last executing test programs: 7.644815352s ago: executing program 4 (id=237): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r2, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r1, @ANYBLOB="7100330080200900ffffffffffff0802110000005050505050762942bd0000000000000064000010000601010101010104060308090004000602fc0105030597052a01042d1243f2161b081db16b6ba049256654fb8f9e5327b4"], 0x90}, 0x1, 0x0, 0x0, 0x40080c0}, 0x0) 6.798883278s ago: executing program 4 (id=248): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x5, '\x00', @buffer={"be97fa44a04f306e3b851e23d99db5c3f4d94447056ef1cffbb7e5fa02219005", 0x20}, 0x14}]}) 6.250256165s ago: executing program 4 (id=253): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) r0 = syz_io_uring_setup(0x26b6, &(0x7f0000000200)={0x0, 0xf906, 0x800, 0x0, 0x308}, &(0x7f0000000080), &(0x7f0000000280), 0x0) io_uring_register$IORING_REGISTER_FILES2(r0, 0xd, &(0x7f00000008c0)={0xa, 0x0, 0x0, &(0x7f0000000740), &(0x7f0000000800)=[0x2, 0x4]}, 0x20) 5.882249596s ago: executing program 1 (id=258): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes192\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) close(0x3) 5.82119032s ago: executing program 4 (id=259): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x84000, 0x0) 5.638986521s ago: executing program 4 (id=261): sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000004e80)={0x0, 0x0, &(0x7f0000004e40)={&(0x7f0000000000)={0x50, 0x2, 0x1, 0x401, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x21}]}, @CTA_TUPLE_REPLY={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x20048084}, 0x20048000) 5.370179076s ago: executing program 1 (id=263): setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8000}, 0x8) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000002d00)=[{{&(0x7f0000001080)={0xa, 0x4e22, 0x1, @private2, 0x10001}, 0x1c, &(0x7f00000010c0)=[{&(0x7f00000011c0)="e6", 0x1}], 0x1}}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000), &(0x7f0000000080)=0x4) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000001180)=0xfd9) 4.585458204s ago: executing program 1 (id=268): unshare(0x8040600) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x4, 0x4, 0x12}, 0x50) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r0, r1, 0x4, 0x0, @val=@tracing={0x0, 0x1}}, 0x20) 4.400376593s ago: executing program 4 (id=272): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x80) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {}, {}, {0xa, 0x1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40098}, 0x4000800) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0x7, 0xfff1}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x400dc}, 0x4020080) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r12, {}, {0xffff, 0xffff}, {0x2, 0x5}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 4.385150054s ago: executing program 1 (id=273): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000280), 0x14) write$binfmt_script(r0, &(0x7f00000000c0)={'#! ', './file0'}, 0xb) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000500)=@gcm_256={{0x303}, "2a4001011f891d5b", "11682d84dd05bb63ae661f051e1e79ceafeaa60a5bd1dc83db142ade2bd907fd", "fd6ed24e", "d4e9e1c90d89691c"}, 0x38) ppoll(&(0x7f0000000400)=[{r0, 0x2084}], 0x1, 0x0, 0x0, 0x0) 3.887444314s ago: executing program 32 (id=272): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x80) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {}, {}, {0xa, 0x1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40098}, 0x4000800) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0x7, 0xfff1}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x400dc}, 0x4020080) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r12, {}, {0xffff, 0xffff}, {0x2, 0x5}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 3.824815233s ago: executing program 1 (id=276): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001200), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000001c0)={0x13, 0x10, 0x8, {0x0, 0xffffffffffffffff, 0x2}}, 0x18) 3.743679954s ago: executing program 0 (id=278): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x2c}, 0x94) r1 = socket$inet6(0xa, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'bond_slave_1\x00', 0x0}) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000180)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r3, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r0, r2, 0x25, 0x0, @val=@target_btf_id=0xffffffffffffffff}, 0x14) 3.679395699s ago: executing program 1 (id=279): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) shutdown(r3, 0x1) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e20, 0x0, @loopback, 0x10006}}, 0x0, 0x0, 0x47, 0x0, "09be2271b78506e6dd938d324c415acd403a4480fd1afa34432bcdfa64d957e93efafd27ad06a6f589bb643f167cf0fcd370239aaa93f6ded3c5032c96ead0cdc68474d402ab73e482db7ec1e0a57489"}, 0xd8) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e20, 0x3, @empty, 0x10005}, 0x1c) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e20, 0x9, @loopback, 0x1}, 0x1c) 3.318607532s ago: executing program 3 (id=284): openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x1, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000540)=0x1, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000600), 0x0, 0x81, &(0x7f0000000100)={0x2, 0xfffc, @local}, 0x10) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="040e04000f08"], 0x7) 3.172804267s ago: executing program 3 (id=286): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f0000000000)={r1, @in={{0x2, 0x0, @empty}}, 0x7, 0x7ffc}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000340)={r1, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x4, 0x2c}, 0x9c) 3.134275387s ago: executing program 0 (id=287): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@ipv6_newrule={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x81, 0x80}}, 0x1c}}, 0x0) 2.944775668s ago: executing program 3 (id=289): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/image_size', 0x82802, 0xcd) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x7, 0x4010000000000ffd, 0x0, 0x0, 0x19, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "a5b07dcc14180222d4ae002e43b761b7ad330000000000000000000600", [0xfffffffffffffce8, 0x3]}}) io_setup(0x1, &(0x7f00000016c0)=0x0) io_submit(r2, 0x16, &(0x7f0000001640)=[&(0x7f0000000000)={0x4000000, 0x0, 0x1f, 0x1, 0x4, r0, &(0x7f0000000280)='a', 0x1, 0x5}]) 2.896275041s ago: executing program 0 (id=290): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, 0x0, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @local, 0x2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 2.164665838s ago: executing program 2 (id=295): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) 2.067081089s ago: executing program 3 (id=296): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r1) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4400000010000d042abd70f8ffffffffffffff00", @ANYRES32=r2, @ANYBLOB="01000000000000002400128009000100626f6e6400000000140002800500010004"], 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r3 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) 1.983436996s ago: executing program 2 (id=297): syz_mount_image$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x40, 0x0, 0x0, 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000002200)='hugetlbfs\x00', 0x400, 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x1000020, &(0x7f0000000140)={[{@size={'size', 0x3d, [0x2d]}}]}) 1.867638153s ago: executing program 0 (id=298): r0 = socket(0xa, 0x3, 0x87) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@local, 0x78, r4}) 1.793217677s ago: executing program 2 (id=299): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@ipv6_newrule={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x81, 0x80}}, 0x1c}}, 0x0) 765.24969ms ago: executing program 3 (id=300): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001200), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f00000001c0)={0x13, 0x10, 0x8, {0x0, 0xffffffffffffffff, 0x2}}, 0x18) 659.926554ms ago: executing program 0 (id=301): r0 = socket$kcm(0x29, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001dc0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad0e0e2b45d14ee446b840edaa1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c50ce6a8e9f65de13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87915ed063f608dddb03a95b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0fd9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000c3d51d9a161446b4373e06a9e07f8a000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfada1f69756651b73a7ed0f7e467081193b2844869"], &(0x7f0000000140)='GPL\x00'}, 0x48) r2 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r2, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000014) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000040)={r2, r1}) shutdown(r2, 0x0) 591.403714ms ago: executing program 2 (id=302): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) close(0x3) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) setsockopt(r0, 0x84, 0x80, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000005400)={r4, @in={{0x2, 0x4e23, @remote}}}, 0x84) 484.785891ms ago: executing program 3 (id=303): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e27, 0xf82c, @local, 0x5}]}, &(0x7f0000000040)=0x10) shutdown(r0, 0x2) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={r1, 0x3}, &(0x7f0000000140)=0x8) 397.298602ms ago: executing program 2 (id=304): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, 0x0, 0x20048000) 356.517084ms ago: executing program 0 (id=305): getdents64(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) socket(0x1e, 0x805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmget(0x1, 0x4000, 0xa20, &(0x7f0000ffb000/0x4000)=nil) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r3, 0x3) accept4$bt_l2cap(r3, &(0x7f0000000200), 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) ioctl$TIOCSETD(r4, 0x5423, 0x0) 0s ago: executing program 2 (id=306): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='configfs\x00', 0x16, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[], [], 0x2f}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20400, 0x38) getdents64(r0, 0x0, 0x0) lseek(r0, 0x7fff, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.29' (ED25519) to the list of known hosts. [ 72.158987][ T5596] cgroup: Unknown subsys name 'net' [ 72.400500][ T5596] cgroup: Unknown subsys name 'cpuset' [ 72.455824][ T5596] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.119673][ T5596] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.431781][ T5614] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.451612][ T5617] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.458630][ T5614] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.461307][ T5614] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.462789][ T5614] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.467213][ T5614] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.475635][ T60] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.477220][ T60] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.478235][ T60] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.478951][ T60] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.494940][ T4925] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.510864][ T4925] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.511671][ T4925] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.535577][ T4925] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.538793][ T4925] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.550911][ T4925] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.551266][ T4925] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.553263][ T4925] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.565869][ T5617] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.570766][ T4925] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.671044][ T4925] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 76.691190][ T4925] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 76.692213][ T4925] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 76.712654][ T4925] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 76.724081][ T4925] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 78.567743][ T4925] Bluetooth: hci1: command tx timeout [ 78.646291][ T4925] Bluetooth: hci2: command tx timeout [ 78.646306][ T60] Bluetooth: hci3: command tx timeout [ 78.725977][ T4925] Bluetooth: hci0: command tx timeout [ 78.815502][ T4925] Bluetooth: hci4: command tx timeout [ 78.969137][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.969869][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.970365][ T5620] bridge_slave_0: entered allmulticast mode [ 78.972227][ T5620] bridge_slave_0: entered promiscuous mode [ 79.012771][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.012928][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.013068][ T5610] bridge_slave_0: entered allmulticast mode [ 79.014827][ T5610] bridge_slave_0: entered promiscuous mode [ 79.055136][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.056863][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.057058][ T5620] bridge_slave_1: entered allmulticast mode [ 79.068507][ T5620] bridge_slave_1: entered promiscuous mode [ 79.103940][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.104217][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.104793][ T5610] bridge_slave_1: entered allmulticast mode [ 79.108353][ T5610] bridge_slave_1: entered promiscuous mode [ 79.143401][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.143572][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.143707][ T5609] bridge_slave_0: entered allmulticast mode [ 79.146024][ T5609] bridge_slave_0: entered promiscuous mode [ 79.153419][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.153682][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.153901][ T5611] bridge_slave_0: entered allmulticast mode [ 79.160350][ T5611] bridge_slave_0: entered promiscuous mode [ 79.187083][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.187353][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.187570][ T5612] bridge_slave_0: entered allmulticast mode [ 79.190444][ T5612] bridge_slave_0: entered promiscuous mode [ 79.228009][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.228271][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.228427][ T5609] bridge_slave_1: entered allmulticast mode [ 79.230284][ T5609] bridge_slave_1: entered promiscuous mode [ 79.231276][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.231536][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.231748][ T5611] bridge_slave_1: entered allmulticast mode [ 79.233533][ T5611] bridge_slave_1: entered promiscuous mode [ 79.260031][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.260306][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.260843][ T5612] bridge_slave_1: entered allmulticast mode [ 79.269128][ T5612] bridge_slave_1: entered promiscuous mode [ 79.283632][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.333103][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.353651][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.444344][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.479089][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.483711][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.514202][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.534895][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.540308][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.561330][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.564481][ T5620] team0: Port device team_slave_0 added [ 79.611789][ T5610] team0: Port device team_slave_0 added [ 79.631975][ T5620] team0: Port device team_slave_1 added [ 79.661723][ T5610] team0: Port device team_slave_1 added [ 79.694186][ T5609] team0: Port device team_slave_0 added [ 79.698429][ T5611] team0: Port device team_slave_0 added [ 79.720059][ T5612] team0: Port device team_slave_0 added [ 79.740672][ T5609] team0: Port device team_slave_1 added [ 79.743117][ T5611] team0: Port device team_slave_1 added [ 79.769484][ T5612] team0: Port device team_slave_1 added [ 79.770883][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.770892][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.770906][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.839499][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.839509][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.839523][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.867400][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.867415][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.867439][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.924949][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.924966][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.924989][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.972445][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.972461][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.972483][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.976699][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.976713][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.976735][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.996853][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.996869][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.996892][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.010548][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.010563][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.010586][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.013513][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.013525][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.013549][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.019470][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.019484][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.019506][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.203621][ T5620] hsr_slave_0: entered promiscuous mode [ 80.210622][ T5620] hsr_slave_1: entered promiscuous mode [ 80.247776][ T5610] hsr_slave_0: entered promiscuous mode [ 80.249759][ T5610] hsr_slave_1: entered promiscuous mode [ 80.251471][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 80.251566][ T5610] Cannot create hsr debugfs directory [ 80.339837][ T5609] hsr_slave_0: entered promiscuous mode [ 80.341023][ T5609] hsr_slave_1: entered promiscuous mode [ 80.341989][ T5609] debugfs: 'hsr0' already exists in 'hsr' [ 80.342010][ T5609] Cannot create hsr debugfs directory [ 80.360458][ T5612] hsr_slave_0: entered promiscuous mode [ 80.363694][ T5612] hsr_slave_1: entered promiscuous mode [ 80.365221][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 80.365243][ T5612] Cannot create hsr debugfs directory [ 80.377267][ T5611] hsr_slave_0: entered promiscuous mode [ 80.379096][ T5611] hsr_slave_1: entered promiscuous mode [ 80.380559][ T5611] debugfs: 'hsr0' already exists in 'hsr' [ 80.380578][ T5611] Cannot create hsr debugfs directory [ 80.645523][ T4925] Bluetooth: hci1: command tx timeout [ 80.725409][ T4925] Bluetooth: hci2: command tx timeout [ 80.735968][ T4925] Bluetooth: hci3: command tx timeout [ 80.808520][ T4925] Bluetooth: hci0: command tx timeout [ 80.888541][ T4925] Bluetooth: hci4: command tx timeout [ 81.641198][ T5620] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 81.718783][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.723513][ T5620] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 81.764936][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.769741][ T5620] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 81.806589][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.835516][ T5620] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 81.879400][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.005386][ T5609] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 82.041773][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.047242][ T5609] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 82.093335][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.099532][ T5609] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 82.140349][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.162847][ T5609] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 82.200137][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.352007][ T5612] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 82.390836][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.408831][ T5612] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 82.452368][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.465008][ T5612] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 82.511834][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.536728][ T5612] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 82.574393][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.711663][ T5610] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 82.736266][ T4925] Bluetooth: hci1: command tx timeout [ 82.752866][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.772182][ T5610] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 82.806775][ T60] Bluetooth: hci2: command tx timeout [ 82.806863][ T4925] Bluetooth: hci3: command tx timeout [ 82.814802][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.829168][ T5610] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 82.872728][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.896719][ T4925] Bluetooth: hci0: command tx timeout [ 82.902770][ T5610] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 82.928586][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.966130][ T4925] Bluetooth: hci4: command tx timeout [ 83.049222][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.091934][ T5611] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 83.133418][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.154166][ T5611] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 83.191768][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.203490][ T5611] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 83.230978][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.253895][ T5611] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 83.291300][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.347330][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.389165][ T4890] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.389326][ T4890] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.427030][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.461855][ T4890] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.461957][ T4890] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.573228][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.633612][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.660482][ T1318] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.661337][ T1318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.709740][ T1318] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.709896][ T1318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.794887][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.840029][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.906603][ T1180] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.909451][ T1180] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.988509][ T1180] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.989009][ T1180] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.083722][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.168689][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.168835][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.188965][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.242563][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.243681][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.409860][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.488342][ T98] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.488492][ T98] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.589165][ T4890] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.589393][ T4890] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.808391][ T4925] Bluetooth: hci1: command tx timeout [ 84.897579][ T60] Bluetooth: hci2: command tx timeout [ 84.897625][ T4925] Bluetooth: hci3: command tx timeout [ 84.940609][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.977754][ T4925] Bluetooth: hci0: command tx timeout [ 85.046629][ T4925] Bluetooth: hci4: command tx timeout [ 85.502989][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.983079][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.002848][ T5609] veth0_vlan: entered promiscuous mode [ 86.052201][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.148536][ T5609] veth1_vlan: entered promiscuous mode [ 86.182720][ T5620] veth0_vlan: entered promiscuous mode [ 86.289015][ T5620] veth1_vlan: entered promiscuous mode [ 86.387821][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.448313][ T5610] veth0_vlan: entered promiscuous mode [ 86.452912][ T5609] veth0_macvtap: entered promiscuous mode [ 86.481925][ T5612] veth0_vlan: entered promiscuous mode [ 86.493907][ T5609] veth1_macvtap: entered promiscuous mode [ 86.533440][ T5610] veth1_vlan: entered promiscuous mode [ 86.560665][ T5620] veth0_macvtap: entered promiscuous mode [ 86.568850][ T5612] veth1_vlan: entered promiscuous mode [ 86.591254][ T5620] veth1_macvtap: entered promiscuous mode [ 86.604965][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.658487][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.701063][ T5611] veth0_vlan: entered promiscuous mode [ 86.709749][ T56] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.730116][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.755886][ T44] cfg80211: failed to load regulatory.db [ 86.760233][ T56] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.792497][ T56] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.808127][ T56] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.830159][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.850593][ T5611] veth1_vlan: entered promiscuous mode [ 86.900364][ T5610] veth0_macvtap: entered promiscuous mode [ 86.922408][ T5612] veth0_macvtap: entered promiscuous mode [ 86.930704][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.990180][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.997218][ T5610] veth1_macvtap: entered promiscuous mode [ 87.011613][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.032340][ T5612] veth1_macvtap: entered promiscuous mode [ 87.044820][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.355782][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.490785][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.502282][ T191] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.502306][ T191] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.533035][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.572110][ T5611] veth0_macvtap: entered promiscuous mode [ 87.593293][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.593379][ T1183] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.626559][ T1183] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.657532][ T5611] veth1_macvtap: entered promiscuous mode [ 87.662783][ T1183] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.675466][ T1183] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.727931][ T1183] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.727950][ T1183] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.760381][ T191] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.811325][ T191] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.825264][ T191] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.834748][ T191] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.837016][ T1318] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.837033][ T1318] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.037038][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.270266][ T1318] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.270286][ T1318] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.451334][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.794147][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.882539][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.882640][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.882653][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.993325][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.006791][ T5806] loop5: detected capacity change from 0 to 7 [ 89.016558][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.036064][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.036081][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.102250][ T5806] Dev loop5: unable to read RDB block 7 [ 89.102303][ T5806] loop5: unable to read partition table [ 89.102510][ T5806] loop5: partition table beyond EOD, truncated [ 89.102527][ T5806] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 89.556308][ T5813] loop4: detected capacity change from 0 to 256 [ 89.654548][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.654565][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.836717][ T5813] FAT-fs (loop4): Directory bread(block 64) failed [ 89.836753][ T5813] FAT-fs (loop4): Directory bread(block 65) failed [ 89.836851][ T5813] FAT-fs (loop4): Directory bread(block 66) failed [ 89.836872][ T5813] FAT-fs (loop4): Directory bread(block 67) failed [ 89.837032][ T5813] FAT-fs (loop4): Directory bread(block 68) failed [ 89.837054][ T5813] FAT-fs (loop4): Directory bread(block 69) failed [ 89.837143][ T5813] FAT-fs (loop4): Directory bread(block 70) failed [ 89.837164][ T5813] FAT-fs (loop4): Directory bread(block 71) failed [ 89.837251][ T5813] FAT-fs (loop4): Directory bread(block 72) failed [ 89.837272][ T5813] FAT-fs (loop4): Directory bread(block 73) failed [ 90.300594][ T4925] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 90.300620][ T4925] CPU: 1 UID: 0 PID: 4925 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 90.300636][ T4925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 90.300642][ T4925] Workqueue: hci0 hci_rx_work [ 90.300664][ T4925] Call Trace: [ 90.300668][ T4925] [ 90.300674][ T4925] dump_stack_lvl+0xe8/0x150 [ 90.300690][ T4925] sysfs_create_dir_ns+0x271/0x2a0 [ 90.300704][ T4925] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 90.300721][ T4925] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 90.300736][ T4925] ? rt_spin_unlock+0x160/0x200 [ 90.300752][ T4925] kobject_add_internal+0x631/0xd10 [ 90.300771][ T4925] kobject_add+0x163/0x240 [ 90.300788][ T4925] ? __pfx_kobject_add+0x10/0x10 [ 90.300805][ T4925] ? get_device_parent+0x370/0x3a0 [ 90.300821][ T4925] device_add+0x408/0xb90 [ 90.300836][ T4925] hci_conn_add_sysfs+0xd5/0x210 [ 90.300849][ T4925] le_conn_complete_evt+0x10e6/0x16b0 [ 90.300869][ T4925] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 90.300911][ T4925] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 90.300924][ T4925] ? lockdep_hardirqs_on+0x7a/0x110 [ 90.300936][ T4925] ? skb_pull_data+0xfb/0x200 [ 90.300951][ T4925] hci_le_enh_conn_complete_evt+0x189/0x490 [ 90.300970][ T4925] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 90.300987][ T4925] hci_event_packet+0x659/0xef0 [ 90.301001][ T4925] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 90.301015][ T4925] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 90.301028][ T4925] ? __pfx_hci_event_packet+0x10/0x10 [ 90.301038][ T4925] ? rt_spin_unlock+0x14f/0x200 [ 90.301057][ T4925] ? hci_send_to_monitor+0xe2/0x590 [ 90.301074][ T4925] hci_rx_work+0x3ee/0x1040 [ 90.301090][ T4925] process_one_work+0xa31/0x1980 [ 90.301112][ T4925] ? process_one_work+0x8d5/0x1980 [ 90.301132][ T4925] ? __pfx_process_one_work+0x10/0x10 [ 90.301145][ T4925] ? do_raw_spin_lock+0x12b/0x2f0 [ 90.301168][ T4925] worker_thread+0xba8/0x11e0 [ 90.301195][ T4925] kthread+0x388/0x470 [ 90.301206][ T4925] ? __pfx_worker_thread+0x10/0x10 [ 90.301220][ T4925] ? __pfx_kthread+0x10/0x10 [ 90.301231][ T4925] ret_from_fork+0x514/0xb70 [ 90.301246][ T4925] ? __pfx_ret_from_fork+0x10/0x10 [ 90.301258][ T4925] ? __switch_to+0xc79/0x1410 [ 90.301271][ T4925] ? __pfx_kthread+0x10/0x10 [ 90.301282][ T4925] ret_from_fork_asm+0x1a/0x30 [ 90.301305][ T4925] [ 90.301331][ T4925] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 90.301352][ T4925] Bluetooth: hci0: failed to register connection device [ 90.387788][ T98] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.387806][ T98] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.782444][ T98] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.782463][ T98] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.804570][ T5818] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 90.804696][ T5818] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 90.935213][ T4925] Bluetooth: to_multiplier 4209 > 3200 [ 91.975241][ T5818] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 92.062568][ T5818] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 92.118479][ T5837] syz.2.12 uses obsolete (PF_INET,SOCK_PACKET) [ 92.123135][ T5837] netlink: 104 bytes leftover after parsing attributes in process `syz.2.12'. [ 92.148757][ T5818] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 92.148836][ T5818] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 92.219191][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.219210][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.244472][ T5818] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 92.463795][ T5818] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 92.463939][ T5818] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 92.589494][ T5843] loop5: detected capacity change from 0 to 7 [ 92.618989][ T5818] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 92.645959][ T5842] netlink: 208 bytes leftover after parsing attributes in process `syz.3.4'. [ 92.667554][ T5843] Dev loop5: unable to read RDB block 7 [ 92.667598][ T5843] loop5: unable to read partition table [ 92.667813][ T5843] loop5: partition table beyond EOD, truncated [ 92.670908][ T5843] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 92.752105][ T5818] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 92.752188][ T5818] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 92.809407][ T4925] Bluetooth: hci0: command 0x0c1a tx timeout [ 92.917435][ T5818] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 92.980895][ T5818] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 92.980965][ T5818] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 93.021091][ T4925] Bluetooth: hci3: unexpected event for opcode 0x080f [ 93.114404][ T5850] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvtap0, syncid = 4, id = 0 [ 93.162690][ T5818] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 93.751235][ T5871] netlink: 4 bytes leftover after parsing attributes in process `syz.1.21'. [ 94.170773][ T5878] netlink: 8 bytes leftover after parsing attributes in process `syz.0.23'. [ 94.247850][ T4925] Bluetooth: hci1: command 0x0c1a tx timeout [ 94.808623][ T4925] Bluetooth: hci2: command 0x0c1a tx timeout [ 94.887790][ T4925] Bluetooth: hci0: command 0x0c1a tx timeout [ 95.046864][ T4925] Bluetooth: hci4: command 0x0c1a tx timeout [ 95.078843][ T5889] netlink: 4 bytes leftover after parsing attributes in process `syz.0.28'. [ 95.505965][ T5900] capability: warning: `syz.4.32' uses 32-bit capabilities (legacy support in use) [ 96.007883][ T5905] loop1: detected capacity change from 0 to 512 [ 96.476386][ T4925] Bluetooth: hci1: command 0x0c1a tx timeout [ 96.534672][ T5905] EXT4-fs (loop1): orphan cleanup on readonly fs [ 96.552839][ T5905] EXT4-fs warning (device loop1): ext4_xattr_inode_get:560: inode #11: comm syz.1.25: EA inode hash validation failed [ 96.553094][ T5905] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2860: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 96.553449][ T5905] EXT4-fs error (device loop1): ext4_xattr_inode_update_ref:1037: inode #11: comm syz.1.25: EA inode 11 ref wraparound: ref_count=0 ref_change=-1 [ 96.553547][ T5905] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 96.559446][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 96.559464][ C1] EXT4-fs (loop1): initial error at time 1778116154: ext4_xattr_inode_update_ref:1037: inode 11 [ 96.559483][ C1] EXT4-fs (loop1): last error at time 1778116154: ext4_xattr_inode_update_ref:1037: inode 11 [ 96.580975][ T5905] EXT4-fs warning (device loop1): ext4_xattr_inode_dec_ref_all:1231: inode #11: comm syz.1.25: ea_inode dec ref err=-117 [ 96.581678][ T5905] EXT4-fs (loop1): 1 orphan inode deleted [ 96.584009][ T5905] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 96.887606][ T4925] Bluetooth: hci2: command 0x0c1a tx timeout [ 96.935097][ T5611] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 96.982148][ T4925] Bluetooth: hci0: command 0x0c1a tx timeout [ 97.050618][ T4925] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 97.054798][ T4925] Bluetooth: hci3: Injecting HCI hardware error event [ 97.057732][ T4925] Bluetooth: hci3: hardware error 0x00 [ 97.131258][ T60] Bluetooth: hci4: command 0x0c1a tx timeout [ 97.131425][ T5915] ======================================================= [ 97.131425][ T5915] WARNING: The mand mount option has been deprecated and [ 97.131425][ T5915] and is ignored by this kernel. Remove the mand [ 97.131425][ T5915] option from the mount to silence this warning. [ 97.131425][ T5915] ======================================================= [ 97.131508][ T5915] tmpfs: Bad value for 'mpol' [ 98.570029][ T60] Bluetooth: hci1: command 0x0c1a tx timeout [ 98.689369][ T5935] loop3: detected capacity change from 0 to 512 [ 99.175525][ T5617] Bluetooth: hci2: command 0x0c1a tx timeout [ 99.178331][ T4925] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 99.178412][ T4925] Bluetooth: hci0: command 0x0c1a tx timeout [ 99.206582][ T4925] Bluetooth: hci4: command 0x0c1a tx timeout [ 100.646446][ T5617] Bluetooth: hci1: command 0x0c1a tx timeout [ 101.050289][ T5935] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 101.050439][ T5935] ext4 filesystem being mounted at /9/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 101.098472][ T5954] loop2: detected capacity change from 0 to 512 [ 101.299781][ T5617] Bluetooth: hci2: command 0x0c1a tx timeout [ 101.384313][ T5954] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 101.384333][ T5954] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 102.770807][ T60] Bluetooth: hci1: command 0x0c1a tx timeout [ 103.003220][ T5612] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 103.107272][ T5954] EXT4-fs (loop2): 1 truncate cleaned up [ 103.139532][ T5954] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 103.523477][ T60] Bluetooth: hci2: command 0x0c1a tx timeout [ 103.560264][ T5971] loop4: detected capacity change from 0 to 2048 [ 104.534031][ T5971] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 104.918529][ T5620] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 104.919159][ T5610] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 105.752666][ T6008] loop2: detected capacity change from 0 to 2048 [ 106.462878][ T6008] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 106.887114][ T5610] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 108.547655][ T6049] loop0: detected capacity change from 0 to 128 [ 109.523070][ T6049] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 109.633031][ T6049] ext4 filesystem being mounted at /18/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 109.869480][ T6065] netlink: 4 bytes leftover after parsing attributes in process `syz.3.89'. [ 110.003661][ T5609] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 110.043336][ T60] Bluetooth: hci1: unexpected event for opcode 0x080f [ 110.299616][ T6070] loop4: detected capacity change from 0 to 256 [ 110.377226][ T6076] loop2: detected capacity change from 0 to 512 [ 110.434477][ T6076] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 110.541479][ T6076] EXT4-fs (loop2): 1 truncate cleaned up [ 110.553652][ T6076] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 110.774192][ T6070] FAT-fs (loop4): Directory bread(block 64) failed [ 110.774224][ T6070] FAT-fs (loop4): Directory bread(block 65) failed [ 110.774317][ T6070] FAT-fs (loop4): Directory bread(block 66) failed [ 110.774338][ T6070] FAT-fs (loop4): Directory bread(block 67) failed [ 110.774557][ T6070] FAT-fs (loop4): Directory bread(block 68) failed [ 110.774579][ T6070] FAT-fs (loop4): Directory bread(block 69) failed [ 110.777129][ T6070] FAT-fs (loop4): Directory bread(block 70) failed [ 110.777159][ T6070] FAT-fs (loop4): Directory bread(block 71) failed [ 110.777255][ T6070] FAT-fs (loop4): Directory bread(block 72) failed [ 110.777275][ T6070] FAT-fs (loop4): Directory bread(block 73) failed [ 112.077157][ T6088] Zero length message leads to an empty skb [ 112.311887][ T5610] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 112.410103][ T6098] netlink: 36 bytes leftover after parsing attributes in process `syz.3.106'. [ 112.411800][ T6098] netlink: 36 bytes leftover after parsing attributes in process `syz.3.106'. [ 112.985108][ T6117] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 113.954779][ T6151] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.079508][ T6151] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.085689][ T60] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 114.085819][ T60] Bluetooth: hci1: Injecting HCI hardware error event [ 114.087365][ T5617] Bluetooth: hci1: hardware error 0x00 [ 115.156558][ T6197] hugetlbfs: Bad value '-' for mount option 'size' [ 115.156558][ T6197] [ 116.181960][ T5617] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 116.228824][ T6232] loop5: detected capacity change from 0 to 7 [ 116.244856][ T6232] Dev loop5: unable to read RDB block 7 [ 116.244888][ T6232] loop5: AHDI p1 p2 p3 [ 116.244916][ T6232] loop5: partition table partially beyond EOD, truncated [ 116.245160][ T6232] loop5: p1 start 1818582900 is beyond EOD, truncated [ 116.245179][ T6232] loop5: p3 start 335544320 is beyond EOD, truncated [ 116.901444][ T6252] loop4: detected capacity change from 0 to 512 [ 117.054397][ T6252] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 117.054550][ T6252] ext4 filesystem being mounted at /34/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 117.311175][ T6267] loop0: detected capacity change from 0 to 512 [ 117.569613][ T6267] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 117.569764][ T6267] ext4 filesystem being mounted at /37/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 117.587464][ T6252] EXT4-fs error (device loop4): ext4_xattr_block_get:597: inode #12: comm syz.4.169: corrupted xattr block 6: invalid header [ 117.748954][ T6277] loop3: detected capacity change from 0 to 512 [ 117.782221][ T5620] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 117.797405][ T6267] EXT4-fs error (device loop0): ext4_do_update_inode:5690: inode #2: comm syz.0.174: corrupted inode contents [ 117.807898][ T6277] EXT4-fs (loop3): orphan cleanup on readonly fs [ 117.807919][ T6277] EXT4-fs error (device loop3): ext4_quota_enable:7221: comm syz.3.177: Bad quota inum: 2, type: 1 [ 117.808101][ T6277] loop3: lost filesystem error report for type 5 error -117 [ 117.815384][ C0] EXT4-fs (loop3): last error at time 1778116176: ext4_quota_enable:7221 [ 117.846879][ T5617] Bluetooth: hci4: command 0x0c1a tx timeout [ 117.880875][ T6267] EXT4-fs error (device loop0): ext4_dirty_inode:6587: inode #2: comm syz.0.174: mark_inode_dirty error [ 117.956670][ T6277] EXT4-fs warning (device loop3): ext4_enable_quotas:7269: Failed to enable quota tracking (type=1, err=-117, ino=2). Please run e2fsck to fix. [ 117.967365][ T6277] EXT4-fs (loop3): Cannot turn on quotas: error -117 [ 117.969840][ T6267] EXT4-fs error (device loop0): ext4_do_update_inode:5690: inode #2: comm syz.0.174: corrupted inode contents [ 117.977541][ T6277] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 118.047503][ T6267] EXT4-fs error (device loop0): __ext4_ext_dirty:207: inode #2: comm syz.0.174: mark_inode_dirty error [ 118.100179][ T5612] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 118.144650][ T6275] EXT4-fs warning (device loop0): ext4_es_cache_extent:1082: inode #2: comm syz.0.174: ES cache extent failed: add [0,1,20,0x1] conflict with existing [0,8,576460752303423487,0x18] [ 118.144650][ T6275] [ 118.175464][ T6275] EXT4-fs error (device loop0): ext4_do_update_inode:5690: inode #2: comm syz.0.174: corrupted inode contents [ 118.203060][ T6275] EXT4-fs error (device loop0): ext4_append:88: inode #2: comm syz.0.174: mark_inode_dirty error [ 118.207302][ T6275] EXT4-fs error (device loop0) in ext4_append:100: Corrupt filesystem [ 118.423421][ T6294] loop3: detected capacity change from 0 to 128 [ 118.483280][ T6267] EXT4-fs error (device loop0): ext4_do_update_inode:5690: inode #2: comm syz.0.174: corrupted inode contents [ 118.528655][ T6294] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 118.537495][ T6294] ext4 filesystem being mounted at /43/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 118.541827][ T6267] EXT4-fs error (device loop0): add_dirent_to_buf:2151: inode #2: comm syz.0.174: mark_inode_dirty error [ 118.609336][ T6297] netlink: 8 bytes leftover after parsing attributes in process `syz.2.186'. [ 118.711421][ T5609] EXT4-fs error (device loop0): ext4_do_update_inode:5690: inode #2: comm syz-executor: corrupted inode contents [ 118.745217][ T5612] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 118.849465][ T5609] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 119.033757][ T6297] 8021q: adding VLAN 0 to HW filter on device bond1 [ 119.982887][ T6333] loop5: detected capacity change from 0 to 7 [ 120.069095][ T6333] Dev loop5: unable to read RDB block 7 [ 120.069125][ T6333] loop5: AHDI p1 p2 p3 [ 120.069150][ T6333] loop5: partition table partially beyond EOD, truncated [ 120.069354][ T6333] loop5: p1 start 1818582900 is beyond EOD, truncated [ 120.069372][ T6333] loop5: p3 start 335544320 is beyond EOD, truncated [ 120.121755][ T6336] netlink: 8 bytes leftover after parsing attributes in process `syz.2.205'. [ 120.192497][ T6339] loop4: detected capacity change from 0 to 128 [ 120.334042][ T6346] loop1: detected capacity change from 0 to 512 [ 120.347959][ T6339] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 120.348645][ T6346] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 120.348770][ T6339] ext4 filesystem being mounted at /40/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 120.527278][ T6346] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.207: bad orphan inode 16 [ 120.527308][ T6346] loop1: lost filesystem error report for type 5 error -117 [ 120.532290][ T6346] ext4_test_bit(bit=15, block=4) = 0 [ 120.532311][ T6346] EXT4-fs (loop1): 1 orphan inode deleted [ 120.574685][ T6346] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 120.589925][ T6336] 8021q: adding VLAN 0 to HW filter on device bond2 [ 120.648956][ T5617] Bluetooth: hci2: command 0x0c1a tx timeout [ 120.667900][ T5620] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 120.920033][ T5611] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 121.182114][ T6374] netlink: 48 bytes leftover after parsing attributes in process `syz.0.219'. [ 121.182519][ T6374] netlink: 48 bytes leftover after parsing attributes in process `syz.0.219'. [ 121.549320][ T6393] netlink: 8 bytes leftover after parsing attributes in process `syz.4.225'. [ 121.865793][ T6393] 8021q: adding VLAN 0 to HW filter on device bond1 [ 122.079784][ T6404] loop1: detected capacity change from 0 to 8 [ 125.000760][ T5617] Bluetooth: hci0: unexpected event for opcode 0x080f [ 126.457208][ T5617] Bluetooth: hci0: unexpected event for opcode 0x080f [ 127.520122][ T60] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 127.554459][ T60] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 127.566973][ T60] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 127.571799][ T60] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 127.572537][ T60] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 127.959110][ T6535] loop7: detected capacity change from 0 to 7 [ 128.500926][ T6535] Dev loop7: unable to read RDB block 7 [ 128.500969][ T6535] loop7: unable to read partition table [ 128.501252][ T6535] loop7: partition table beyond EOD, truncated [ 128.501288][ T6535] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 128.849618][ T6557] netlink: 8 bytes leftover after parsing attributes in process `syz.3.296'. [ 129.046969][ T60] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 129.047128][ T60] Bluetooth: hci0: Injecting HCI hardware error event [ 129.050202][ T5617] Bluetooth: hci0: hardware error 0x00 [ 129.272863][ T6557] 8021q: adding VLAN 0 to HW filter on device bond1 [ 129.695182][ T60] Bluetooth: hci4: command tx timeout [ 131.360585][ T60] ================================================================== [ 131.360605][ T60] BUG: KASAN: slab-use-after-free in l2cap_sock_new_connection_cb+0x208/0x2f0 [ 131.360640][ T60] Read of size 8 at addr ffff8880335847b0 by task kworker/u9:0/60 [ 131.360658][ T60] [ 131.360677][ T60] CPU: 0 UID: 0 PID: 60 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 131.360700][ T60] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 131.360713][ T60] Workqueue: hci0 hci_rx_work [ 131.360738][ T60] Call Trace: [ 131.360745][ T60] [ 131.360755][ T60] dump_stack_lvl+0xe8/0x150 [ 131.360781][ T60] print_address_description+0x55/0x1e0 [ 131.360807][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 131.360827][ T60] print_report+0x58/0x70 [ 131.360849][ T60] kasan_report+0x117/0x150 [ 131.360879][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 131.360903][ T60] l2cap_sock_new_connection_cb+0x208/0x2f0 [ 131.360924][ T60] l2cap_connect_cfm+0x368/0x1560 [ 131.360957][ T60] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 131.360986][ T60] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 131.361008][ T60] ? lockdep_hardirqs_on+0x7a/0x110 [ 131.361028][ T60] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 131.361049][ T60] ? mutex_lock_nested+0x152/0x1d0 [ 131.361075][ T60] ? hci_connect_cfm+0x2c/0x140 [ 131.361100][ T60] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 131.361129][ T60] hci_connect_cfm+0x95/0x140 [ 131.361154][ T60] le_conn_complete_evt+0x1134/0x16b0 [ 131.361192][ T60] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 131.361221][ T60] ? rt_mutex_slowunlock+0x201/0x300 [ 131.361249][ T60] ? skb_pull_data+0xfb/0x200 [ 131.361274][ T60] hci_le_conn_complete_evt+0x187/0x470 [ 131.361303][ T60] hci_event_packet+0x659/0xef0 [ 131.361326][ T60] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 131.361354][ T60] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 131.361377][ T60] ? __pfx_hci_event_packet+0x10/0x10 [ 131.361397][ T60] ? rt_spin_unlock+0x14f/0x200 [ 131.361428][ T60] ? hci_send_to_monitor+0xe2/0x590 [ 131.361457][ T60] hci_rx_work+0x3ee/0x1040 [ 131.361479][ T60] ? preempt_schedule_thunk+0x16/0x40 [ 131.361501][ T60] process_one_work+0xa31/0x1980 [ 131.361534][ T60] ? process_one_work+0x8d5/0x1980 [ 131.361565][ T60] ? __pfx_process_one_work+0x10/0x10 [ 131.361590][ T60] ? do_raw_spin_lock+0x12b/0x2f0 [ 131.361626][ T60] worker_thread+0xba8/0x11e0 [ 131.361665][ T60] kthread+0x388/0x470 [ 131.361685][ T60] ? __pfx_worker_thread+0x10/0x10 [ 131.361711][ T60] ? __pfx_kthread+0x10/0x10 [ 131.361732][ T60] ret_from_fork+0x514/0xb70 [ 131.361757][ T60] ? __pfx_ret_from_fork+0x10/0x10 [ 131.361780][ T60] ? __switch_to+0xc79/0x1410 [ 131.361800][ T60] ? __pfx_kthread+0x10/0x10 [ 131.361821][ T60] ret_from_fork_asm+0x1a/0x30 [ 131.361855][ T60] [ 131.361862][ T60] [ 131.361866][ T60] Allocated by task 60: [ 131.361875][ T60] kasan_save_track+0x3e/0x80 [ 131.361899][ T60] __kasan_kmalloc+0x93/0xb0 [ 131.361923][ T60] __kmalloc_noprof+0x3e7/0x7b0 [ 131.361949][ T60] sk_prot_alloc+0xe7/0x210 [ 131.361965][ T60] sk_alloc+0x3a/0x390 [ 131.361980][ T60] bt_sock_alloc+0x3b/0x310 [ 131.362000][ T60] l2cap_sock_new_connection_cb+0xf1/0x2f0 [ 131.362018][ T60] l2cap_connect_cfm+0x368/0x1560 [ 131.362044][ T60] hci_connect_cfm+0x95/0x140 [ 131.362065][ T60] le_conn_complete_evt+0x1134/0x16b0 [ 131.362090][ T60] hci_le_conn_complete_evt+0x187/0x470 [ 131.362112][ T60] hci_event_packet+0x659/0xef0 [ 131.362129][ T60] hci_rx_work+0x3ee/0x1040 [ 131.362147][ T60] process_one_work+0xa31/0x1980 [ 131.362177][ T60] worker_thread+0xba8/0x11e0 [ 131.362202][ T60] kthread+0x388/0x470 [ 131.362220][ T60] ret_from_fork+0x514/0xb70 [ 131.362240][ T60] ret_from_fork_asm+0x1a/0x30 [ 131.362264][ T60] [ 131.362268][ T60] Freed by task 6585: [ 131.362277][ T60] kasan_save_track+0x3e/0x80 [ 131.362300][ T60] kasan_save_free_info+0x46/0x50 [ 131.362319][ T60] __kasan_slab_free+0x5c/0x80 [ 131.362343][ T60] kfree+0x1c5/0x6c0 [ 131.362366][ T60] __sk_destruct+0x74b/0x9d0 [ 131.362383][ T60] l2cap_sock_cleanup_listen+0xe0/0x440 [ 131.362399][ T60] l2cap_sock_release+0x6e/0x270 [ 131.362425][ T60] __sock_release+0xb9/0x250 [ 131.362446][ T60] sock_close+0x1c/0x30 [ 131.362466][ T60] __fput+0x461/0xa70 [ 131.362486][ T60] task_work_run+0x1d9/0x270 [ 131.362506][ T60] get_signal+0x11eb/0x1330 [ 131.362530][ T60] arch_do_signal_or_restart+0xbc/0x840 [ 131.362549][ T60] exit_to_user_mode_loop+0x86/0x4d0 [ 131.362566][ T60] [ 131.362570][ T60] The buggy address belongs to the object at ffff888033584000 [ 131.362570][ T60] which belongs to the cache kmalloc-2k of size 2048 [ 131.362587][ T60] The buggy address is located 1968 bytes inside of [ 131.362587][ T60] freed 2048-byte region [ffff888033584000, ffff888033584800) [ 131.362608][ T60] [ 131.362612][ T60] The buggy address belongs to the physical page: [ 131.362628][ T60] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888033585000 pfn:0x33580 [ 131.362653][ T60] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 131.362669][ T60] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 131.362691][ T60] page_type: f5(slab) [ 131.362709][ T60] raw: 0080000000000240 ffff88813fe17000 ffffea0000d26e10 ffff88813fe15c88 [ 131.362727][ T60] raw: ffff888033585000 0000000800080005 00000000f5000000 0000000000000000 [ 131.362745][ T60] head: 0080000000000240 ffff88813fe17000 ffffea0000d26e10 ffff88813fe15c88 [ 131.362762][ T60] head: ffff888033585000 0000000800080005 00000000f5000000 0000000000000000 [ 131.362780][ T60] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 131.362796][ T60] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 131.362806][ T60] page dumped because: kasan: bad access detected [ 131.362820][ T60] page_owner tracks the page as allocated [ 131.362827][ T60] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5612, tgid 5612 (syz-executor), ts 78431123883, free_ts 64319440899 [ 131.362860][ T60] post_alloc_hook+0x1f9/0x250 [ 131.362884][ T60] get_page_from_freelist+0x27d6/0x2850 [ 131.362902][ T60] __alloc_frozen_pages_noprof+0x18d/0x380 [ 131.362918][ T60] allocate_slab+0x74/0x5e0 [ 131.362937][ T60] refill_objects+0x33c/0x3d0 [ 131.362955][ T60] __pcs_replace_empty_main+0x373/0x720 [ 131.362976][ T60] __kmalloc_node_track_caller_noprof+0x60b/0x7e0 [ 131.363003][ T60] pskb_expand_head+0x230/0x1390 [ 131.363023][ T60] netlink_trim+0x1b3/0x2c0 [ 131.363048][ T60] netlink_broadcast_filtered+0x80/0xea0 [ 131.363074][ T60] nlmsg_notify+0xf0/0x1a0 [ 131.363100][ T60] __dev_notify_flags+0xf2/0x310 [ 131.363127][ T60] rtnl_newlink_create+0x657/0xb70 [ 131.363143][ T60] rtnl_newlink+0x166a/0x1bb0 [ 131.363174][ T60] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 131.363200][ T60] netlink_rcv_skb+0x232/0x4b0 [ 131.363226][ T60] page last free pid 5489 tgid 5489 stack trace: [ 131.363237][ T60] __free_frozen_pages+0x1075/0x11b0 [ 131.363261][ T60] __slab_free+0x252/0x2a0 [ 131.363287][ T60] qlist_free_all+0x99/0x100 [ 131.363309][ T60] kasan_quarantine_reduce+0x148/0x160 [ 131.363331][ T60] __kasan_slab_alloc+0x22/0x80 [ 131.363356][ T60] kmem_cache_alloc_noprof+0x33b/0x680 [ 131.363381][ T60] vm_area_dup+0x2b/0x670 [ 131.363397][ T60] dup_mmap+0x8b7/0x1d50 [ 131.363423][ T60] copy_mm+0x13b/0x4a0 [ 131.363448][ T60] copy_process+0x1f24/0x4450 [ 131.363474][ T60] kernel_clone+0x2d7/0x940 [ 131.363489][ T60] __x64_sys_clone+0x1b6/0x230 [ 131.363505][ T60] do_syscall_64+0x15f/0xf80 [ 131.363525][ T60] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.363543][ T60] [ 131.363548][ T60] Memory state around the buggy address: [ 131.363558][ T60] ffff888033584680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 131.363571][ T60] ffff888033584700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 131.363584][ T60] >ffff888033584780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 131.363594][ T60] ^ [ 131.363605][ T60] ffff888033584800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 131.363617][ T60] ffff888033584880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 131.363627][ T60] ================================================================== [ 131.363641][ T60] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 131.363660][ T60] CPU: 0 UID: 0 PID: 60 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 131.363682][ T60] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 131.363695][ T60] Workqueue: hci0 hci_rx_work [ 131.363717][ T60] Call Trace: [ 131.363724][ T60] [ 131.363733][ T60] vpanic+0x56c/0xa60 [ 131.363762][ T60] ? __pfx_vpanic+0x10/0x10 [ 131.363793][ T60] panic+0xc5/0xd0 [ 131.363817][ T60] ? __pfx_panic+0x10/0x10 [ 131.363844][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 131.363865][ T60] ? rcu_is_watching+0x15/0xb0 [ 131.363892][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 131.363917][ T60] check_panic_on_warn+0x89/0xb0 [ 131.363941][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 131.363961][ T60] end_report+0x73/0x170 [ 131.363990][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 131.364010][ T60] kasan_report+0x128/0x150 [ 131.364041][ T60] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 131.364066][ T60] l2cap_sock_new_connection_cb+0x208/0x2f0 [ 131.364088][ T60] l2cap_connect_cfm+0x368/0x1560 [ 131.364121][ T60] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 131.364149][ T60] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 131.364177][ T60] ? lockdep_hardirqs_on+0x7a/0x110 [ 131.364198][ T60] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 131.364220][ T60] ? mutex_lock_nested+0x152/0x1d0 [ 131.364246][ T60] ? hci_connect_cfm+0x2c/0x140 [ 131.364270][ T60] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 131.364300][ T60] hci_connect_cfm+0x95/0x140 [ 131.364325][ T60] le_conn_complete_evt+0x1134/0x16b0 [ 131.364356][ T60] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 131.364385][ T60] ? rt_mutex_slowunlock+0x201/0x300 [ 131.364412][ T60] ? skb_pull_data+0xfb/0x200 [ 131.364437][ T60] hci_le_conn_complete_evt+0x187/0x470 [ 131.364466][ T60] hci_event_packet+0x659/0xef0 [ 131.364489][ T60] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 131.364516][ T60] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 131.364540][ T60] ? __pfx_hci_event_packet+0x10/0x10 [ 131.364559][ T60] ? rt_spin_unlock+0x14f/0x200 [ 131.364591][ T60] ? hci_send_to_monitor+0xe2/0x590 [ 131.364620][ T60] hci_rx_work+0x3ee/0x1040 [ 131.364641][ T60] ? preempt_schedule_thunk+0x16/0x40 [ 131.364663][ T60] process_one_work+0xa31/0x1980 [ 131.364696][ T60] ? process_one_work+0x8d5/0x1980 [ 131.364727][ T60] ? __pfx_process_one_work+0x10/0x10 [ 131.364752][ T60] ? do_raw_spin_lock+0x12b/0x2f0 [ 131.364788][ T60] worker_thread+0xba8/0x11e0 [ 131.364827][ T60] kthread+0x388/0x470 [ 131.364848][ T60] ? __pfx_worker_thread+0x10/0x10 [ 131.364875][ T60] ? __pfx_kthread+0x10/0x10 [ 131.364896][ T60] ret_from_fork+0x514/0xb70 [ 131.364920][ T60] ? __pfx_ret_from_fork+0x10/0x10 [ 131.364943][ T60] ? __switch_to+0xc79/0x1410 [ 131.364963][ T60] ? __pfx_kthread+0x10/0x10 [ 131.364984][ T60] ret_from_fork_asm+0x1a/0x30 [ 131.365018][ T60] [ 131.365640][ T60] Kernel Offset: disabled