(138.960:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6707 comm="syz.2.713" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbab5b9e8 code=0x7ffc0000 [ 138.988837][ T27] audit: type=1326 audit(138.980:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6707 comm="syz.2.713" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbab5b9e8 code=0x7ffc0000 [ 138.994208][ T27] audit: type=1326 audit(138.980:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6707 comm="syz.2.713" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=148 compat=0 ip=0xffffbab5b9e8 code=0x7ffc0000 [ 139.001968][ T6708] netlink: 64 bytes leftover after parsing attributes in process `syz.2.713'. [ 139.004320][ T27] audit: type=1326 audit(138.980:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6707 comm="syz.2.713" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbab5b9e8 code=0x7ffc0000 [ 139.009294][ T27] audit: type=1326 audit(138.980:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6707 comm="syz.2.713" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbab5b9e8 code=0x7ffc0000 [ 139.014490][ T27] audit: type=1326 audit(138.980:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6707 comm="syz.2.713" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=211 compat=0 ip=0xffffbab5b9e8 code=0x7ffc0000 [ 139.180180][ T27] audit: type=1326 audit(139.170:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6707 comm="syz.2.713" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbab5b9e8 code=0x7ffc0000 [ 139.187133][ T27] audit: type=1326 audit(139.170:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6707 comm="syz.2.713" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbab5b9e8 code=0x7ffc0000 [ 139.465778][ T6717] kernel profiling enabled (shift: 17) [ 140.667992][ T6738] futex_wake_op: syz.2.723 tries to shift op by 32; fix this program [ 140.702254][ T6738] netlink: 332 bytes leftover after parsing attributes in process `syz.2.723'. [ 140.703746][ T6738] netlink: 'syz.2.723': attribute type 9 has an invalid length. [ 140.705450][ T6738] netlink: 108 bytes leftover after parsing attributes in process `syz.2.723'. [ 140.706681][ T6738] netlink: 32 bytes leftover after parsing attributes in process `syz.2.723'. [ 140.877264][ C0] net_ratelimit: 15 callbacks suppressed [ 140.877277][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 140.879345][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 140.879806][ T27] audit: type=1326 audit(140.870:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6734 comm="syz.4.722" exe="/root/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffbd35b9e8 code=0x0 [ 140.988722][ T6741] netlink: 'syz.4.722': attribute type 1 has an invalid length. [ 140.989988][ T6741] netlink: 4 bytes leftover after parsing attributes in process `syz.4.722'. [ 141.029182][ T6747] tipc: Enabling of bearer rejected, already enabled [ 141.047309][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 141.048475][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 141.437258][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 141.452569][ T6766] No such timeout policy "syz1" [ 141.917411][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 141.918576][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 142.249688][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 142.250874][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 142.477267][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 142.529112][ T6783] tipc: Enabling of bearer rejected, already enabled [ 144.303028][ T6826] No such timeout policy "syz1" [ 144.307853][ T6826] loop2: detected capacity change from 0 to 1024 [ 144.309247][ T6826] EXT4-fs: Ignoring removed nobh option [ 144.313164][ T6825] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.314653][ T6825] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.327345][ T6826] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 145.143459][ T6826] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 145.146511][ T6826] EXT4-fs error (device loop2): ext4_lookup:1858: inode #15: comm syz.2.746: inode has both inline data and extents flags [ 145.163189][ T6826] EXT4-fs (loop2): Remounting filesystem read-only [ 145.296431][ T4329] EXT4-fs (loop2): unmounting filesystem. [ 145.379008][ T6840] tipc: Enabling of bearer rejected, already enabled [ 145.606481][ T6854] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 145.612628][ T6854] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 146.040586][ T6861] binder: 6860:6861 unknown command 0 [ 146.041604][ T6861] binder: 6860:6861 ioctl c0306201 20000080 returned -22 [ 146.044533][ T6861] binder: 6860:6861 tried to acquire reference to desc 0, got 1 instead [ 146.157361][ C0] net_ratelimit: 15 callbacks suppressed [ 146.157374][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 146.159541][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 146.267972][ T6865] syz.2.757 sent an empty control message without MSG_MORE. [ 146.637300][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 147.024324][ T6871] loop3: detected capacity change from 0 to 1024 [ 147.025971][ T6871] EXT4-fs: Ignoring removed nobh option [ 147.199479][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 147.200762][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 147.230026][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 147.231264][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 147.232871][ T6871] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 147.268913][ T6879] tipc: Enabling of bearer rejected, already enabled [ 147.280263][ T6871] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 147.283204][ T6871] EXT4-fs error (device loop3): ext4_lookup:1858: inode #15: comm syz.3.759: inode has both inline data and extents flags [ 147.285486][ T6871] EXT4-fs (loop3): Remounting filesystem read-only [ 148.078246][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 148.404077][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 148.405311][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 148.409428][ T4320] EXT4-fs (loop3): unmounting filesystem. [ 148.520875][ T6909] lo speed is unknown, defaulting to 1000 [ 148.521927][ T6909] lo speed is unknown, defaulting to 1000 [ 148.523131][ T6909] lo speed is unknown, defaulting to 1000 [ 148.525585][ T6909] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 148.535126][ T6909] lo speed is unknown, defaulting to 1000 [ 148.536330][ T6909] lo speed is unknown, defaulting to 1000 [ 148.538407][ T6909] lo speed is unknown, defaulting to 1000 [ 148.539944][ T6909] lo speed is unknown, defaulting to 1000 [ 148.541026][ T6909] lo speed is unknown, defaulting to 1000 [ 148.602471][ T6917] netlink: 16 bytes leftover after parsing attributes in process `syz.0.774'. [ 149.030606][ T6915] bridge0: port 2(bridge_slave_1) entered disabled state [ 149.031876][ T6915] bridge0: port 1(bridge_slave_0) entered disabled state [ 149.052189][ T6933] binder: 6932:6933 unknown command 0 [ 149.053112][ T6933] binder: 6932:6933 ioctl c0306201 20000080 returned -22 [ 149.055791][ T6933] binder: 6932:6933 tried to acquire reference to desc 0, got 1 instead [ 149.834855][ T6915] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 149.848731][ T6915] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 149.954204][ T6950] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 149.957942][ T6950] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 150.155835][ T6915] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.157366][ T6915] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.158699][ T6915] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.159997][ T6915] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.395484][ T6936] netlink: 8 bytes leftover after parsing attributes in process `syz.2.777'. [ 150.398458][ T6936] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 150.538959][ T6963] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 150.540416][ T6963] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 150.652873][ T6971] binder: 6970:6971 unknown command 0 [ 150.655002][ T6971] binder: 6970:6971 ioctl c0306201 20000080 returned -22 [ 150.661429][ T6971] binder: 6970:6971 tried to acquire reference to desc 0, got 1 instead [ 151.197299][ C0] net_ratelimit: 12 callbacks suppressed [ 151.197315][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 151.517473][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 151.517495][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 151.518621][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 151.519701][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 151.611542][ T6995] futex_wake_op: syz.0.796 tries to shift op by 32; fix this program [ 151.719861][ T6993] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.721238][ T6993] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.079852][ T6993] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 152.095564][ T6993] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 152.334066][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 152.557288][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 152.558495][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 152.566202][ T6993] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.567360][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 152.567794][ T6993] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.568826][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 152.570025][ T6993] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.572595][ T6993] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.025215][ T4374] lo speed is unknown, defaulting to 1000 [ 153.026595][ T7016] tipc: Enabling of bearer rejected, already enabled [ 153.028240][ T7018] netlink: 8 bytes leftover after parsing attributes in process `syz.4.802'. [ 153.070928][ T7035] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.072601][ T7035] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.512875][ T7056] futex_wake_op: syz.1.815 tries to shift op by 32; fix this program [ 153.568344][ T7063] netlink: 332 bytes leftover after parsing attributes in process `syz.1.815'. [ 153.569929][ T7063] netlink: 'syz.1.815': attribute type 9 has an invalid length. [ 153.571227][ T7063] netlink: 108 bytes leftover after parsing attributes in process `syz.1.815'. [ 153.572713][ T7063] netlink: 32 bytes leftover after parsing attributes in process `syz.1.815'. [ 153.630501][ T7068] tipc: Enabling of bearer rejected, already enabled [ 154.186486][ T7086] netlink: 8 bytes leftover after parsing attributes in process `syz.3.821'. [ 154.515768][ T7095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 154.517971][ T7095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 154.729142][ T7097] netlink: 8 bytes leftover after parsing attributes in process `syz.1.827'. [ 154.743372][ T7097] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 154.872037][ T7105] tipc: Enabling of bearer rejected, already enabled [ 154.916810][ T7108] lo speed is unknown, defaulting to 1000 [ 154.943250][ T7110] netlink: 4 bytes leftover after parsing attributes in process `syz.0.831'. [ 154.944793][ T7110] device bridge_slave_1 left promiscuous mode [ 154.945908][ T7110] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.997988][ T7110] device bridge_slave_0 left promiscuous mode [ 154.999205][ T7110] bridge0: port 1(bridge_slave_0) entered disabled state [ 155.057005][ T7115] netlink: 'syz.4.832': attribute type 2 has an invalid length. [ 155.060824][ T7115] netlink: 'syz.4.832': attribute type 1 has an invalid length. [ 155.294684][ T7126] futex_wake_op: syz.1.837 tries to shift op by 32; fix this program [ 155.350808][ T7129] netlink: 332 bytes leftover after parsing attributes in process `syz.1.837'. [ 155.352273][ T7129] netlink: 'syz.1.837': attribute type 9 has an invalid length. [ 155.353349][ T7129] netlink: 108 bytes leftover after parsing attributes in process `syz.1.837'. [ 155.354634][ T7129] netlink: 32 bytes leftover after parsing attributes in process `syz.1.837'. [ 155.941066][ T7136] netlink: 8 bytes leftover after parsing attributes in process `syz.3.840'. [ 156.159364][ T7142] tipc: Enabling of bearer rejected, already enabled [ 156.170052][ T7144] netlink: 4 bytes leftover after parsing attributes in process `syz.0.844'. [ 156.282401][ T7157] lo speed is unknown, defaulting to 1000 [ 156.337640][ T7165] futex_wake_op: syz.1.853 tries to shift op by 32; fix this program [ 156.395987][ T7171] netlink: 332 bytes leftover after parsing attributes in process `syz.1.853'. [ 156.400891][ T7171] netlink: 'syz.1.853': attribute type 9 has an invalid length. [ 156.402303][ T7171] netlink: 108 bytes leftover after parsing attributes in process `syz.1.853'. [ 156.477311][ C0] net_ratelimit: 15 callbacks suppressed [ 156.477326][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 156.652333][ T7174] tipc: Enabling of bearer rejected, already enabled [ 156.717312][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 156.718495][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 156.719962][ T7176] device bridge_slave_1 left promiscuous mode [ 156.721408][ T7176] bridge0: port 2(bridge_slave_1) entered disabled state [ 156.727326][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 156.728598][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 156.749261][ T7176] device bridge_slave_0 left promiscuous mode [ 156.750699][ T7176] bridge0: port 1(bridge_slave_0) entered disabled state [ 157.082364][ T7184] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.084590][ T7184] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.160453][ T7186] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 157.517301][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 157.543462][ T7205] device bridge_slave_1 left promiscuous mode [ 157.544784][ T7205] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.645453][ T7205] device bridge_slave_0 left promiscuous mode [ 157.649728][ T7205] bridge0: port 1(bridge_slave_0) entered disabled state [ 157.757290][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 157.758480][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 158.078322][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 158.516837][ T7220] futex_wake_op: syz.3.872 tries to shift op by 32; fix this program [ 158.717413][ T4324] Bluetooth: hci1: command 0x0406 tx timeout [ 158.717437][ T4327] Bluetooth: hci4: command 0x0406 tx timeout [ 158.717466][ T4332] Bluetooth: hci3: command 0x0406 tx timeout [ 158.812865][ T7228] netlink: 'syz.3.872': attribute type 9 has an invalid length. [ 159.078906][ T7242] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 159.082134][ T7242] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 159.734172][ T7250] tipc: Enabling of bearer rejected, already enabled [ 161.406131][ T7272] __nla_validate_parse: 7 callbacks suppressed [ 161.406157][ T7272] netlink: 8 bytes leftover after parsing attributes in process `syz.0.882'. [ 161.417304][ T7275] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 161.418561][ T7275] vhci_hcd: invalid port number 96 [ 161.419379][ T7275] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 161.727716][ C0] net_ratelimit: 16 callbacks suppressed [ 161.727726][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 161.762152][ T7282] futex_wake_op: syz.3.889 tries to shift op by 32; fix this program [ 161.817731][ T7290] tipc: Enabling of bearer rejected, already enabled [ 161.917292][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 161.918560][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 162.405405][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 162.406823][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 162.797365][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 162.957040][ T7323] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 162.958350][ T7323] vhci_hcd: invalid port number 96 [ 162.959212][ T7323] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 162.967280][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 162.968408][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 163.437291][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 163.438493][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 163.822285][ T7318] netlink: 4 bytes leftover after parsing attributes in process `syz.1.899'. [ 163.838684][ T7334] tipc: Enabling of bearer rejected, already enabled [ 163.960776][ T7338] lo speed is unknown, defaulting to 1000 [ 164.109142][ T7348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 164.165504][ T7348] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 165.013765][ T7369] tipc: Enabling of bearer rejected, already enabled [ 165.033566][ T7371] netlink: 4 bytes leftover after parsing attributes in process `syz.2.916'. [ 165.035155][ T7371] device bridge_slave_1 left promiscuous mode [ 165.036204][ T7371] bridge0: port 2(bridge_slave_1) entered disabled state [ 165.058386][ T7371] device bridge_slave_0 left promiscuous mode [ 165.059523][ T7371] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.128352][ T7379] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 165.129511][ T7379] vhci_hcd: invalid port number 96 [ 165.130295][ T7379] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 166.389730][ T7410] tipc: Enabling of bearer rejected, already enabled [ 166.501220][ T7418] netlink: 4 bytes leftover after parsing attributes in process `syz.0.930'. [ 166.571287][ T7420] binder: 7419:7420 got transaction to invalid handle, 1 [ 166.573706][ T7420] binder: 7420:7419 cannot find target node [ 166.574811][ T7420] binder: 7419:7420 transaction call to 0:0 failed 89/29201/-22, size 0-0 line 3045 [ 166.580881][ T4869] binder: undelivered TRANSACTION_ERROR: 29201 [ 166.750810][ T7425] device vlan0 entered promiscuous mode [ 166.957322][ C0] net_ratelimit: 15 callbacks suppressed [ 166.957336][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 167.127306][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 167.128586][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 167.384168][ T7385] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 167.584930][ T7439] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 167.587394][ T7439] vhci_hcd: invalid port number 96 [ 167.588116][ T7439] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 167.597296][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 167.598486][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 167.997328][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 168.167268][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 168.168456][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 168.405186][ T7454] netlink: 4 bytes leftover after parsing attributes in process `syz.1.942'. [ 168.440682][ T7456] binder: 7455:7456 got transaction to invalid handle, 1 [ 168.441964][ T7456] binder: 7456:7455 cannot find target node [ 168.443076][ T7456] binder: 7455:7456 transaction call to 0:0 failed 93/29201/-22, size 0-0 line 3045 [ 168.463895][ T4381] binder: undelivered TRANSACTION_ERROR: 29201 [ 168.637318][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 168.638628][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 169.393473][ T7484] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 169.395849][ T7484] vhci_hcd: invalid port number 96 [ 169.396628][ T7484] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 169.555936][ T7486] netlink: 4 bytes leftover after parsing attributes in process `syz.1.954'. [ 169.591950][ T7488] binder: 7487:7488 got transaction to invalid handle, 1 [ 169.593228][ T7488] binder: 7488:7487 cannot find target node [ 169.594076][ T7488] binder: 7487:7488 transaction call to 0:0 failed 97/29201/-22, size 0-0 line 3045 [ 169.596592][ T4381] binder: undelivered TRANSACTION_ERROR: 29201 [ 170.271058][ T7519] binder: 7518:7519 got transaction to invalid handle, 1 [ 170.275027][ T7519] binder: 7519:7518 cannot find target node [ 170.275821][ T7520] netlink: 4 bytes leftover after parsing attributes in process `syz.4.965'. [ 170.539130][ T7527] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 170.541208][ T7527] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 171.935287][ T7553] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 171.936610][ T7553] vhci_hcd: invalid port number 96 [ 171.938032][ T7553] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 171.978220][ T7556] binder: 7555:7556 got transaction to invalid handle, 1 [ 171.979537][ T7556] binder_debug: 2 callbacks suppressed [ 171.979546][ T7556] binder: 7556:7555 cannot find target node [ 171.981126][ T7556] binder: 7555:7556 transaction call to 0:0 failed 105/29201/-22, size 0-0 line 3045 [ 171.983313][ T4869] binder: undelivered TRANSACTION_ERROR: 29201 [ 172.093535][ T7561] fuse: Unknown parameter 'fd0x0000000000000005' [ 172.157286][ C0] net_ratelimit: 15 callbacks suppressed [ 172.157299][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 172.317272][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 172.318480][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 172.491479][ T7570] lo speed is unknown, defaulting to 1000 [ 172.797332][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 172.798513][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 172.987974][ T7584] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 172.989228][ T7584] vhci_hcd: invalid port number 96 [ 172.990061][ T7584] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 173.197797][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 173.357293][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 173.358421][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 173.696202][ T7616] binder: 7615:7616 tried to acquire reference to desc 0, got 1 instead [ 173.704982][ T7616] binder: 7615:7616 ioctl c0306201 0 returned -14 [ 173.837310][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 173.838415][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 174.203139][ T27] audit: type=1326 audit(174.170:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7601 comm="syz.1.995" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 174.211264][ T7629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 174.216087][ T7629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 174.518118][ T7627] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1004'. [ 174.557557][ T27] audit: type=1326 audit(174.550:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7601 comm="syz.1.995" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=172 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 174.561526][ T27] audit: type=1326 audit(174.550:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7601 comm="syz.1.995" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 174.567512][ T27] audit: type=1326 audit(174.550:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7601 comm="syz.1.995" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 174.571106][ T27] audit: type=1326 audit(174.550:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7601 comm="syz.1.995" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 174.584555][ T27] audit: type=1326 audit(174.550:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7601 comm="syz.1.995" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 174.587791][ T27] audit: type=1326 audit(174.550:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7601 comm="syz.1.995" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 174.590848][ T27] audit: type=1326 audit(174.550:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7601 comm="syz.1.995" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 174.593881][ T27] audit: type=1326 audit(174.550:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7601 comm="syz.1.995" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 174.606157][ T27] audit: type=1326 audit(174.550:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7601 comm="syz.1.995" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 174.842399][ T7646] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1009'. [ 175.300757][ T7657] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 175.302088][ T7657] vhci_hcd: invalid port number 96 [ 175.302864][ T7657] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 175.421408][ T7660] binder: 7659:7660 tried to acquire reference to desc 0, got 1 instead [ 175.423171][ T7660] binder: 7659:7660 ioctl c0306201 0 returned -14 [ 176.821523][ T7687] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.823001][ T7687] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.850292][ T7690] binder: 7689:7690 tried to acquire reference to desc 0, got 1 instead [ 176.852003][ T7690] binder: 7689:7690 ioctl c0306201 0 returned -14 [ 177.154781][ T7699] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 177.155953][ T7699] vhci_hcd: invalid port number 96 [ 177.156670][ T7699] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 177.202843][ T7702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.204333][ T7702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.501849][ T7712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.503425][ T7712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.517271][ C0] net_ratelimit: 15 callbacks suppressed [ 177.517279][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 177.517317][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 177.520263][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 177.997307][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 177.998557][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 178.567274][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 178.568487][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 178.618132][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 178.868239][ T7743] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1043'. [ 178.870387][ T7743] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1043'. [ 178.871937][ T7743] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1043'. [ 178.873445][ T7743] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1043'. [ 178.874900][ T7743] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1043'. [ 179.037281][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 179.038479][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 180.050689][ T7765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.054603][ T7765] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.333953][ T7778] team0: Port device team_slave_0 removed [ 181.602247][ T7800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.612764][ T7800] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 182.717282][ C1] net_ratelimit: 15 callbacks suppressed [ 182.717293][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 182.719514][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 182.797276][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 183.330303][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 183.331575][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 183.757326][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 183.758465][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 183.837328][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 184.397362][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 184.398550][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 184.404161][ T7878] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1089'. [ 184.440691][ T7882] binder: 7881:7882 tried to acquire reference to desc 0, got 1 instead [ 184.449343][ T4870] binder: release 7881:7882 transaction 122 out, still active [ 184.450549][ T4870] binder: undelivered TRANSACTION_COMPLETE [ 184.463211][ T4870] binder: send failed reply for transaction 122, target dead [ 184.984886][ T7894] tipc: Enabling of bearer rejected, already enabled [ 185.199524][ T7913] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1101'. [ 185.250292][ T7919] binder: 7918:7919 tried to acquire reference to desc 0, got 1 instead [ 185.253019][ T4381] binder: release 7918:7919 transaction 127 out, still active [ 185.254302][ T4381] binder: undelivered TRANSACTION_COMPLETE [ 185.263655][ T4381] binder: send failed reply for transaction 127, target dead [ 185.350345][ T7924] lo speed is unknown, defaulting to 1000 [ 185.981231][ T7938] tipc: Enabling of bearer rejected, already enabled [ 186.152154][ T7947] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1112'. [ 186.906946][ T7968] tipc: Enabling of bearer rejected, failed to enable media [ 187.317659][ T7975] tipc: Enabling of bearer rejected, already enabled [ 187.539491][ T7981] team0: Port device team_slave_0 removed [ 187.715320][ T7983] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1124'. [ 187.917281][ C1] net_ratelimit: 15 callbacks suppressed [ 187.917294][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 187.919403][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 188.077303][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 188.200568][ T8000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.202096][ T8000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.273052][ T8002] tipc: Enabled bearer , priority 0 [ 188.282643][ T8002] tipc: Resetting bearer [ 188.567290][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 188.568571][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 188.957280][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 188.958571][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 188.998605][ T8001] tipc: Disabling bearer [ 189.001996][ T8013] tipc: Enabling of bearer rejected, already enabled [ 189.069760][ T8017] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1136'. [ 189.117284][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 189.597355][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 189.598642][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 190.375793][ T8051] binder: 8049:8051 tried to acquire reference to desc 0, got 1 instead [ 190.380816][ T4870] binder: release 8049:8051 transaction 132 out, still active [ 190.382103][ T4870] binder: undelivered TRANSACTION_COMPLETE [ 190.389967][ T4870] binder: send failed reply for transaction 132, target dead [ 190.413392][ T8055] tipc: Enabling of bearer rejected, already enabled [ 190.440739][ T8057] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1148'. [ 190.575001][ T8072] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 190.576823][ T8072] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.259283][ T8085] tipc: Enabling of bearer rejected, already enabled [ 191.259984][ T8082] binder: 8081:8082 tried to acquire reference to desc 0, got 1 instead [ 191.265500][ T4870] binder: release 8081:8082 transaction 137 out, still active [ 191.266691][ T4870] binder: undelivered TRANSACTION_COMPLETE [ 191.286290][ T4381] binder: send failed reply for transaction 137, target dead [ 191.383955][ T8091] lo speed is unknown, defaulting to 1000 [ 191.751744][ T8110] tipc: Enabling of bearer rejected, failed to enable media [ 191.798543][ T8115] lo speed is unknown, defaulting to 1000 [ 192.431742][ T8141] binder: 8140:8141 tried to acquire reference to desc 0, got 1 instead [ 192.434470][ T3898] binder: release 8140:8141 transaction 142 out, still active [ 192.435763][ T3898] binder: undelivered TRANSACTION_COMPLETE [ 192.451390][ T3898] binder: send failed reply for transaction 142, target dead [ 193.172498][ T8164] tipc: Enabling of bearer rejected, failed to enable media [ 193.198651][ C1] net_ratelimit: 15 callbacks suppressed [ 193.198664][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 193.200745][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 193.243207][ T8171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1180'. [ 193.437281][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 193.613532][ T8181] binder: 8180:8181 tried to acquire reference to desc 0, got 1 instead [ 193.615818][ T4381] binder: release 8180:8181 transaction 147 out, still active [ 193.714550][ T8187] tipc: Enabling of bearer rejected, failed to enable media [ 193.757309][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 193.758541][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 194.237305][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 194.238421][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 194.589141][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 194.702081][ T8202] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1191'. [ 194.721229][ T8215] tipc: Enabling of bearer rejected, failed to enable media [ 194.788668][ T8219] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 194.790043][ T8219] vhci_hcd: invalid port number 96 [ 194.790960][ T8219] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 194.797278][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 194.798392][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 195.553290][ T8236] tipc: Enabling of bearer rejected, failed to enable media [ 195.674753][ T8252] tipc: Enabling of bearer rejected, failed to enable media [ 195.778453][ T8256] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1205'. [ 196.025498][ T8256] 8021q: adding VLAN 0 to HW filter on device bond0 [ 196.029208][ T8256] bond0: (slave rose0): Enslaving as an active interface with an up link [ 196.040408][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 196.410877][ T8289] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 196.412167][ T8289] vhci_hcd: invalid port number 96 [ 196.412999][ T8289] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 197.076016][ T8326] tipc: Enabling of bearer rejected, failed to enable media [ 197.993111][ T8360] tipc: Enabling of bearer rejected, failed to enable media [ 198.407330][ C1] net_ratelimit: 15 callbacks suppressed [ 198.407339][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 198.409639][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 198.717333][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 198.957309][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 198.958440][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 199.334777][ T8400] tipc: Enabled bearer , priority 0 [ 199.337522][ T8399] tipc: Disabling bearer [ 199.447267][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 199.448387][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 199.757316][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 199.997270][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 199.998397][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 200.692457][ T8433] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1252'. [ 200.789534][ T8439] tipc: Enabled bearer , priority 0 [ 200.796779][ T8438] tipc: Disabling bearer [ 200.920462][ T8453] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1260'. [ 201.203071][ T8469] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.205481][ T8469] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.251934][ T8474] tipc: Enabling of bearer rejected, failed to enable media [ 201.756687][ T4336] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 201.758416][ T4336] CPU: 1 PID: 4336 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 201.759455][ T4336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 201.761119][ T4336] Workqueue: hci1 hci_rx_work [ 201.761817][ T4336] Call trace: [ 201.762346][ T4336] dump_backtrace+0x1c8/0x1f4 [ 201.763031][ T4336] show_stack+0x2c/0x3c [ 201.763675][ T4336] __dump_stack+0x30/0x40 [ 201.764296][ T4336] dump_stack_lvl+0xf8/0x160 [ 201.765030][ T4336] dump_stack+0x1c/0x5c [ 201.765683][ T4336] sysfs_create_dir_ns+0x22c/0x24c [ 201.766479][ T4336] kobject_add_internal+0x5a8/0xb30 [ 201.767252][ T4336] kobject_add+0x134/0x1f8 [ 201.767965][ T4336] device_add+0x3f0/0xf94 [ 201.768666][ T4336] hci_conn_add_sysfs+0xbc/0x1cc [ 201.769431][ T4336] le_conn_complete_evt+0xcb0/0x1220 [ 201.770171][ T4336] hci_le_conn_complete_evt+0x114/0x3f8 [ 201.770971][ T4336] hci_le_meta_evt+0x2c0/0x4a4 [ 201.771707][ T4336] hci_event_packet+0x6ac/0xf08 [ 201.772404][ T4336] hci_rx_work+0x324/0xaa0 [ 201.773037][ T4336] process_one_work+0x7f4/0x13a8 [ 201.773798][ T4336] worker_thread+0x8c8/0xfbc [ 201.774465][ T4336] kthread+0x250/0x2d8 [ 201.775086][ T4336] ret_from_fork+0x10/0x20 [ 201.777011][ T4336] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 201.779400][ T4336] Bluetooth: hci1: failed to register connection device [ 202.099292][ T8493] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1273'. [ 202.174839][ T8507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 202.176223][ T8507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 202.241190][ T8508] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 202.242509][ T8508] vhci_hcd: invalid port number 96 [ 202.243304][ T8508] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 202.778029][ T4869] libceph: connect (1)[c::]:6789 error -101 [ 202.795571][ T4869] libceph: mon0 (1)[c::]:6789 connect error [ 203.108782][ T4869] libceph: connect (1)[c::]:6789 error -101 [ 203.112892][ T4869] libceph: mon0 (1)[c::]:6789 connect error [ 203.335192][ T8515] ceph: No mds server is up or the cluster is laggy [ 203.548944][ T8538] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1285'. [ 203.597306][ C1] net_ratelimit: 16 callbacks suppressed [ 203.597320][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 203.599467][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 203.917293][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 204.165913][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 204.167139][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 204.422498][ T4336] Bluetooth: hci1: command 0x2016 tx timeout [ 204.617392][ T8564] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 204.620713][ T8566] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1294'. [ 204.624817][ T8564] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 204.656593][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 204.657819][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 204.737453][ T8570] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1297'. [ 204.798696][ T4336] Bluetooth: hci2: command 0x0406 tx timeout [ 204.957313][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 205.197312][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 205.198466][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 205.308967][ T8590] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 205.310285][ T8590] vhci_hcd: invalid port number 96 [ 205.311128][ T8590] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 205.603815][ T8598] lo speed is unknown, defaulting to 1000 [ 205.629935][ T8600] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1309'. [ 206.953734][ T8630] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1321'. [ 207.630087][ T8637] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 207.631380][ T8637] vhci_hcd: invalid port number 96 [ 207.632254][ T8637] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 208.246280][ T8658] lo speed is unknown, defaulting to 1000 [ 208.253937][ T8660] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1332'. [ 208.797272][ C0] net_ratelimit: 13 callbacks suppressed [ 208.797285][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 208.799232][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 208.807302][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 208.808488][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 209.196026][ T8676] lo speed is unknown, defaulting to 1000 [ 209.277267][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 209.700534][ T27] kauditd_printk_skb: 919 callbacks suppressed [ 209.700547][ T27] audit: type=1326 audit(209.480:940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8682 comm="syz.1.1337" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7ffc0000 [ 209.704519][ T27] audit: type=1326 audit(209.480:941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8682 comm="syz.1.1337" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7ffc0000 [ 209.708362][ T27] audit: type=1326 audit(209.480:942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8682 comm="syz.1.1337" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7ffc0000 [ 209.711659][ T27] audit: type=1326 audit(209.480:943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8682 comm="syz.1.1337" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7ffc0000 [ 209.714723][ T27] audit: type=1326 audit(209.480:944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8682 comm="syz.1.1337" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=56 compat=0 ip=0xffff92359dd4 code=0x7ffc0000 [ 209.717958][ T27] audit: type=1326 audit(209.480:945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8682 comm="syz.1.1337" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7ffc0000 [ 209.721232][ T27] audit: type=1326 audit(209.480:946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8682 comm="syz.1.1337" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7ffc0000 [ 209.724386][ T27] audit: type=1326 audit(209.480:947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8682 comm="syz.1.1337" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7ffc0000 [ 209.727590][ T27] audit: type=1326 audit(209.480:948): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8682 comm="syz.1.1337" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7ffc0000 [ 209.730803][ T27] audit: type=1326 audit(209.480:949): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8682 comm="syz.1.1337" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=56 compat=0 ip=0xffff92359dd4 code=0x7ffc0000 [ 209.837286][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 209.838498][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 209.987407][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 209.988542][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 210.227391][ T8675] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 210.228516][ T8675] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 210.235474][ T8675] Bluetooth: hci1: Suspend notifier action (1) failed: -4 [ 210.236724][ T8675] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 210.246900][ T8675] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 210.249445][ T8675] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 210.250466][ T8675] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 210.265211][ T8675] Bluetooth: hci2: Suspend notifier action (1) failed: -4 [ 210.266888][ T8706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.268860][ T8706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.317283][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 211.904101][ T4336] Bluetooth: hci1: command 0x0c1a tx timeout [ 212.034372][ T4336] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 212.036320][ T4336] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 212.067561][ T4336] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 212.936599][ T4327] Bluetooth: hci4: command 0x0c1a tx timeout [ 212.936624][ T4332] Bluetooth: hci2: command 0x0c1a tx timeout [ 212.938747][ T4336] Bluetooth: hci3: command 0x0c1a tx timeout [ 213.073408][ T4327] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 213.075298][ T4336] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 213.076677][ T4336] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 213.917318][ T4336] Bluetooth: hci1: command 0x0406 tx timeout [ 213.994223][ T8728] lo speed is unknown, defaulting to 1000 [ 214.007339][ C1] net_ratelimit: 13 callbacks suppressed [ 214.007352][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 214.009426][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 214.077405][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 214.078649][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 214.477274][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 215.037302][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 215.038491][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 215.445545][ T4324] Bluetooth: hci2: command 0x0406 tx timeout [ 215.445568][ T4336] Bluetooth: hci5: command 0x0409 tx timeout [ 215.566558][ T8783] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1355'. [ 215.694120][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 215.695344][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 215.696521][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 215.759994][ T8787] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1364'. [ 215.829127][ T8728] chnl_net:caif_netlink_parms(): no params data found [ 216.210301][ T8728] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.211671][ T8728] bridge0: port 1(bridge_slave_0) entered disabled state [ 216.213192][ T8728] device bridge_slave_0 entered promiscuous mode [ 216.218273][ T8728] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.220602][ T8728] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.222669][ T8728] device bridge_slave_1 entered promiscuous mode [ 216.260942][ T8728] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 216.263687][ T8728] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 216.280490][ T8728] team0: Port device team_slave_0 added [ 216.282738][ T8728] team0: Port device team_slave_1 added [ 216.289849][ T8728] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 216.290989][ T8728] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 216.295019][ T8728] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 216.298415][ T8728] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 216.299705][ T8728] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 216.303686][ T8728] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 216.348548][ T8728] device hsr_slave_0 entered promiscuous mode [ 216.478877][ T8816] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 216.480239][ T8816] vhci_hcd: invalid port number 96 [ 216.481063][ T8816] vhci_hcd: default hub control req: 0006 v000d i0060 l0 [ 216.671372][ T8728] device hsr_slave_1 entered promiscuous mode [ 216.718513][ T8728] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 216.719862][ T8728] Cannot create hsr debugfs directory [ 216.821469][ T8728] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 217.086605][ T8728] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 217.293158][ T8728] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 217.369064][ T8728] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 217.517360][ T4324] Bluetooth: hci5: command 0x041b tx timeout [ 217.741477][ T8728] 8021q: adding VLAN 0 to HW filter on device bond0 [ 217.749127][ T5273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 217.750765][ T5273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 217.759459][ T8728] 8021q: adding VLAN 0 to HW filter on device team0 [ 217.768920][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 217.770648][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 217.772347][ T4550] bridge0: port 1(bridge_slave_0) entered blocking state [ 217.773884][ T4550] bridge0: port 1(bridge_slave_0) entered forwarding state [ 217.775385][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 217.777087][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 217.779726][ T4550] bridge0: port 2(bridge_slave_1) entered blocking state [ 217.780857][ T4550] bridge0: port 2(bridge_slave_1) entered forwarding state [ 217.782400][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 217.784164][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 217.785895][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 217.789523][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 217.801169][ T8728] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 217.802931][ T8728] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 217.805465][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 217.807100][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 217.809084][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 217.811211][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 217.812830][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 217.814388][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 217.816042][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 217.818916][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 217.830504][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 217.985197][ T5281] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 217.986503][ T5281] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 217.994066][ T8728] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 218.773047][ T8863] tipc: Enabling of bearer rejected, failed to enable media [ 219.207253][ C1] net_ratelimit: 15 callbacks suppressed [ 219.207267][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 219.209256][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 219.256627][ T8888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.259932][ T8888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.262073][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 219.263728][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 219.274090][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 219.275834][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 219.277793][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 219.279305][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 219.281739][ T8728] device veth0_vlan entered promiscuous mode [ 219.285402][ T8728] device veth1_vlan entered promiscuous mode [ 219.295744][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 219.297921][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 219.299579][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 219.301180][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 219.304106][ T8728] device veth0_macvtap entered promiscuous mode [ 219.306926][ T8728] device veth1_macvtap entered promiscuous mode [ 219.313334][ T8728] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 219.314897][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 219.316515][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 219.319346][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 219.321037][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 219.324143][ T8728] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 219.325487][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 219.327051][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 219.331287][ T8728] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.332831][ T8728] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.334313][ T8728] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.335758][ T8728] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 219.369426][ T4550] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 219.370825][ T4550] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 219.373280][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 219.383254][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 219.384930][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 219.390024][ T4550] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 219.469712][ T8890] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1346'. [ 219.471355][ T8890] device bridge_slave_1 left promiscuous mode [ 219.472535][ T8890] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.508364][ T8890] device bridge_slave_0 left promiscuous mode [ 219.509705][ T8890] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.597290][ T4324] Bluetooth: hci5: command 0x040f tx timeout [ 219.749979][ T8904] tipc: Enabling of bearer rejected, failed to enable media [ 219.837308][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 219.838515][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 219.839607][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 220.173875][ T8920] lo speed is unknown, defaulting to 1000 [ 220.247307][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 220.248566][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 220.877301][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 220.878642][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 220.879786][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 221.088580][ T8942] tipc: Enabling of bearer rejected, failed to enable media [ 221.120827][ T8944] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1406'. [ 221.197114][ T27] kauditd_printk_skb: 211 callbacks suppressed [ 221.197127][ T27] audit: type=1326 audit(221.180:1161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8934 comm="syz.1.1402" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 221.681825][ T4336] Bluetooth: hci5: command 0x0419 tx timeout [ 221.838631][ T27] audit: type=1326 audit(221.830:1162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8934 comm="syz.1.1402" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=29 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 221.888531][ T27] audit: type=1326 audit(221.850:1163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8934 comm="syz.1.1402" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 221.965506][ T27] audit: type=1326 audit(221.880:1164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8934 comm="syz.1.1402" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9235b9e8 code=0x7fc00000 [ 222.966971][ T8991] device syzkaller0 entered promiscuous mode [ 222.979206][ T8994] tipc: Enabling of bearer rejected, failed to enable media [ 223.894067][ T9005] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1421'. [ 223.972480][ T9014] lo speed is unknown, defaulting to 1000 [ 224.397317][ C1] net_ratelimit: 15 callbacks suppressed [ 224.397331][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 224.399395][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 225.056485][ T9024] 9pnet_fd: Insufficient options for proto=fd [ 225.061358][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 225.062486][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 225.063562][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 225.282827][ T9032] tipc: Enabling of bearer rejected, failed to enable media [ 225.437282][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 225.438468][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 226.077351][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 226.078467][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 226.079581][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 227.035222][ T9077] capability: warning: `syz.1.1440' uses deprecated v2 capabilities in a way that may be insecure [ 227.076898][ T27] audit: type=1326 audit(227.060:1165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9079 comm="syz.4.1441" exe="/root/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffbd35b9e8 code=0x0 [ 227.169673][ T9078] team0: Port device team_slave_0 removed [ 227.251913][ T9086] device vlan0 entered promiscuous mode [ 227.619714][ T9101] lo speed is unknown, defaulting to 1000 [ 227.654712][ T9103] device syzkaller0 entered promiscuous mode [ 227.920934][ T9106] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1452'. [ 228.385887][ T9122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 228.391709][ T9122] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 229.837292][ C1] net_ratelimit: 15 callbacks suppressed [ 229.837306][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 229.839304][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 230.043888][ T9142] netlink: 72 bytes leftover after parsing attributes in process `syz.5.1461'. [ 230.045296][ T9142] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1461'. [ 230.237421][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 230.238602][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 230.239802][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 230.473325][ T9147] tipc: Enabling of bearer rejected, failed to enable media [ 230.877993][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 230.879162][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 230.973439][ T9153] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1466'. [ 231.644406][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 231.645620][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 231.646703][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 231.963624][ T9170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 231.965075][ T9170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.058310][ T78] block nbd1: Attempted send on invalid socket [ 233.059449][ T78] I/O error, dev nbd1, sector 128 op 0x0:(READ) flags 0x1000 phys_seg 1 prio class 1 [ 233.060905][ T78] gfs2: error 10 reading superblock [ 233.973098][ T9217] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.974631][ T9217] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.037322][ C1] net_ratelimit: 12 callbacks suppressed [ 235.037335][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 235.039491][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 235.117318][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 235.118456][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 235.119567][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 236.077288][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 236.078663][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 236.167309][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 236.168519][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 236.169579][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 236.598955][ T9274] device syzkaller0 entered promiscuous mode [ 237.545710][ T9298] tipc: Enabling of bearer rejected, failed to enable media [ 237.692985][ T9308] lo speed is unknown, defaulting to 1000 [ 238.140527][ T9315] device ip6gre1 entered promiscuous mode [ 238.235194][ T9325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 238.236750][ T9325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 238.323654][ T4869] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 238.325343][ T4869] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 238.347427][ T4398] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 238.935199][ T9339] sp0: Synchronizing with TNC [ 239.048870][ T4869] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 239.057818][ T9346] lo speed is unknown, defaulting to 1000 [ 239.080215][ T4869] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 240.247263][ C1] net_ratelimit: 15 callbacks suppressed [ 240.247276][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 240.249489][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 240.316782][ T9383] lo speed is unknown, defaulting to 1000 [ 240.317283][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 240.318900][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 240.320093][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 241.357291][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 241.358450][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 241.359576][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 241.462279][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 241.463611][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 242.425455][ T9424] lo speed is unknown, defaulting to 1000 [ 242.557281][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 243.320378][ T9437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 243.322134][ T9437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 243.868894][ T9461] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1555'. [ 244.258190][ T9471] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1557'. [ 244.260880][ T9473] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1558'. [ 245.517307][ C0] net_ratelimit: 15 callbacks suppressed [ 245.517322][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 245.519427][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 245.520529][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 245.597535][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 245.598708][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 246.102910][ T9513] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1570'. [ 246.164931][ T9517] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1573'. [ 246.557370][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 246.558645][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 246.559814][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 247.256691][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 247.257996][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 247.511248][ T4336] ================================================================== [ 247.512533][ T4336] BUG: KASAN: use-after-free in l2cap_connect_cfm+0x594/0xd64 [ 247.513613][ T4336] Read of size 8 at addr ffff0000d11a3498 by task kworker/u5:7/4336 [ 247.514754][ T4336] [ 247.515086][ T4336] CPU: 1 PID: 4336 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 247.516173][ T4336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 247.517673][ T4336] Workqueue: hci2 hci_rx_work [ 247.518376][ T4336] Call trace: [ 247.518867][ T4336] dump_backtrace+0x1c8/0x1f4 [ 247.519553][ T4336] show_stack+0x2c/0x3c [ 247.520193][ T4336] __dump_stack+0x30/0x40 [ 247.520839][ T4336] dump_stack_lvl+0xf8/0x160 [ 247.521495][ T4336] print_address_description+0x88/0x218 [ 247.522327][ T4336] print_report+0x50/0x68 [ 247.523031][ T4336] kasan_report+0xa8/0x100 [ 247.523647][ T4336] __asan_report_load8_noabort+0x2c/0x38 [ 247.524526][ T4336] l2cap_connect_cfm+0x594/0xd64 [ 247.525274][ T4336] hci_connect_cfm+0x98/0x130 [ 247.525968][ T4336] le_conn_complete_evt+0xd18/0x1220 [ 247.526727][ T4336] hci_le_conn_complete_evt+0x114/0x3f8 [ 247.527608][ T4336] hci_le_meta_evt+0x2c0/0x4a4 [ 247.528309][ T4336] hci_event_packet+0x6ac/0xf08 [ 247.529024][ T4336] hci_rx_work+0x324/0xaa0 [ 247.529703][ T4336] process_one_work+0x7f4/0x13a8 [ 247.530426][ T4336] worker_thread+0x8c8/0xfbc [ 247.531090][ T4336] kthread+0x250/0x2d8 [ 247.531686][ T4336] ret_from_fork+0x10/0x20 [ 247.532377][ T4336] [ 247.532729][ T4336] Allocated by task 4336: [ 247.533397][ T4336] kasan_set_track+0x4c/0x80 [ 247.534141][ T4336] kasan_save_alloc_info+0x28/0x34 [ 247.534951][ T4336] __kasan_kmalloc+0xa0/0xb8 [ 247.535695][ T4336] kmalloc_trace+0x7c/0x94 [ 247.536383][ T4336] l2cap_chan_create+0x58/0x698 [ 247.537123][ T4336] l2cap_sock_new_connection_cb+0x164/0x284 [ 247.538041][ T4336] l2cap_connect_cfm+0x2d4/0xd64 [ 247.538785][ T4336] hci_connect_cfm+0x98/0x130 [ 247.539509][ T4336] le_conn_complete_evt+0xd18/0x1220 [ 247.540325][ T4336] hci_le_conn_complete_evt+0x114/0x3f8 [ 247.541106][ T4336] hci_le_meta_evt+0x2c0/0x4a4 [ 247.541825][ T4336] hci_event_packet+0x6ac/0xf08 [ 247.542549][ T4336] hci_rx_work+0x324/0xaa0 [ 247.543226][ T4336] process_one_work+0x7f4/0x13a8 [ 247.543957][ T4336] worker_thread+0x8c8/0xfbc [ 247.544637][ T4336] kthread+0x250/0x2d8 [ 247.545239][ T4336] ret_from_fork+0x10/0x20 [ 247.545906][ T4336] [ 247.546256][ T4336] Freed by task 9508: [ 247.546823][ T4336] kasan_set_track+0x4c/0x80 [ 247.547530][ T4336] kasan_save_free_info+0x3c/0x60 [ 247.548299][ T4336] ____kasan_slab_free+0x148/0x1b0 [ 247.549043][ T4336] __kasan_slab_free+0x18/0x28 [ 247.549697][ T4336] slab_free_freelist_hook+0x16c/0x1ec [ 247.550453][ T4336] __kmem_cache_free+0xc0/0x224 [ 247.551145][ T4336] kfree+0xd0/0x1ac [ 247.551706][ T4336] l2cap_chan_put+0x174/0x24c [ 247.552466][ T4336] l2cap_sock_cleanup_listen+0x104/0x28c [ 247.553270][ T4336] l2cap_sock_release+0x68/0x1c0 [ 247.554043][ T4336] sock_close+0xb4/0x1f8 [ 247.554653][ T4336] __fput+0x1bc/0x7c0 [ 247.555240][ T4336] ____fput+0x20/0x30 [ 247.555802][ T4336] task_work_run+0x1ec/0x270 [ 247.556487][ T4336] do_notify_resume+0x2038/0x2b28 [ 247.557232][ T4336] el0_svc+0x98/0x138 [ 247.557813][ T4336] el0t_64_sync_handler+0x84/0xf0 [ 247.558619][ T4336] el0t_64_sync+0x18c/0x190 [ 247.559298][ T4336] [ 247.559651][ T4336] Last potentially related work creation: [ 247.560474][ T4336] kasan_save_stack+0x40/0x70 [ 247.561169][ T4336] __kasan_record_aux_stack+0xc0/0xdc [ 247.561949][ T4336] kasan_record_aux_stack_noalloc+0x14/0x20 [ 247.562830][ T4336] call_rcu+0x100/0x954 [ 247.563436][ T4336] __qdisc_destroy+0x2a8/0x500 [ 247.564182][ T4336] shutdown_scheduler_queue+0x168/0x200 [ 247.564984][ T4336] dev_shutdown+0x9c/0x47c [ 247.565652][ T4336] unregister_netdevice_many+0x944/0x1740 [ 247.566470][ T4336] unregister_netdevice_queue+0x2ac/0x2f8 [ 247.567354][ T4336] __tun_detach+0xb04/0x122c [ 247.568036][ T4336] tun_chr_close+0x118/0x1f8 [ 247.568685][ T4336] __fput+0x1bc/0x7c0 [ 247.569270][ T4336] ____fput+0x20/0x30 [ 247.569861][ T4336] task_work_run+0x1ec/0x270 [ 247.570517][ T4336] do_notify_resume+0x2038/0x2b28 [ 247.571285][ T4336] el0_svc+0x98/0x138 [ 247.571870][ T4336] el0t_64_sync_handler+0x84/0xf0 [ 247.572682][ T4336] el0t_64_sync+0x18c/0x190 [ 247.573304][ T4336] [ 247.573673][ T4336] Second to last potentially related work creation: [ 247.574613][ T4336] kasan_save_stack+0x40/0x70 [ 247.575353][ T4336] __kasan_record_aux_stack+0xc0/0xdc [ 247.576216][ T4336] kasan_record_aux_stack_noalloc+0x14/0x20 [ 247.577119][ T4336] call_rcu+0x100/0x954 [ 247.577758][ T4336] netlink_release+0x1260/0x1710 [ 247.578521][ T4336] sock_close+0xb4/0x1f8 [ 247.579186][ T4336] __fput+0x1bc/0x7c0 [ 247.579798][ T4336] ____fput+0x20/0x30 [ 247.580394][ T4336] task_work_run+0x1ec/0x270 [ 247.581073][ T4336] do_notify_resume+0x2038/0x2b28 [ 247.581825][ T4336] el0_svc+0x98/0x138 [ 247.582416][ T4336] el0t_64_sync_handler+0x84/0xf0 [ 247.583228][ T4336] el0t_64_sync+0x18c/0x190 [ 247.583897][ T4336] [ 247.584233][ T4336] The buggy address belongs to the object at ffff0000d11a3000 [ 247.584233][ T4336] which belongs to the cache kmalloc-2k of size 2048 [ 247.586317][ T4336] The buggy address is located 1176 bytes inside of [ 247.586317][ T4336] 2048-byte region [ffff0000d11a3000, ffff0000d11a3800) [ 247.588281][ T4336] [ 247.588604][ T4336] The buggy address belongs to the physical page: [ 247.589511][ T4336] page:000000001b241392 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1111a0 [ 247.590953][ T4336] head:000000001b241392 order:3 compound_mapcount:0 compound_pincount:0 [ 247.592113][ T4336] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 247.593330][ T4336] raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002900 [ 247.594514][ T4336] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 247.595719][ T4336] page dumped because: kasan: bad access detected [ 247.596707][ T4336] [ 247.597059][ T4336] Memory state around the buggy address: [ 247.597931][ T4336] ffff0000d11a3380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 247.599111][ T4336] ffff0000d11a3400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 247.600292][ T4336] >ffff0000d11a3480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 247.601428][ T4336] ^ [ 247.602152][ T4336] ffff0000d11a3500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 247.603345][ T4336] ffff0000d11a3580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 247.604539][ T4336] ================================================================== [ 247.610106][ T9522] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1571'. [ 247.643511][ T4336] Disabling lock debugging due to kernel taint [ 247.644559][ T4336] Unable to handle kernel paging request at virtual address fbd51fffffffff90 [ 247.645961][ T4336] KASAN: maybe wild-memory-access in range [0xdeacfffffffffc80-0xdeacfffffffffc87] [ 247.648133][ T4336] Mem abort info: [ 247.648690][ T4336] ESR = 0x0000000096000004 [ 247.649341][ T4336] EC = 0x25: DABT (current EL), IL = 32 bits [ 247.650274][ T4336] SET = 0, FnV = 0 [ 247.650852][ T4336] EA = 0, S1PTW = 0 [ 247.651435][ T4336] FSC = 0x04: level 0 translation fault [ 247.652370][ T4336] Data abort info: [ 247.652900][ T4336] ISV = 0, ISS = 0x00000004 [ 247.653601][ T4336] CM = 0, WnR = 0 [ 247.654161][ T4336] [fbd51fffffffff90] address between user and kernel address ranges [ 247.655305][ T4336] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 247.656285][ T4336] Modules linked in: [ 247.656860][ T4336] CPU: 0 PID: 4336 Comm: kworker/u5:7 Tainted: G B syzkaller #0 [ 247.658210][ T4336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 247.659749][ T4336] Workqueue: hci2 hci_rx_work [ 247.660447][ T4336] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 247.661712][ T4336] pc : l2cap_connect_cfm+0x4fc/0xd64 [ 247.662502][ T4336] lr : l2cap_connect_cfm+0x4f0/0xd64 [ 247.663329][ T4336] sp : ffff800020de7600 [ 247.663927][ T4336] x29: ffff800020de7680 x28: dfff800000000000 x27: 1fffe00019b1b007 [ 247.665223][ T4336] x26: 0000000000000001 x25: 0000000000000080 x24: deacfffffffffc84 [ 247.666404][ T4336] x23: ffff0000c375701a x22: dead000000000100 x21: ffff0000c3757260 [ 247.667654][ T4336] x20: ffff0000cd8d8039 x19: ffff0000c3757000 x18: ffff800011abbcc0 [ 247.668823][ T4336] x17: 0000000000000000 x16: ffff800008042d90 x15: 0000000000000002 [ 247.669912][ T4336] x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000100000 [ 247.671056][ T4336] x11: 0000000000062997 x10: ffff80003195b000 x9 : 0000000000000007 [ 247.672205][ T4336] x8 : 1bd59fffffffff90 x7 : 0000000000000001 x6 : 0000000000000001 [ 247.673457][ T4336] x5 : ffff800020de6fd8 x4 : ffff8000151a4920 x3 : ffff800010c09798 [ 247.674612][ T4336] x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001 [ 247.675821][ T4336] Call trace: [ 247.676303][ T4336] l2cap_connect_cfm+0x4fc/0xd64 [ 247.677076][ T4336] hci_connect_cfm+0x98/0x130 [ 247.677754][ T4336] le_conn_complete_evt+0xd18/0x1220 [ 247.678596][ T4336] hci_le_conn_complete_evt+0x114/0x3f8 [ 247.679385][ T4336] hci_le_meta_evt+0x2c0/0x4a4 [ 247.680095][ T4336] hci_event_packet+0x6ac/0xf08 [ 247.680827][ T4336] hci_rx_work+0x324/0xaa0 [ 247.681489][ T4336] process_one_work+0x7f4/0x13a8 [ 247.682241][ T4336] worker_thread+0x8c8/0xfbc [ 247.682904][ T4336] kthread+0x250/0x2d8 [ 247.683469][ T4336] ret_from_fork+0x10/0x20 [ 247.684132][ T4336] Code: 97cfa459 d343ff08 12000b09 11000d29 (38fc6908) [ 247.685147][ T4336] ---[ end trace 0000000000000000 ]--- [ 248.006688][ T4336] Kernel panic - not syncing: Oops: Fatal exception [ 248.007678][ T4336] SMP: stopping secondary CPUs [ 248.008393][ T4336] Kernel Offset: disabled [ 248.009033][ T4336] CPU features: 0x080000,000f0097,a65bfea7 [ 248.009897][ T4336] Memory Limit: none [ 248.324921][ T4336] Rebooting in 86400 seconds..