last executing test programs: 4.818939201s ago: executing program 3 (id=159): r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000005c0), 0x40000000008d82, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 4.671491645s ago: executing program 3 (id=162): sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4c000) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000100)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000080)) sendmmsg(r0, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) 4.568088907s ago: executing program 1 (id=164): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000bc0)={0x2, 0x0, @ioapic={0x33325000, 0xb, 0xa, 0xfffffffe, 0x0, [{0xc, 0x6, 0x7, '\x00', 0xb4}, {0x83, 0x7, 0x4, '\x00', 0x4b}, {0xfc, 0xe, 0x7, '\x00', 0xf8}, {0x0, 0x9, 0x40, '\x00', 0x7}, {0x8, 0x10, 0x8, '\x00', 0xa8}, {0x2, 0x2f, 0x6, '\x00', 0xff}, {0x6, 0xe, 0x47, '\x00', 0x6}, {0x5, 0x8c, 0x4, '\x00', 0xe9}, {0xe, 0x4, 0x8, '\x00', 0xff}, {0x5, 0x7, 0x6, '\x00', 0x4}, {0x2, 0xd, 0x15, '\x00', 0x8}, {0x6, 0x7, 0x6, '\x00', 0x7}, {0x4, 0x8a, 0x80, '\x00', 0xdd}, {0x3, 0xf1, 0x6, '\x00', 0x9}, {0x7, 0x65, 0xb, '\x00', 0xfd}, {0x6, 0x9b, 0x19, '\x00', 0x5}, {0x7, 0x2, 0x4, '\x00', 0xc}, {0xef, 0x6, 0x9, '\x00', 0xd}, {0xc, 0x6, 0x6, '\x00', 0x9}, {0x9, 0x3, 0x3, '\x00', 0x4}, {0x1, 0x3, 0x7, '\x00', 0x4}, {0x1d, 0x40, 0x7, '\x00', 0x6}, {0xfe, 0xfd, 0x7, '\x00', 0xfe}, {0x92, 0x6, 0xfa}]}}) 4.3000852s ago: executing program 1 (id=167): connect$inet(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000380)=ANY=[], 0x1, 0x14fe, &(0x7f0000002a80)="$eJzs3AuYjlXXOPC99t43Y5r0NMlh2GuvmycNtkmSHBJySJIkSXJKSJokSUgMOSUNSchxkhyGkBymMWmcz4eckyavNEkSEhL2/9J78L5v7/f1ff/e/993fbN+17Wv2WvuZ61n3bPmmue+n+ua57ueo+q1qF+7GRGJPwT+/CVFCBEjhBgmhLhOCBEIISrFV4q/fLyAgpQ/9iTs3+vh9KvdAbuaeP55G88/b+P55208/7yN55+38fzzNp5/3sbzZywv2z6n2PW88u7i9//zMn79/18kt/zkrzaWv7HXfyOF55+38fzzNp5/3sbzz9t4/nkbz/9/v1r/yTGef97G82csL9sOWoj/Ae9D87o662r//jHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYyxvO+Su0EOKv+6vdF2OMMcYYY4wxxv59fP6r3QFjjDHGGGOMMcb+3wMhhRJaBCKfyC9iRAERK64RceJaUVBcJyLiehEvbhCFxI2isCgiiopiIkEUFyWEESisIBGKkqKUiIqbRGlxs0gUZURZUU44UV4kiVtEBXGrqChuE5XE7aKyuENUEVVFNVFd3ClqiLtETVFL1BZ3izqirqgn6ot7RANxr2go7hONxP2isXhANBEPiqbiIdFMPCyai0dEC/GoaCkeE61Ea9FGtBXt/q/yXxJ9xcuin+gvUsQAMVC8IgaJwWKIGCqGiVfFcPGaGCFeF6lipBgl3hCjxZtijHhLjBXjxHjxtpggJopJYrKYIqaKNPGOmCbeFdPFe2KGmClmidkiXcwRc8X7Yp6YLxaID8RC8aFYJBaLJWKpyBAfiUyxTGSJj8Vy8YnIFivESrFKrBZrxFqxTqwXG8RGsUlsFlvEVrFNbBefih1ip9gldos9Yq/YJz4T+8Xn4oD4QuSIL/+b+Wf/Kb8XCBAgQYIGDfkgH8RADMRCLMRBHBSEghCBCMRDPBSCQlAYCkNRKAoJkAAloAQgIBAQlISSEIUolIbSkAiJUBbKggMHSZAEFeBWqAgVoRJUgspQGapAVagK1aE61IAaUBNqQm2oDXWgDtSDenAP3AP3QkNoCI2gETSGxtAEmkBTaArNoBk0h+bQAlpAS2gJraAVtIE20A7aQXtoDx2gA3SCTtAZOkMX6ALJkAxdoSt0g27QHbpDD+gBPaEn9ILe0BtegpfgZXgZ+kMdOQAGwkAYBINgCAyFofAqDIfX4DV4HVJhJIyCN+ANeBPGwBkYC+NgPIyHGnIiTILJQHIqpEEaTINpMB2mwwyYCTNhNqTDHJgLc2EezIf58AEshA/hQ1gMi2EpZEAGZMIyyIIsWA5nIRtWwEpYBathDayGdbAe1sFG2AQbYQtsgW2wDT6FT2En7ITdsBv2wl74DD6Dz+FzSIUcyIGDcBAOwSE4DIchF3LhCByBo3AUjsExOA7H4QSchFNwEk7DaTgDZ+EcnIPzcB4uwAsJ3zTfW2ZDqpCXaallPplPxsgYGStjZZyMkwVlQRmRERkv42UhWUgWloVlUVlUJsgEWUKWkChRkgxlSVlSRmVUlpalZaJMlGVlWemkk0kySVaQFWRFWVFWkrfLyvIOWUVWlR1ddVld1pCdXE1ZS9aWtWUdWVfWk/VlfdlANpANZUPZSDaSjWVj2UQ+KJvKATAEHpaXJ9NCjoSWchS0kq1lG9lWvgmPy/ZyDHSQHWUn+aQcB2Ohi2zvkuUzsqucBN3kc3IyPC97yKnQU74oe8neso98SfaVHVw/2V/OgAFyoJwNg+RgOUQOlfOgrrw8sXrydZkqR8pR8g25FN6UY+RbcqwcJ8fLt+UEOVFOkpPlFDlVpsl35DT5rpwu35Mz5Ew5S86W6XKOnCvfl/PkfLlAfiAXyg/lIrlYLpFLZYb8SGbKZTJLfiyXy09ktlwhV8pVcrVcI9fKdXK93CA3yk1ys9wit8ptcrv8VO6QO+UuuVvukXvlPvmZ3C8/lwfkFzJHfikPyj/JQ/IreVh+LXPlN/KI/FYeld/JY/J7eVz+IE/Ik/KU/FGelj/JM/KsPCd/luflL/KCvCgvSS+FAiWVUloFKp/Kr2JUARWrrlFx6lpVUF2nIup6Fa9uUIXUjaqwKqKKqmIqQRVXJZRRqKwiFaqSqpSKqptUaXWzSlRlVFlVTjlVXiWpW1QFdauqqG5TldTtqrK6Q1VRVVU1VV3dqWqou1RNVUvVVnerOqquqqfqq3tUA3WvaqjuU43U/aqxekA1UQ+qpuoh1Uw9rJqrR1QL9ahqqR5TrVRr1Ua1Ve3U46q9ekJ1UB1VJ/Wk6qyeUl3U0ypZPaO6qmdVN/Wc6q6eVz3UC6qnelH1Ur1VH3VRXVJe9VP9VYoaoAaqV9QgNVgNUUPVMPWqGq5eUyPU6ypVjVSj1BtqtHpTjVFvqbFqnBqv3lYT1EQ1SU1WU9RUlabeUdPUu2q6ek/NUDPVLDVbpas5ashfKi34L+S/+y/yR/z67NvUdvWp2qF2ql1qt9qj9qp9ap/ar/arA+qAylE56qA6qA6pQ+qwOqxyVa46oo6oo+qoOqaOqePquDqhTqqf1Y/qtPpJnVFn1Vn1szqvzqsLf/kZCA1aaqW1DnQ+nV/H6AI6Vl+j4/S1uqC+Tkf09Tpe36AL6Rt1YV1EF9XFdIIurktoo1FbTTrUJXUpHdU36dL6Zp2oy+iyupx2urxO0rf84fzf66+dbqfb6/a6g+6gO+lOurPurLvoLjpZJ+uuuqvuprvp7rq77qF76J66p+6le+k+uo/uq/vqfrqfTtEpeqB+RQ/Sg/UQPVQP06/q4Xq4HqFH6FSdqkfpUXq0Hq3H6DF6rB6rx+vxeoKeoCfpSXqKnqLTdJqepqfp6Xq6nqFn6Fl6lk7X6Xqunqvn6Xl6gV6gF+qFepFepJfoJTpDZ+hMnamzdJZerpfrbL1Cr9Cr9Cq9Rq/R6/Q6vUFv0Jv0Jr1Fb9HZervernfoHXqX3qX36D16n96n9+v9+oA+oHN0jj6oD+pD+pA+rA/rXJ2rj+gj+qg+qo/pY/q4Pq5P6BP6lD6lT+vT+ow+o8/pc/q8Pq8v6Av6kr50+bIvkIEMdKCDfEG+ICaICWKD2CAuiAsKBgWDSBAJ4oP4oFBwY1A4KBIUDYoFCUHxoERgAgxsQEEYlAxKBdHgpqB0cHOQGJQJygblAheUD5KCW4IKwa1BxeC2oFJwe1A5uCOoUkAE1YLqwZ1BjeCuoGZQK6gd3B3UCeoG9YL6wT1Bg+DeoGFwX9AouD9oHDwQNAkeDJoGDwXNgoeD5sEjQYvg0aBl8FjQKmgdtAnaBu3+uX5Q9Q/U9/5MkSdcP9PfpJgBZqB5xQwyg80QM9QMM6+a4eY1M8K8blLNSDPKvGFGmzfNGPOWGWvGmfHmbTPBTDSTzGQzxUw1aeYdM828a6ab98wMM9PMMrNNuplj5pr3zTwz3ywwH5iF5kOzyCw2S8xSk2E+MplmmckyH5vl5hOTbVaYlWaVWW3WmLVmnVlvNpiNZpPZbLaYrWab2W4+NTvMTrPL7DZ7zF6zz3xm9pvPzQHzhckxX5qD5k/mkPnKHDZfm1zzjTlivjVHzXfmmPneHDc/mBPmpDllfjSnzU/mjDlrzpmfzXnzi7lgLppLxl++uL/88o4aNebDfBiDMRiLsRiHcVgQC2IEIxiP8VgIC2FhLIxFsSgmYAKWwBJ4GSFhSSyJUYxiaSyNiZiIZbEsOnSYhElYAStgRayIlbASVsbKWAWrYDWshnfinXgX3oW1sBbejXdjXayL9bE+NsAG2BAbYiNshI2xMTbBJtgUm2IzbIbNsTm2wBbYEltiK2yFbbANtsN22B7bYwfsgJ2wE3bGztgFu2AyJmNX7IrdsBt2x+7YA3tgT+yJvbAX9sE+2Bf7Yj/shymYggNxIA7CQTgEh+AwHIbDcTiOwBGYiqk4CkfhaByNY3AMjsVxOB7fxgk4ESfhZJyCUzEN03AaTsPpOB1n4AychbMwHdNxLs7FeTgPF+ACXIgLcREuwiW4BDMwAzMxE7MwC5fjcszGbFyJK3E1rsa1uBbX43rciBtxM27GrbgVt+N23IE7cBfuwj24B/fhPtyP+/EAHsAczMGDeBAP4SE8jIcxF3PxCB7Bo3gUj+ExPI7H8QSewFN4Ck/jaTyDZ/AcnsPz+AtewIt4CT3GWCli7TU2zl5rC9rrbIwtYP8+LmqL2QRb3Jawxha2Rf4hRmttoi1jy9py1tnyNsne8pu4iq1qq9nq9k5bw95la/4mbmDvtQ3tfbaRvd/Wt/f8Q9zYPmCb2EdtU/uYbWZb2+a2rW1hH7Ut7WO2lW1t29i2trN9ynaxT9tk+4ztap/9TZxpl9n1doPdaDfZ/fZze87+bI/a7+x5+4vtZ/vbYfZVO9y+ZkfY122qHfmbeLx9206wE+0kO9lOsVN/E8+ys226nWPn2vftPDv/N3GG/cgutFl2kV1sl9ilv8aXe8qyH9vl9hObbVfYlXaVXW3X2LV23d96XWW32K12m91nP7M77E67y+62e+zeX+PL53HAfmFz7Jf2iP3WHrJf2cP2mM213/waXz6/Y/Z7e9z+YE/Yk/aU/dGetj/ZM/bsr+d/+dx/tBftJeutICBJijQFlI/yUwwVoFi6huLoWipI11GErqd4uoEK0Y1UmIpQUSpGCVScSpAhJEtEIZWkUhSlm6g03UyJVIbKUjlyVJ6S6BaqQLdSRbqNKtHtVJnuoCpUlapRdbqTatBdVJNqUW26m+pQXapH9ekeakD3UkO6jxrR/dSYHqAm9CA1pYeoGT1MzekRakGPUkt6jFpRa2pDbakdPU7t6QnqQB2pEz1Jnekp6kJPUzI9Q13pWepGz1F3ep560AvUk16kXtSb+tBL1Jdepn7Un1JoAA2kV2gQDaYhNJSG0as0nF6jEfQ6pdJIGkVv0Gh6k8bQWzSWxtF4epsm0ESaRJNpCk2lNHqHptG7NJ3eoxk0k2bRbEqnOTSX3qd5NJ8W0Ae0kD6kRbSYltBSyqCPKJOWURZ9TMvpE8qmFbSSVtFqWkNraR2tpw20kTbRZtpCW2kbbadPaQftpF20m/bQXtpHn9F++pwO0BeUQ1/SQfoTHaKv6DB9Tbn0DR2hb+kofUfH6Hs6Tj/QCTpJp+hHOk0/0Rk6S+foZzpPv9AFukiXyJMIIZShCnUYhPnC/GFMWCCMDa8J48Jrw4LhdWEkvD6MD28IC4U3hoXDImHRsFiYEBYPS4QmxNCGFIZhybBUGA1vCkuHN4eJYZmwbFgudGH5MCm8JawQ3hpWDG8LK4W3h5XDO8IqYdXw0furh3eGNcK7wpphrbB2eHdYJ6wb1gvrh/eEDcJ7w4bhfWGj8P6wYvhA2CR8MGwaPhQ2Cx8Om4ePhC3CR8OW4WNhq7B12CZsG7YLHw/bh0+EHcKOYafwybBz+FTYJXw6TA6fCbuGz/7u8ZRwQDgwfCV8JfT+PrUkujSaEf0omhldFs2KfhxdHv0kmh1dEV0ZXRVdHV0TXRtdF10f3RDdGN0U3RzdEt0a3Rb1vn5+4cBJp5x2gcvn8rsYV8DFumtcnLvWFXTXuYi73sW7G1whd6Mr7Iq4oq6YS3DFXQlnHDrryIWupCvlou4mV9rd7BJdGVfWlXPOlXdJrq1r59q59u4J18F1dJ3ck+5J95R7yj3tnnbPuK7uWdfNPee6u+ddD/eCe8G96Hq53q6Pe8n1dS+7fq6/S3EpbqAb6Aa5QW6IG+KGuWFuuBvuRrgRLtWlulFulBvtRrsxbowb68a68W68m+AmuElukpviprg0l+amuWluupvuZrgZbpab5dJdupvr5rp5bp5b4Ba4hYkL3SK3yC1xS1yGy3CZLtNluSy33C132S7brXQr3Wq32q11a916t95tdBvdZrfZbXVb3Xa33e1wO9wut8vtcXvcPrfP7Xf73QF3wOW4HHfQHXSH3CF32H3tct037oj71h1137lj7nt33P3gTriT7pT70Z12P7kz7qw75352590v7oK76C4579Ii70SmRd6NTI+8F5kRmRmZFZkdSY/MicyNvB+ZF5kfWRD5ILIw8mFkUWRxZElkaSQj8lEkM7IskhX5OLI88kkkO7IisjKyKrI6sibiffEdoS/pS/mov8mX9jf7RF/Gl/XlvPPlfZK/xVfwt/qK/jZfyd/uK/s7fBVf1Vfzj/lWvrVv49v6dv5x394/4Tv4jr6Tf9J39k/5Lv5pn+yf8V39s76bf85398/7Hv4F39O/6Hv53r6Pf8n39S/7fr6/T/ED/ED/ih/kB/shfqgf5l/1w/1rfoR/3af6kX6Uf8OP9m/6Mf4tP9aP8+P9236Cn+gn+cl+ip/q0/w7fpp/10/37/kZfqaf5Wf7dD/Hz/Xv+3l+vl/gP/AL/Yd+kV/sl/ilPsN/5DP9Mp/lP/bL/Sc+26/wK/0qv9qv8Wv9Or/eb/Ab/Sa/2W/xW/02v91/6nf4nX6X3+33+L1+n//M7/ef+wP+C5/jv/QH/Z/8If+VP+y/9rn+G3/Ef+uP+u/8Mf+9P+5/8Cf8SX/K/+hP+5/8GX/Wn/M/+/P+F3/BX/SX+H/WGGOMMcb+S9TvHB/wL74n/7IuGyiEuHZnsdx/rrm58J/3g2VC54gQ4pn+PR/+66pTJyUl5S+PzVYiKLVYCBG5kp9PXIlXiE7iKZEsOooK/7K/wbL3efqd+tHbhYj9W+dCxIi/xn9f/9b/oP7jT47PrByei/9P6i8WIrHUlZwC4kp8pX7F/6B+kfa/03+Br9KE6PB3OXHiSnylfpJ4Qjwrkv/hkYwxxhhjjDHG2J8NltW6/9798+X78wR9JSe/uBL/3v05Y4wxxhhjjDHGrr7ne/d5+vHk5I7decMb3vDmb5ur/ZeJMcYYY4wx9u925aL/anfCGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4zlXf8/Pk7sap8jY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxdrX9nwAAAP//JhA6YA==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8042, 0x60) r1 = open(&(0x7f0000000240)='./file1\x00', 0xcd042, 0x0) sendfile(r1, r0, 0x0, 0x80000000c) 4.231335977s ago: executing program 3 (id=168): socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$inet6(0xa, 0x80001, 0x0) socket$inet6(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000040000000c"], 0x50) socket$l2tp6(0xa, 0x2, 0x73) socket$key(0xf, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', @ANYRES32=r0], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x802) 4.07582572s ago: executing program 3 (id=170): syz_mount_image$msdos(&(0x7f0000000140), &(0x7f0000001080)='./bus\x00', 0x80, &(0x7f0000000600)=ANY=[@ANYBLOB="666c7573682c6e6f646f74732c646973636172642c646d61736b3d30303030303030303030303030303030303030303030322c646d61736b3d30303030303030303030303030303030303030303137372c646f74732c6e6f646f74732c71756965742c646f74732c0023c3cb4d2e3cbf18508098fe0de2af38db67d42d1bc4ab714d52f019082433fc9ca2d7174b2c4ece31c9f4c7a4d53914e100"/167], 0x1, 0x140, &(0x7f0000000000)="$eJzs27Fq21AUBuDj2m3ddvFcOgi6dDJtn6CluFAqaEnwkEwJOFnsYIgXJZMfJS8YCJ683ZAo2Imxhwy2IPq+RT/8CO4dpMMV6OjT2XAwnpyO/8+i3WhE60dkMW9EJ15FM0rTAABeknlKcZNSSm+n8e4qUkpVrwgA2DbzHwDqx/wHgPox/wGgfvYPDv/+zPPeXpa1I66nRb/ol9ey//0n733N7nWWd82Kot9c9N/KPnvav473D/33tf2b+PK57O+6X//ylf5DDLa/fQAAAKiFbraw9nzf7W7qy/To+8DK+b0VH1s72wYA8AyTi8vh8Wh0ci4IgrAIVb+ZgG1bPvRVrwQAAAAAAAAAAAAAANhkF78TVb1HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHUbAAD//0DvUik=") syz_read_part_table(0x5e4, &(0x7f0000000000)="$eJzs3D2LXFUYB/D/uXfeFiLrBxBcSCMKRrETF2Oha7og2gnaWqxILMRCdgcVwZcPYCtaGIUQawUFCWKsrERYYiFib2GacGTuy0xAsZlFCfx+xZznnHue57mXe9sz4c5Wd5Nakuvd7KO2GybNw33wW/L2NFm+8EQy7xOmQ2JJ8tzlJ5+6sHexzNdrq9Xj4ep802U2jJPsDdGXk3xw+eCdLj5OyVGGMNPPZ5ms9tY+78O/3/TNkrbbw/9s8nXtX8QsP+aLJIelXb38ebLMJ8ndWXT7ziVpa63daz5OdpJ2/VVs4cr+teXjQ7yT4Uub9rOjd0t9aLg2Ta21Njk6O2a2yT2Pnbv0T0W7/GX3eONSrXV6ZsxtNhcOb80mw+yR7345ynKxrp7abEqe7CSvnDzzYHcnpa8x3f7xAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Zfe9ev83zTg53/2Wdfz0p2k2W49z7zreW5xS/yv713bffOtSk9f3X/rp5Td+Pfg9fyRp2xycSebrfS/2w9X3umEyrLZb9z+81cw++/jbnfXCULok35/9+WYdO5wM42uP3pa832zdHwAAAAAAAAAAAAAAAAAAAFau5sLexSbPfnWj5PlsjvvXLJJSxukiqbXWP2tnPPz/w3gOP9dvpKySUsvt1c8nu3cldf7+A93fCvSJtdZJ16L8J4/Iv/grAAD//x/vY/E=") mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143581, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) 3.951296888s ago: executing program 1 (id=171): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="180000002500010324bd5f02ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmsg(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000580)=""/4089, 0xff9}], 0x1}, 0x2000) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000000), 0x10) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, &(0x7f00000000c0), 0xf00) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0x0) 3.947514197s ago: executing program 2 (id=173): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000dc0)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000800)=""/90}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000380)={0x0, 0x3ff, 0x5}) socket$inet6_mptcp(0xa, 0x1, 0x106) sched_setscheduler(0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x100400000000000, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) 3.803540772s ago: executing program 3 (id=175): sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)={0x28, 0x3, 0x8, 0x101, 0x0, 0x0, {}, [@CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @fccp=[@CTA_TIMEOUT_DCCP_CLOSEREQ={0x8, 0x5, 0x1, 0x0, 0xfffffffe}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}]}, 0x28}}, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x20902, 0x0) write$sequencer(r0, &(0x7f0000000200)=ANY=[], 0x10) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000005c0), 0x40000000008d82, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r1, 0xc0045009, 0x0) keyctl$restrict_keyring(0x1d, 0xfffffffffffffffd, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)='#,d\x00') socket$nl_route(0x10, 0x3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f00000012c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109024a0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009", @ANYRESHEX], 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$rtl8150(r2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27}, 0x94) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000300)=@ethtool_dump={0x3e, 0x0, 0x2}}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'dummy0\x00', 0x4000}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r3, 0x8b1b, &(0x7f0000000040)) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r4, 0x40015b19, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1}) 3.79575367s ago: executing program 2 (id=177): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000000b2e2b5ab40bf85edaca83"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x44, &(0x7f0000000580)=ANY=[@ANYBLOB="000301"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x104, 0x8080) ioctl$HIDIOCSFLAG(r1, 0x4004480f, &(0x7f0000000040)=0x3) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) 3.750145252s ago: executing program 0 (id=178): ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x141091, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) chdir(&(0x7f00000001c0)='./bus\x00') rmdir(&(0x7f0000000380)='./file0/../file0\x00') 3.692197682s ago: executing program 1 (id=179): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x19, 0x3, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) fsmount(r0, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket(0x1e, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x103081, 0x0) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000017c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r1, @ANYBLOB='\a'], 0x0) 3.636068632s ago: executing program 0 (id=181): r0 = syz_io_uring_setup(0x10d, &(0x7f00000003c0)={0x0, 0xbcb7, 0x80, 0x803, 0x1000}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_LINKAT={0x27, 0x18, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, 0x400}) io_uring_enter(r0, 0x3516, 0x3e44, 0x8, 0x0, 0x0) 3.532105614s ago: executing program 0 (id=183): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f0100000000000000000006241a0000000905810300020000000904010000020d00000904010102020d00000905820300028000000905c30cfb"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 3.200174655s ago: executing program 2 (id=187): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)=0x5) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, 0x0) 3.199858575s ago: executing program 2 (id=189): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12014101f2c59620d016b8108ede0102030109022400010000100009040002020083ec0009050602000202000a09058202"], 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x400401, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000005c0)=[@text64={0x40, &(0x7f0000000300)="0f225c66b876000f00d8c4c179174cfa3566b870000f00d8c7442400eb000000c7442402ee000000ff2c2448b8f1d00000000000000f23d00f21f835300000000f23f8640f01c9c44159fc4904f2d3253327000066420f388062dc", 0x5b}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c4a616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$tipc(0x1e, 0x5, 0x0) ioctl$HIDIOCSREPORT(0xffffffffffffffff, 0x400c4808, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r3, 0x4048587b, &(0x7f0000000400)={{0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000040)={@align=0xffffffff, {0x0, 0x7fff, 0xe6e, 0x400}}, 0x6, 0x0, &(0x7f0000000180)=0x8}, 0x0, 0x0}) r7 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) getsockopt$CAN_RAW_FD_FRAMES(r6, 0x65, 0x5, &(0x7f0000001480), 0x0) write$UHID_CREATE(r7, &(0x7f0000000080)={0x0, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x0, 0x0, 0xa0, 0x6, 0x3, 0x5, 0x1635}}, 0x120) 1.952149755s ago: executing program 1 (id=192): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x40000) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x0, &(0x7f0000000100), 0xff, 0x4b6, &(0x7f0000000a80)="$eJzs3c9vVNUeAPDvnWnLb9rH4/EePNBRNBJ/tLSgsnChRhMXmpjoApe1LYgM1NCaCGm0GINLQ+LeuDTxL3DnxqgLY+JWE5eGhGhjQnFVc3/BdDot09Iytf18kmHOmXPn3vO9556ZM/dwbwPYtGrpP0nEzoj4OSJ68+z8BWr50+zM1MjNmamRJObmXvs9yZa7MTM1Ui5avm9HkTlSiah8lMSzycLtTly8dHa4Xh+7UOQHJs+9MzBx8dITZ84Nnx47PXZ+6MSJ48cGn35q6MlViTON68aB98cP7n/pjauvjJy8+uZ3X6bV2ncoL2+M445utgiohVq61/6YyzSXPbyMuv8T7GpIJ10drAjLUo2ItLm6s/7fG9W43Xi98eKHHa0csKbS76YtixdPzwEbWBKdrgHQGeUXffr7t3zco6HHunD9uYieIj07MzUyeyv+rqgUr3ev4fZrEXFy+q/P0kcs9zwEAMAKZGObx1uN/yqxL3vO5zp2F3MofRHxr4jYExH/joi9EfGfiGzZ/0ZP/C9/81xvm9uvNeUXjn8q11rWeZWk479nGsZ+sw3xF0991SK3K4u/Ozl1pj52tNgnR6J7S5ofXGIbX7/w0yeLlTWO/9JHuv1yLFhU4FpX0wm60eHJ4dXaCdcvRxzoahV/cmsmID0C9kfEgeWtenc+uxBx5tEvDi620J3jX8IqzDPNfR7xSN7+09EUfylZen5yYGvUx44OlEfFQt//eOXVItnTXHZX8a+CtP23zz/+i5LLxXPvn0k+X9sd9frYhYnlb+PKLx8v+ptmpcd/T/J6Nmf9w1v5a+8NT05eGIzoSV7O8uWOzl4fuv3eMl8un8Z/5HDr/r+neE8a//8jIj2ID0XEfRFxf1H3ByLiwYg4vET83z7/0NtLxJ9EEh1t/9GWn39JxNYs0Zc0ztevIFE9+81Xi82Yt9f+x2M6+6zNZZ9/d9BuBe9+DwIAAMD6V4mInZFU+vN0bWdUKv39+f/h3xvbK/XxicnHTo2/e340v0agL7or5Zmu3obzoYPJdLHGPD9UnCsuy48V540/rW7L8v0j4/XRDscOm92O+f0/sv5fTH38Vu107YA153ot2Lya+3+lQ/UA7r12vv/9FoCNqUX/39aJegD3nt//sHm16v8fNOWN/2FjWtj/f21xyzpgI1ru+N8NHmHj0J1h89L/YVNq9yr+8n4KK74JwLxEebHAytezte0r/NdforYmay5baC0rvy1uvxKVVVvz9DpolHWRqEZE66K0x6xkzbG7/XthzE/Mu1lNe3/wAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYB36OwAA//8Dq+BG") sched_setscheduler(0x0, 0x1, 0x0) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000000), 0x651, 0x0) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="040e04d63d20"], 0x7) 1.761220591s ago: executing program 1 (id=193): syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904e4ff1107"], 0x0) close(0x3) syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x4, 0x0, 0x2}}]}}, 0x0) 1.339149617s ago: executing program 4 (id=197): syz_usb_connect(0x0, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="120100008e77e3405c1b0501f101010203010902240001000000000904000002a4d36f00090504090000000000090507"], 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, 0x0, 0x0) 948.146928ms ago: executing program 0 (id=198): r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000040)='./cgroup.cpu/cgroup.procs\x00', 0x6000516) setxattr$trusted_overlay_redirect(&(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000180), 0x0, 0x0, 0x0) 947.938648ms ago: executing program 0 (id=199): syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000480)=ANY=[], 0x8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x1fff, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='batadv0\x00', 0x10) write(r1, &(0x7f0000000140)="8465000000000000", 0x5ac) mkdirat$cgroup(r0, &(0x7f0000000080)='syz0\x00', 0x1ff) openat$cgroup(r0, &(0x7f0000000280)='syz0\x00', 0x200002, 0x0) syz_usb_connect(0x3, 0x73, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x20, r3, 0x1, 0x70bd2b, 0x0, {0x1a}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) 784.975989ms ago: executing program 4 (id=200): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x5}, @TCA_FQ_FLOW_PLIMIT={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) syz_io_uring_setup(0x111, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 661.471087ms ago: executing program 3 (id=201): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x200ce0c0) syz_emit_vhci(0x0, 0x16) ppoll(&(0x7f00000000c0)=[{r0, 0x60}], 0x1, 0x0, 0x0, 0x0) 540.248356ms ago: executing program 4 (id=202): r0 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x800, 0xffffffff, 0x3b1}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_CLOSE={0x13, 0x59}) io_uring_enter(r0, 0x47f6, 0x0, 0x0, 0x0, 0x0) 501.373399ms ago: executing program 4 (id=203): r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x1e2b, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) 448.03817ms ago: executing program 4 (id=204): r0 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000000), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000180)=@v1={0x0, @aes256, 0x4, @auto="b6f964631862f0c3"}) 228.144211ms ago: executing program 0 (id=205): syz_mount_image$vfat(&(0x7f00000006c0), &(0x7f00000001c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, &(0x7f0000000080)) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x3, @loopback}, 0x80004, 0x0, 0xffffffff}}, 0x2e) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x6, 0x8, 0x8}, 0x50) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f0000000000)={0x1, 0x0, [{0x1, 0x2, 0x80, 0xfffffff9, 0xeaa}]}) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0xa0c, 0x0, 0xffffffff}]}) 157.783128ms ago: executing program 4 (id=206): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file0\x00', 0x1c0) r0 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000200)={0x100}, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0/file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000280)={0x100, r1}, 0x0) close(r1) close(0xffffffffffffffff) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x200000, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) close(r0) 154.389478ms ago: executing program 2 (id=207): r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x80000, 0x0) preadv(r0, &(0x7f00000000c0)=[{&(0x7f0000033a80)=""/102380, 0x18fec}], 0x1, 0x0, 0x4) 0s ago: executing program 2 (id=208): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x400, @empty, 0x100001}, 0x1c) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f00004e220000000058000b480400945f64009400050038925a01000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.25' (ED25519) to the list of known hosts. [ 52.619365][ T4171] cgroup: Unknown subsys name 'net' [ 52.764342][ T4171] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 54.132530][ T4171] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 55.592844][ T4184] chnl_net:caif_netlink_parms(): no params data found [ 55.657871][ T4187] chnl_net:caif_netlink_parms(): no params data found [ 55.701566][ T4194] chnl_net:caif_netlink_parms(): no params data found [ 55.749826][ T4193] chnl_net:caif_netlink_parms(): no params data found [ 55.774220][ T4184] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.781881][ T4184] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.790492][ T4184] device bridge_slave_0 entered promiscuous mode [ 55.802476][ T4184] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.809561][ T4184] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.817408][ T4184] device bridge_slave_1 entered promiscuous mode [ 55.825289][ T4191] chnl_net:caif_netlink_parms(): no params data found [ 55.846652][ T4187] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.854096][ T4187] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.861937][ T4187] device bridge_slave_0 entered promiscuous mode [ 55.875497][ T4187] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.882818][ T4187] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.890679][ T4187] device bridge_slave_1 entered promiscuous mode [ 55.946001][ T4184] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.962685][ T4184] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.983172][ T4187] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.007614][ T4194] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.014989][ T4194] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.023203][ T4194] device bridge_slave_0 entered promiscuous mode [ 56.035185][ T4187] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.066641][ T4194] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.074082][ T4194] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.082234][ T4194] device bridge_slave_1 entered promiscuous mode [ 56.105334][ T4184] team0: Port device team_slave_0 added [ 56.111530][ T4193] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.118581][ T4193] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.126447][ T4193] device bridge_slave_0 entered promiscuous mode [ 56.158356][ T4194] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.171414][ T4184] team0: Port device team_slave_1 added [ 56.177348][ T4193] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.184819][ T4193] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.192945][ T4193] device bridge_slave_1 entered promiscuous mode [ 56.201642][ T4194] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.213143][ T4187] team0: Port device team_slave_0 added [ 56.219463][ T4191] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.226520][ T4191] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.234938][ T4191] device bridge_slave_0 entered promiscuous mode [ 56.272545][ T4187] team0: Port device team_slave_1 added [ 56.280515][ T4193] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.289724][ T4191] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.296783][ T4191] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.305516][ T4191] device bridge_slave_1 entered promiscuous mode [ 56.318701][ T4184] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.325745][ T4184] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.351736][ T4184] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.376187][ T4193] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.391986][ T4184] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.399233][ T4184] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.425492][ T4184] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.438477][ T4194] team0: Port device team_slave_0 added [ 56.457207][ T4187] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.464321][ T4187] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.490331][ T4187] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.503181][ T4191] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.517429][ T4194] team0: Port device team_slave_1 added [ 56.530644][ T4187] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.537606][ T4187] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.563986][ T4187] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.576677][ T4191] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.610202][ T4193] team0: Port device team_slave_0 added [ 56.621409][ T4191] team0: Port device team_slave_0 added [ 56.628873][ T4191] team0: Port device team_slave_1 added [ 56.641000][ T4194] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.647958][ T4194] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.674093][ T4194] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.691969][ T4193] team0: Port device team_slave_1 added [ 56.721378][ T4194] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.728334][ T4194] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.754357][ T4194] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.771138][ T4193] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.778116][ T4193] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.804337][ T4193] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.821662][ T4193] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.829323][ T4193] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.855318][ T4193] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.888368][ T4184] device hsr_slave_0 entered promiscuous mode [ 56.895369][ T4184] device hsr_slave_1 entered promiscuous mode [ 56.906018][ T4191] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.913315][ T4191] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.939573][ T4191] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.954504][ T4187] device hsr_slave_0 entered promiscuous mode [ 56.961402][ T4187] device hsr_slave_1 entered promiscuous mode [ 56.967837][ T4187] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 56.975624][ T4187] Cannot create hsr debugfs directory [ 56.998009][ T4194] device hsr_slave_0 entered promiscuous mode [ 57.004820][ T4194] device hsr_slave_1 entered promiscuous mode [ 57.011609][ T4194] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 57.019324][ T4194] Cannot create hsr debugfs directory [ 57.025278][ T4191] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 57.032355][ T4191] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 57.058406][ T4191] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 57.119397][ T4193] device hsr_slave_0 entered promiscuous mode [ 57.126150][ T4193] device hsr_slave_1 entered promiscuous mode [ 57.133010][ T4193] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 57.140968][ T4193] Cannot create hsr debugfs directory [ 57.231753][ T4191] device hsr_slave_0 entered promiscuous mode [ 57.238303][ T4191] device hsr_slave_1 entered promiscuous mode [ 57.245445][ T4191] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 57.253835][ T4191] Cannot create hsr debugfs directory [ 57.319484][ T7] Bluetooth: hci3: command 0x0409 tx timeout [ 57.326010][ T7] Bluetooth: hci1: command 0x0409 tx timeout [ 57.332294][ T7] Bluetooth: hci0: command 0x0409 tx timeout [ 57.399169][ T1324] Bluetooth: hci2: command 0x0409 tx timeout [ 57.408879][ T4173] Bluetooth: hci4: command 0x0409 tx timeout [ 57.506401][ T4184] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 57.521696][ T4184] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 57.531261][ T4184] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 57.544124][ T4184] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 57.566759][ T4187] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 57.585262][ T4187] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 57.594675][ T4187] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 57.605702][ T4187] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 57.661636][ T4194] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 57.671459][ T4194] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 57.687229][ T4194] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 57.696177][ T4194] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 57.752707][ T4191] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 57.765592][ T4191] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 57.784659][ T4191] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 57.793991][ T4191] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 57.830869][ T4193] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 57.855572][ T4193] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 57.867747][ T4184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.883386][ T4193] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 57.893003][ T4193] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 57.909938][ T4187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.944216][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.956493][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.965555][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.973927][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.985641][ T4194] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.998617][ T4187] 8021q: adding VLAN 0 to HW filter on device team0 [ 58.006437][ T4184] 8021q: adding VLAN 0 to HW filter on device team0 [ 58.019833][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 58.027791][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 58.040936][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 58.050169][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.059399][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.066733][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.075681][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 58.085742][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 58.094541][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.101676][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.124181][ T4194] 8021q: adding VLAN 0 to HW filter on device team0 [ 58.134360][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 58.144776][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 58.154111][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.162796][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.169903][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.179375][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 58.187825][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.196565][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.203664][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.211958][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 58.220060][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 58.252245][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 58.261394][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 58.271277][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.278336][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.287153][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 58.296609][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 58.305501][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 58.317595][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 58.362088][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 58.371261][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 58.381464][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 58.391687][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 58.400788][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 58.409191][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 58.417294][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 58.426276][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 58.434878][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.442128][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.451222][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 58.460252][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 58.468588][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 58.477591][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 58.486474][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 58.495428][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 58.504283][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 58.512920][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 58.521485][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 58.530439][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 58.540241][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 58.549554][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 58.557801][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 58.565734][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 58.574082][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 58.593319][ T4187] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 58.605859][ T4187] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 58.616589][ T4184] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 58.626933][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 58.636435][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 58.645115][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 58.654496][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 58.667321][ T4193] 8021q: adding VLAN 0 to HW filter on device bond0 [ 58.676878][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 58.685610][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 58.703878][ T4191] 8021q: adding VLAN 0 to HW filter on device bond0 [ 58.726908][ T4194] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 58.750323][ T4194] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 58.774990][ T4193] 8021q: adding VLAN 0 to HW filter on device team0 [ 58.806598][ T4191] 8021q: adding VLAN 0 to HW filter on device team0 [ 58.816684][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 58.826695][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 58.837643][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 58.846626][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 58.855276][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 58.863348][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 58.905087][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 58.930200][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.938558][ T1159] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.945662][ T1159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.961043][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 58.969953][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.987721][ T1159] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.994827][ T1159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.027246][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 59.036147][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 59.050133][ T1159] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.057202][ T1159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.065948][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 59.075347][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 59.084156][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 59.093795][ T1159] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.100914][ T1159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.108543][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 59.117323][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 59.152817][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 59.162925][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 59.172043][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 59.181866][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 59.192778][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 59.201868][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 59.211119][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 59.220485][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 59.233757][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 59.242760][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 59.258000][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 59.267048][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 59.281791][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 59.290688][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 59.299455][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 59.307646][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 59.315890][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 59.334370][ T4193] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 59.347892][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 59.359299][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 59.367665][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 59.376119][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 59.383918][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 59.391670][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 59.406357][ T4184] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 59.413488][ T4225] Bluetooth: hci0: command 0x041b tx timeout [ 59.423971][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 59.426433][ T4225] Bluetooth: hci1: command 0x041b tx timeout [ 59.435407][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 59.440123][ T4225] Bluetooth: hci3: command 0x041b tx timeout [ 59.455491][ T4187] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 59.470244][ T4191] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 59.497988][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 59.510115][ T4225] Bluetooth: hci4: command 0x041b tx timeout [ 59.516409][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 59.528553][ T4225] Bluetooth: hci2: command 0x041b tx timeout [ 59.542551][ T4194] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 59.566720][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 59.583141][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 59.616993][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 59.626270][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 59.664937][ T4184] device veth0_vlan entered promiscuous mode [ 59.672790][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 59.682616][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 59.691995][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 59.701340][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 59.714822][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 59.728227][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 59.736631][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 59.752352][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 59.766202][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 59.775618][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 59.793730][ T4184] device veth1_vlan entered promiscuous mode [ 59.809830][ T4187] device veth0_vlan entered promiscuous mode [ 59.827530][ T4187] device veth1_vlan entered promiscuous mode [ 59.851127][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 59.859745][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 59.867972][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 59.890973][ T4193] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 59.928429][ T4191] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 59.935922][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 59.946876][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 59.956115][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 59.965102][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 59.975782][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 59.983597][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 59.993158][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 60.002005][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 60.009789][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 60.018574][ T4184] device veth0_macvtap entered promiscuous mode [ 60.026105][ T4194] device veth0_vlan entered promiscuous mode [ 60.040073][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 60.052228][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 60.062188][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 60.074005][ T4184] device veth1_macvtap entered promiscuous mode [ 60.094512][ T4194] device veth1_vlan entered promiscuous mode [ 60.105585][ T4187] device veth0_macvtap entered promiscuous mode [ 60.117687][ T4184] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 60.159416][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 60.167554][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 60.175764][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 60.183972][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 60.193754][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 60.204719][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 60.213614][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 60.222654][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 60.230968][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 60.242304][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 60.250164][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 60.260177][ T4184] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 60.267455][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 60.277434][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 60.287124][ T4187] device veth1_macvtap entered promiscuous mode [ 60.305753][ T4191] device veth0_vlan entered promiscuous mode [ 60.315855][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 60.332653][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 60.345918][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 60.356237][ T4184] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.366351][ T4184] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.375328][ T4184] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.384340][ T4184] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.415840][ T4191] device veth1_vlan entered promiscuous mode [ 60.424108][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 60.433017][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 60.442291][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 60.451214][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 60.460102][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 60.469473][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 60.477866][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 60.488543][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 60.499704][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 60.511095][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 60.535841][ T4194] device veth0_macvtap entered promiscuous mode [ 60.545644][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 60.554461][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 60.563665][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 60.576884][ T4187] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.586159][ T4187] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.595014][ T4187] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.605711][ T4187] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.633337][ T4194] device veth1_macvtap entered promiscuous mode [ 60.686941][ T4191] device veth0_macvtap entered promiscuous mode [ 60.711823][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 60.720776][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 60.729627][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 60.738261][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 60.747286][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 60.756080][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 60.765840][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 60.774670][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 60.784277][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 60.792595][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 60.800938][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 60.829260][ T4193] device veth0_vlan entered promiscuous mode [ 60.842680][ T4191] device veth1_macvtap entered promiscuous mode [ 60.855304][ T4194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 60.869848][ T4194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 60.880301][ T4194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 60.892278][ T4194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 60.903539][ T4194] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 60.923418][ T4194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 60.934297][ T4194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 60.944871][ T4194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 60.955572][ T4194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 60.967195][ T4194] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 60.980145][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 60.988872][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 60.997433][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 61.009011][ T4232] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 61.031094][ T4193] device veth1_vlan entered promiscuous mode [ 61.041276][ T4194] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.051775][ T4194] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.060825][ T4194] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.070048][ T4194] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.086993][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 61.097918][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.108041][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 61.118534][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.128463][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 61.139098][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.150708][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 61.174442][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.174587][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.183171][ T3069] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.200768][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.209010][ T3069] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.218187][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 61.237499][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 61.245889][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 61.263587][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 61.275536][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.290448][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 61.301743][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.311984][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 61.323795][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.336155][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 61.366881][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 61.376640][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 61.397499][ T3069] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.412551][ T4193] device veth0_macvtap entered promiscuous mode [ 61.419200][ T3069] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.442823][ T4191] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.454074][ T4191] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.467674][ T4191] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.476585][ T4191] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.487608][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 61.495721][ T4260] Bluetooth: hci3: command 0x040f tx timeout [ 61.501121][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 61.507743][ T4260] Bluetooth: hci1: command 0x040f tx timeout [ 61.513794][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 61.522913][ T4260] Bluetooth: hci0: command 0x040f tx timeout [ 61.530052][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 61.540236][ T4193] device veth1_macvtap entered promiscuous mode [ 61.563462][ T1159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.571986][ T4260] Bluetooth: hci2: command 0x040f tx timeout [ 61.578255][ T4260] Bluetooth: hci4: command 0x040f tx timeout [ 61.584377][ T1159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.594044][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.607637][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.642918][ T3069] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 61.656399][ T3069] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 61.665025][ T3069] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 61.681655][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 61.692222][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.702597][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 61.713510][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.727262][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 61.737943][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.748107][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 61.761269][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.772395][ T4193] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 61.787061][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 61.797999][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.809786][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 61.820443][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.831001][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 61.841686][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.852542][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 61.863207][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.875898][ T4193] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 61.917810][ T3069] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.935514][ T3069] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 61.966711][ T3069] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 61.976909][ T3069] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 61.998341][ T4193] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.008356][ T1159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.018747][ T1159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.028340][ T4193] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.058678][ T4193] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.067394][ T4193] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.102233][ T4264] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 62.125806][ T3069] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 62.169086][ T3069] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.206334][ T3069] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.258765][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 62.304113][ T4269] loop0: detected capacity change from 0 to 64 [ 62.315783][ T1159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.338997][ T1159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.379795][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 62.397214][ T1159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.410981][ T4269] ======================================================= [ 62.410981][ T4269] WARNING: The mand mount option has been deprecated and [ 62.410981][ T4269] and is ignored by this kernel. Remove the mand [ 62.410981][ T4269] option from the mount to silence this warning. [ 62.410981][ T4269] ======================================================= [ 62.412221][ T4271] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 62.467534][ T1159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.487244][ T3069] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.500679][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 62.514542][ T3069] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.549401][ T3069] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 62.564913][ T4273] Zero length message leads to an empty skb [ 62.644321][ T4271] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 62.665530][ T4274] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 62.705907][ T4276] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2'. [ 62.909619][ T4276] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 62.987469][ T4276] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 63.000991][ T4173] infiniband syz1: ib_query_port failed (-19) [ 63.017606][ T4276] bond0 (unregistering): Released all slaves [ 63.057774][ T4274] tipc: Started in network mode [ 63.064352][ T4274] tipc: Node identity 7f000001, cluster identity 4711 [ 63.072393][ T4271] bond0 speed is unknown, defaulting to 1000 [ 63.075417][ T4274] tipc: Enabling of bearer rejected, failed to enable media [ 63.090964][ T1324] bond0 speed is unknown, defaulting to 1000 [ 63.098420][ T4288] capability: warning: `syz.0.8' uses 32-bit capabilities (legacy support in use) [ 63.137516][ T4271] siw: device registration error -19 [ 63.341506][ T4190] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 63.351280][ T4190] CPU: 0 PID: 4190 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 63.358828][ T4190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 63.368913][ T4190] Workqueue: hci1 hci_rx_work [ 63.373627][ T4190] Call Trace: [ 63.376920][ T4190] [ 63.379856][ T4190] dump_stack_lvl+0x188/0x250 [ 63.384544][ T4190] ? show_regs_print_info+0x20/0x20 [ 63.389769][ T4190] ? load_image+0x400/0x400 [ 63.394298][ T4190] sysfs_create_dir_ns+0x26a/0x290 [ 63.399557][ T4190] ? sysfs_warn_dup+0xa0/0xa0 [ 63.404247][ T4190] ? process_one_work+0x85f/0x1010 [ 63.409389][ T4190] ? do_raw_spin_unlock+0x11d/0x230 [ 63.414609][ T4190] kobject_add_internal+0x6e0/0xd90 [ 63.419916][ T4190] kobject_add+0x160/0x230 [ 63.424438][ T4190] ? kobject_init+0x1d0/0x1d0 [ 63.429144][ T4190] ? klist_children_get+0x50/0x50 [ 63.434191][ T4190] ? get_device_parent+0x121/0x3f0 [ 63.439325][ T4190] device_add+0x483/0xfb0 [ 63.443677][ T4190] hci_conn_add_sysfs+0xd1/0x1e0 [ 63.448626][ T4190] le_conn_complete_evt+0xc48/0x15c0 [ 63.453934][ T4190] ? cs_le_create_conn+0x5e0/0x5e0 [ 63.459073][ T4190] ? __mutex_trylock_common+0x155/0x260 [ 63.464639][ T4190] hci_le_meta_evt+0x285/0x3c90 [ 63.469511][ T4190] ? hci_event_packet+0x37b/0x1370 [ 63.474637][ T4190] ? __lock_acquire+0x7d10/0x7d10 [ 63.479686][ T4190] ? hci_remote_host_features_evt+0x280/0x280 [ 63.485767][ T4190] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 63.491416][ T4190] ? mark_lock+0x94/0x320 [ 63.495754][ T4190] ? mutex_unlock+0x10/0x10 [ 63.500264][ T4190] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 63.506253][ T4190] ? lock_chain_count+0x20/0x20 [ 63.511117][ T4190] ? __rwlock_init+0x140/0x140 [ 63.515900][ T4190] hci_event_packet+0xe48/0x1370 [ 63.520852][ T4190] ? lockdep_hardirqs_on+0x94/0x140 [ 63.526059][ T4190] ? rcu_lock_release+0x20/0x20 [ 63.530917][ T4190] ? hci_send_to_monitor+0x9c/0x4a0 [ 63.536170][ T4190] hci_rx_work+0x255/0xa10 [ 63.540619][ T4190] process_one_work+0x85f/0x1010 [ 63.545578][ T4190] ? worker_detach_from_pool+0x240/0x240 [ 63.551225][ T4190] ? lockdep_hardirqs_off+0x70/0x100 [ 63.556523][ T4190] ? _raw_spin_lock_irq+0xb7/0xf0 [ 63.561562][ T4190] ? _raw_spin_lock_irqsave+0x100/0x100 [ 63.567127][ T4190] ? wq_worker_running+0x97/0x170 [ 63.572162][ T4190] worker_thread+0xaa6/0x1290 [ 63.576875][ T4190] kthread+0x436/0x520 [ 63.580965][ T4190] ? rcu_lock_release+0x20/0x20 [ 63.585822][ T4190] ? kthread_blkcg+0xd0/0xd0 [ 63.590417][ T4190] ret_from_fork+0x1f/0x30 [ 63.594867][ T4190] [ 63.600143][ T4190] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 63.614569][ T4259] Bluetooth: hci0: command 0x0419 tx timeout [ 63.620590][ T4190] Bluetooth: hci1: failed to register connection device [ 63.630471][ T4259] Bluetooth: hci1: command 0x0419 tx timeout [ 63.636547][ T4259] Bluetooth: hci3: command 0x0419 tx timeout [ 63.647952][ T4259] Bluetooth: hci4: command 0x0419 tx timeout [ 63.654067][ T4259] Bluetooth: hci2: command 0x0419 tx timeout [ 64.018771][ T4173] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 64.080119][ T1324] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 64.498845][ T1324] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 64.524648][ T1324] usb 3-1: config 0 interface 0 has no altsetting 0 [ 64.591003][ T4315] netlink: 'syz.1.16': attribute type 10 has an invalid length. [ 64.612375][ T4315] team0: Device vxcan1 is of different type [ 64.713138][ T1324] usb 3-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 64.730172][ T1324] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.747652][ T1324] usb 3-1: Product: syz [ 64.755904][ T1324] usb 3-1: Manufacturer: syz [ 64.774314][ T1324] usb 3-1: SerialNumber: syz [ 64.792812][ T1324] usb 3-1: config 0 descriptor?? [ 64.800457][ T4321] loop3: detected capacity change from 0 to 256 [ 64.853142][ T1324] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 64.887789][ T4321] FAT-fs (loop3): Directory bread(block 64) failed [ 64.912428][ T4323] loop1: detected capacity change from 0 to 64 [ 64.933545][ T1324] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 64.934148][ T4321] FAT-fs (loop3): Directory bread(block 65) failed [ 64.958354][ T4321] FAT-fs (loop3): Directory bread(block 66) failed [ 64.965788][ T4321] FAT-fs (loop3): Directory bread(block 67) failed [ 64.977922][ T4321] FAT-fs (loop3): Directory bread(block 68) failed [ 64.981094][ T1324] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 65.015135][ T4321] FAT-fs (loop3): Directory bread(block 69) failed [ 65.026895][ T1324] usb 3-1: media controller created [ 65.045451][ T4321] FAT-fs (loop3): Directory bread(block 70) failed [ 65.054640][ T4303] tipc: Started in network mode [ 65.071695][ T4303] tipc: Node identity aaaaaaaaaa2a, cluster identity 4711 [ 65.095386][ T4321] FAT-fs (loop3): Directory bread(block 71) failed [ 65.113436][ T1324] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 65.117808][ T4303] tipc: Enabled bearer , priority 10 [ 65.133600][ T4321] FAT-fs (loop3): Directory bread(block 72) failed [ 65.142848][ T4321] FAT-fs (loop3): Directory bread(block 73) failed [ 65.267730][ T4190] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 65.277491][ T4190] CPU: 0 PID: 4190 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 65.285060][ T4190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 65.295161][ T4190] Workqueue: hci3 hci_rx_work [ 65.299872][ T4190] Call Trace: [ 65.303165][ T4190] [ 65.306118][ T4190] dump_stack_lvl+0x188/0x250 [ 65.310824][ T4190] ? show_regs_print_info+0x20/0x20 [ 65.316056][ T4190] ? load_image+0x400/0x400 [ 65.320594][ T4190] sysfs_create_dir_ns+0x26a/0x290 [ 65.325736][ T4190] ? sysfs_warn_dup+0xa0/0xa0 [ 65.330432][ T4190] ? process_one_work+0x85f/0x1010 [ 65.335577][ T4190] ? do_raw_spin_unlock+0x11d/0x230 [ 65.340813][ T4190] kobject_add_internal+0x6e0/0xd90 [ 65.346038][ T4190] kobject_add+0x160/0x230 [ 65.350484][ T4190] ? kobject_init+0x1d0/0x1d0 [ 65.355200][ T4190] ? klist_children_get+0x50/0x50 [ 65.360260][ T4190] ? get_device_parent+0x121/0x3f0 [ 65.365399][ T4190] device_add+0x483/0xfb0 [ 65.369794][ T4190] hci_conn_add_sysfs+0xd1/0x1e0 [ 65.374766][ T4190] le_conn_complete_evt+0xc48/0x15c0 [ 65.380102][ T4190] ? cs_le_create_conn+0x5e0/0x5e0 [ 65.385242][ T4190] ? __mutex_trylock_common+0x155/0x260 [ 65.390819][ T4190] hci_le_meta_evt+0x285/0x3c90 [ 65.395699][ T4190] ? hci_event_packet+0x37b/0x1370 [ 65.400830][ T4190] ? __lock_acquire+0x7d10/0x7d10 [ 65.405885][ T4190] ? hci_remote_host_features_evt+0x280/0x280 [ 65.411974][ T4190] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 65.417649][ T4190] ? mark_lock+0x94/0x320 [ 65.421999][ T4190] ? mutex_unlock+0x10/0x10 [ 65.426535][ T4190] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 65.432546][ T4190] ? lock_chain_count+0x20/0x20 [ 65.437438][ T4190] ? __rwlock_init+0x140/0x140 [ 65.442235][ T4190] hci_event_packet+0xe48/0x1370 [ 65.447201][ T4190] ? lockdep_hardirqs_on+0x94/0x140 [ 65.452441][ T4190] ? rcu_lock_release+0x20/0x20 [ 65.457333][ T4190] ? hci_send_to_monitor+0x9c/0x4a0 [ 65.462559][ T4190] hci_rx_work+0x255/0xa10 [ 65.467021][ T4190] process_one_work+0x85f/0x1010 [ 65.471994][ T4190] ? worker_detach_from_pool+0x240/0x240 [ 65.477648][ T4190] ? lockdep_hardirqs_off+0x70/0x100 [ 65.482957][ T4190] ? _raw_spin_lock_irq+0xb7/0xf0 [ 65.488008][ T4190] ? _raw_spin_lock_irqsave+0x100/0x100 [ 65.493579][ T4190] ? wq_worker_running+0x97/0x170 [ 65.498633][ T4190] worker_thread+0xaa6/0x1290 [ 65.503358][ T4190] kthread+0x436/0x520 [ 65.507457][ T4190] ? rcu_lock_release+0x20/0x20 [ 65.512339][ T4190] ? kthread_blkcg+0xd0/0xd0 [ 65.516958][ T4190] ret_from_fork+0x1f/0x30 [ 65.521415][ T4190] [ 65.531006][ T4190] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 65.544902][ T4190] Bluetooth: hci3: failed to register connection device [ 65.585053][ T1324] DVB: Unable to find symbol tda10046_attach() [ 65.597699][ T1324] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 65.617520][ T1324] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 65.868866][ T4226] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 65.883111][ T4350] loop4: detected capacity change from 0 to 2048 [ 65.941165][ T4350] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 66.079199][ T1324] dvb_usb_m920x: probe of 3-1:0.0 failed with error -71 [ 66.119507][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 66.128425][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #108!!! [ 66.138637][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #40!!! [ 66.148731][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 66.158495][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 66.169803][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #280!!! [ 66.178834][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 66.189042][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 66.198063][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 66.207129][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 66.229955][ T21] tipc: Node number set to 8432298 [ 66.252666][ T4358] autofs4:pid:4358:autofs_fill_super: called with bogus options [ 66.299335][ T4226] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 66.355650][ T4226] usb 2-1: config 0 has no interfaces? [ 66.569249][ T4226] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 66.659741][ T4226] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.761397][ T4226] usb 2-1: Product: syz [ 66.774663][ T4361] loop0: detected capacity change from 0 to 8 [ 66.796803][ T4226] usb 2-1: Manufacturer: syz [ 66.862807][ T4226] usb 2-1: SerialNumber: syz [ 66.923744][ T1324] usb 3-1: USB disconnect, device number 2 [ 66.992403][ T4226] usb 2-1: config 0 descriptor?? [ 67.304277][ T4379] loop0: detected capacity change from 0 to 256 [ 67.319141][ T21] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 67.365441][ T4379] exfat: Deprecated parameter 'namecase' [ 67.414349][ T4379] exfat: Unknown parameter 'sys_tz' [ 67.568750][ T21] usb 4-1: Using ep0 maxpacket: 8 [ 67.640830][ T26] audit: type=1400 audit(1773028774.060:2): apparmor="DENIED" operation="stack" info="label not found" error=-2 profile="unconfined" name="(" pid=4383 comm="syz.2.38" [ 67.728990][ T21] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 68.347088][ T21] usb 4-1: config 179 has no interface number 0 [ 68.353645][ T21] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 68.368062][ T21] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 68.404158][ T21] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 68.432294][ T21] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 68.458442][ T21] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 68.490184][ T21] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 68.513976][ T21] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 68.569139][ T4369] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 68.624181][ T4394] loop4: detected capacity change from 0 to 4096 [ 68.635993][ T23] usb 2-1: USB disconnect, device number 2 [ 68.680786][ T4394] ntfs3: Unknown parameter 'windows_names' [ 68.775475][ T4407] loop1: detected capacity change from 0 to 128 [ 68.810414][ T4408] delete_channel: no stack [ 68.829372][ T4226] usb 4-1: USB disconnect, device number 2 [ 68.848680][ C1] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 68.874799][ T26] audit: type=1800 audit(1773028775.400:3): pid=4407 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.47" name="file1" dev="loop1" ino=1048591 res=0 errno=0 [ 69.260716][ T23] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 69.328838][ T4173] usb 5-1: unable to get BOS descriptor or descriptor too short [ 69.453110][ T4173] usb 5-1: unable to read config index 0 descriptor/start: -32 [ 69.469057][ T4173] usb 5-1: chopping to 0 config(s) [ 69.486178][ T4173] usb 5-1: can't read configurations, error -32 [ 69.557236][ T4434] loop7: detected capacity change from 0 to 16384 [ 69.628973][ T23] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 69.637397][ T23] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 69.650068][ T4173] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 69.671304][ T23] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 69.693143][ T23] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 69.702512][ T23] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 69.709938][ T1324] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 69.721403][ T23] usb 2-1: config 0 descriptor?? [ 69.739023][ T4417] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 69.761138][ T23] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 69.798827][ T23] Bluetooth: hci1: command 0x0406 tx timeout [ 69.818739][ T4173] usb 5-1: device descriptor read/64, error -32 [ 69.939296][ T4173] usb usb5-port1: attempt power cycle [ 69.959304][ T4435] loop_set_status: loop7 () has still dirty pages (nrpages=1376) [ 70.129122][ T1324] usb 4-1: config 246 has an invalid interface number: 166 but max is 0 [ 70.147777][ T1324] usb 4-1: config 246 has an invalid descriptor of length 0, skipping remainder of the config [ 70.186549][ T1324] usb 4-1: config 246 has no interface number 0 [ 70.195374][ T4445] loop2: detected capacity change from 0 to 128 [ 70.210245][ T1324] usb 4-1: config 246 interface 166 altsetting 118 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 70.231660][ T1324] usb 4-1: config 246 interface 166 has no altsetting 0 [ 70.269984][ T4445] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 70.303538][ T4445] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 70.358712][ T4173] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 70.367760][ T4448] serio: Serial port ptm0 [ 70.448970][ T1324] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 9.63 [ 70.450849][ T4173] usb 5-1: device descriptor read/8, error -32 [ 70.458036][ T1324] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.458075][ T1324] usb 4-1: Product: syz [ 70.458089][ T1324] usb 4-1: Manufacturer: syz [ 70.507763][ T1324] usb 4-1: SerialNumber: syz [ 70.517370][ T9] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 70.685790][ T4467] udc-core: couldn't find an available UDC or it's busy [ 70.700069][ T4467] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 70.708380][ T4467] udc-core: couldn't find an available UDC or it's busy [ 70.729773][ T4467] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 70.748734][ T4173] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 70.769196][ T4467] udc-core: couldn't find an available UDC or it's busy [ 70.781509][ T4467] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 70.818871][ T4173] usb 5-1: device descriptor read/8, error -32 [ 70.940412][ T4173] usb usb5-port1: unable to enumerate USB device [ 70.981077][ T4480] netlink: 8 bytes leftover after parsing attributes in process `syz.0.72'. [ 71.163581][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.172073][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.232028][ T1324] usb 4-1: Limiting number of CPorts to U8_MAX [ 71.243487][ T1324] usb 4-1: Not enough endpoints found in device, aborting! [ 71.371838][ T7] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 71.435836][ T13] usb 4-1: USB disconnect, device number 3 [ 71.728857][ T23] Bluetooth: hci3: command 0x0406 tx timeout [ 71.738912][ T7] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 71.748471][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 71.782104][ T7] usb 1-1: config 0 has no interface number 0 [ 71.806772][ T7] usb 1-1: config 0 interface 2 altsetting 2 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 71.838471][ T7] usb 1-1: config 0 interface 2 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 71.884475][ T7] usb 1-1: config 0 interface 2 has no altsetting 0 [ 72.003508][ T13] usb 2-1: USB disconnect, device number 3 [ 72.059335][ T7] usb 1-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f7.3f [ 72.086702][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.146605][ T7] usb 1-1: Product: syz [ 72.179330][ T7] usb 1-1: Manufacturer: syz [ 72.179352][ T4512] loop3: detected capacity change from 0 to 128 [ 72.183949][ T7] usb 1-1: SerialNumber: syz [ 72.266027][ T7] usb 1-1: config 0 descriptor?? [ 72.288903][ T4487] raw-gadget.6 gadget: fail, usb_ep_enable returned -22 [ 72.296857][ T4512] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 72.309050][ T4512] ext4 filesystem being mounted at /7/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 72.608950][ T7] usb 1-1: invalid MIDI in EP 0 [ 72.675486][ T4532] loop3: detected capacity change from 0 to 256 [ 72.767862][ T4532] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x395e47cf, utbl_chksum : 0xe619d30d) [ 72.851621][ T7] snd-usb-audio: probe of 1-1:0.2 failed with error -22 [ 72.870023][ T4532] attempt to access beyond end of device [ 72.870023][ T4532] loop3: rw=0, want=98488, limit=256 [ 72.916055][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 72.935664][ T7] usb 1-1: USB disconnect, device number 2 [ 73.117408][ T4539] loop3: detected capacity change from 0 to 64 [ 73.520630][ T4544] loop0: detected capacity change from 0 to 4096 [ 73.622507][ T4553] loop3: detected capacity change from 0 to 256 [ 73.640049][ T4551] process 'syz.2.100' launched './file2' with NULL argv: empty string added [ 73.875968][ T4565] loop3: detected capacity change from 0 to 256 [ 73.916171][ T4565] exfat: Deprecated parameter 'namecase' [ 73.965366][ T4565] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0xd8f5bb5e, utbl_chksum : 0xe619d30d) [ 74.066419][ T4571] loop0: detected capacity change from 0 to 512 [ 74.102290][ T4574] netlink: 64 bytes leftover after parsing attributes in process `syz.2.110'. [ 74.114254][ T4574] netlink: 64 bytes leftover after parsing attributes in process `syz.2.110'. [ 74.166336][ T4571] EXT4-fs (loop0): Ignoring removed nomblk_io_submit option [ 74.240239][ T4571] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 74.283776][ T4571] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=c000e128, mo2=0002] [ 74.316022][ T4571] EXT4-fs (loop0): orphan cleanup on readonly fs [ 74.335147][ T4571] Quota error (device loop0): v2_read_header: Failed header read: expected=8 got=0 [ 74.382156][ T4571] EXT4-fs warning (device loop0): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 74.436836][ T4571] EXT4-fs (loop0): Cannot turn on quotas: error -22 [ 74.452861][ T4571] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm syz.0.108: bg 0: block 40: padding at end of block bitmap is not set [ 74.475358][ T4571] EXT4-fs (loop0): Remounting filesystem read-only [ 74.483692][ T4571] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6192: Corrupt filesystem [ 74.497418][ T4571] EXT4-fs (loop0): Remounting filesystem read-only [ 74.506060][ T4571] EXT4-fs (loop0): 1 truncate cleaned up [ 74.516809][ T4571] EXT4-fs (loop0): mounted filesystem without journal. Opts: errors=remount-ro,noload,noblock_validity,dioread_lock,nouid32,nomblk_io_submit,. Quota mode: writeback. [ 74.603710][ T4571] fscrypt (loop0, inode 16): Error -61 getting encryption context [ 74.999919][ T4607] netlink: 60 bytes leftover after parsing attributes in process `syz.2.121'. [ 75.027487][ T4607] netlink: 60 bytes leftover after parsing attributes in process `syz.2.121'. [ 75.040021][ T4609] netlink: 60 bytes leftover after parsing attributes in process `syz.2.121'. [ 75.131914][ T4613] udc-core: couldn't find an available UDC or it's busy [ 75.168923][ T4613] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 75.258908][ T7] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 75.501630][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 76.318815][ T7] usb 1-1: unable to get BOS descriptor or descriptor too short [ 76.398960][ T7] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 17, changing to 7 [ 76.619915][ T7] usb 1-1: New USB device found, idVendor=0582, idProduct=0044, bcdDevice= 0.40 [ 76.636615][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.653696][ T7] usb 1-1: Product: syz [ 76.658011][ T7] usb 1-1: Manufacturer: syz [ 76.664325][ T7] usb 1-1: SerialNumber: syz [ 76.831652][ T4670] loop3: detected capacity change from 0 to 512 [ 76.897890][ T4670] EXT4-fs (loop3): mounted filesystem without journal. Opts: errors=remount-ro,bsddf,. Quota mode: writeback. [ 76.911191][ T4670] ext4 filesystem being mounted at /27/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 77.001159][ T7] usb 1-1: interface 3 not found [ 77.012682][ T7] usb 1-1: USB disconnect, device number 3 [ 77.185263][ T4684] loop3: detected capacity change from 0 to 164 [ 77.651482][ T4706] loop0: detected capacity change from 0 to 2048 [ 77.769801][ T4706] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 77.856188][ T4706] ext4 filesystem being mounted at /29/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 77.941096][ T4722] udc-core: couldn't find an available UDC or it's busy [ 77.948079][ T4722] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 78.054199][ T4725] loop1: detected capacity change from 0 to 256 [ 78.156376][ T4725] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 78.244944][ T26] audit: type=1800 audit(1773028784.770:4): pid=4725 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.167" name="file1" dev="loop1" ino=1048599 res=0 errno=0 [ 78.264720][ C1] vkms_vblank_simulate: vblank timer overrun [ 78.317301][ T4734] loop3: detected capacity change from 0 to 128 [ 78.877625][ T4765] loop4: detected capacity change from 0 to 512 [ 78.895819][ T4765] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 78.922390][ T4765] EXT4-fs error (device loop4): ext4_orphan_get:1405: comm syz.4.185: couldn't read orphan inode 26 (err -116) [ 78.934525][ T4260] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 78.936832][ T4765] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 78.949606][ T1324] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 78.953887][ T4765] ext4 filesystem being mounted at /42/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 79.058709][ T7] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 79.144919][ T4774] udc-core: couldn't find an available UDC or it's busy [ 79.152715][ T4774] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 79.208733][ T1324] usb 2-1: Using ep0 maxpacket: 16 [ 79.213940][ T4260] usb 4-1: Using ep0 maxpacket: 8 [ 79.328893][ T1324] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 79.339806][ T4260] usb 4-1: config index 0 descriptor too short (expected 74, got 45) [ 79.348130][ T4260] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 79.359480][ T1324] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 79.368399][ T4260] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 79.378523][ T4260] usb 4-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 79.391890][ T4260] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 79.400985][ T4260] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.439132][ T7] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 79.450187][ T7] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has an invalid bInterval 128, changing to 11 [ 79.463170][ T4260] usbtmc 4-1:16.0: bulk endpoints not found [ 79.471408][ T7] usb 1-1: config 1 interface 1 altsetting 1 has an invalid endpoint with address 0xC3, skipping [ 79.548970][ T1324] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 79.558182][ T1324] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.566747][ T1324] usb 2-1: Product: syz [ 79.571605][ T1324] usb 2-1: Manufacturer: syz [ 79.576288][ T1324] usb 2-1: SerialNumber: syz [ 79.668829][ T7] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 79.678233][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.686628][ T7] usb 1-1: Product: syz [ 79.694646][ T7] usb 1-1: Manufacturer: syz [ 79.699513][ T7] usb 1-1: SerialNumber: syz [ 79.737973][ T4779] autofs4:pid:4779:autofs_fill_super: called with bogus options [ 79.898967][ T1324] usb 2-1: 0:2 : does not exist [ 79.937273][ T1324] usb 2-1: USB disconnect, device number 4 [ 80.170323][ T4535] udevd[4535]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 80.387539][ T4789] loop1: detected capacity change from 0 to 512 [ 80.463901][ T4789] EXT4-fs error (device loop1): ext4_orphan_get:1400: inode #15: comm syz.1.192: inode has both inline data and extents flags [ 80.495406][ T4789] EXT4-fs error (device loop1): ext4_orphan_get:1405: comm syz.1.192: couldn't read orphan inode 15 (err -117) [ 80.513786][ T4789] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 80.839024][ T7] cdc_ncm 1-1:1.0: bind() failure [ 80.875124][ T7] cdc_ncm: probe of 1-1:1.1 failed with error -71 [ 80.911710][ T7] cdc_mbim: probe of 1-1:1.1 failed with error -71 [ 80.942159][ T7] usbtest: probe of 1-1:1.1 failed with error -71 [ 80.955647][ T7] usb 1-1: USB disconnect, device number 4 [ 80.962441][ T4260] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 81.015863][ T4800] udc-core: couldn't find an available UDC or it's busy [ 81.023271][ T4800] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 81.210406][ T4260] usb 2-1: Using ep0 maxpacket: 8 [ 81.378947][ T4260] usb 2-1: config index 0 descriptor too short (expected 5924, got 36) [ 81.392256][ T4260] usb 2-1: config 250 has an invalid interface number: 228 but max is -1 [ 81.402246][ T4260] usb 2-1: config 250 has an invalid descriptor of length 0, skipping remainder of the config [ 81.413553][ T4260] usb 2-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 81.423210][ T4260] usb 2-1: config 250 has no interface number 0 [ 81.424760][ T1107] cfg80211: failed to load regulatory.db [ 81.437188][ T4260] usb 2-1: config 250 interface 228 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 17 [ 81.466177][ T4260] usb 2-1: config 250 interface 228 has no altsetting 0 [ 81.582682][ T4806] tipc: Started in network mode [ 81.588425][ T4806] tipc: Node identity 9a2b979392c2, cluster identity 4711 [ 81.596222][ T4806] tipc: Enabled bearer , priority 0 [ 81.605841][ T4806] device syzkaller0 entered promiscuous mode [ 81.619926][ T4260] usb 2-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 81.642016][ T4260] usb 2-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 81.647111][ T4806] tipc: Resetting bearer [ 81.662015][ T4805] tipc: Resetting bearer [ 81.668152][ T4260] usb 2-1: Product: syz [ 81.684746][ T4260] usb 2-1: SerialNumber: syz [ 81.686719][ T4805] tipc: Disabling bearer [ 81.724216][ T7] usb 4-1: USB disconnect, device number 4 [ 81.763870][ T4260] hub 2-1:250.228: bad descriptor, ignoring hub [ 81.772139][ T4260] hub: probe of 2-1:250.228 failed with error -5 [ 81.913391][ T4814] loop4: detected capacity change from 0 to 128 [ 82.036450][ T4814] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 82.048822][ T4814] ext4 filesystem being mounted at /54/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 82.272445][ T4173] usb 2-1: reset high-speed USB device number 5 using dummy_hcd [ 82.359647][ T4824] [ 82.362015][ T4824] ====================================================== [ 82.369145][ T4824] WARNING: possible circular locking dependency detected [ 82.376184][ T4824] syzkaller #0 Not tainted [ 82.380608][ T4824] ------------------------------------------------------ [ 82.387630][ T4824] syz.2.208/4824 is trying to acquire lock: [ 82.393530][ T4824] ffff8880256f99a0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_sk_diag_fill+0xf5e/0x1ca0 [ 82.403130][ T4824] [ 82.403130][ T4824] but task is already holding lock: [ 82.410499][ T4824] ffffc900017f00b8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: mptcp_diag_dump+0x917/0x12b0 [ 82.420098][ T4824] [ 82.420098][ T4824] which lock already depends on the new lock. [ 82.420098][ T4824] [ 82.430506][ T4824] [ 82.430506][ T4824] the existing dependency chain (in reverse order) is: [ 82.439531][ T4824] [ 82.439531][ T4824] -> #1 (&h->lhash2[i].lock){+.+.}-{2:2}: [ 82.447457][ T4824] _raw_spin_lock+0x2a/0x40 [ 82.452502][ T4824] __inet_hash+0xe3/0x960 [ 82.457378][ T4824] inet_csk_listen_start+0x22f/0x320 [ 82.463202][ T4824] inet_listen+0x2e1/0x590 [ 82.468164][ T4824] __sys_listen+0x19d/0x220 [ 82.473198][ T4824] __x64_sys_listen+0x56/0x60 [ 82.478409][ T4824] do_syscall_64+0x4c/0xa0 [ 82.483338][ T4824] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.489868][ T4824] [ 82.489868][ T4824] -> #0 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 82.497592][ T4824] __lock_acquire+0x2c42/0x7d10 [ 82.502967][ T4824] lock_acquire+0x19e/0x400 [ 82.507988][ T4824] mptcp_diag_get_info+0x1f2/0x9e0 [ 82.513633][ T4824] inet_sk_diag_fill+0xf5e/0x1ca0 [ 82.519204][ T4824] mptcp_diag_dump+0xce6/0x12b0 [ 82.524569][ T4824] __inet_diag_dump+0x1f6/0x380 [ 82.529963][ T4824] netlink_dump+0x694/0xcf0 [ 82.535004][ T4824] __netlink_dump_start+0x523/0x700 [ 82.540738][ T4824] inet_diag_handler_cmd+0x1d3/0x2b0 [ 82.546542][ T4824] sock_diag_rcv_msg+0x164/0x3e0 [ 82.552007][ T4824] netlink_rcv_skb+0x1f5/0x440 [ 82.557335][ T4824] sock_diag_rcv+0x26/0x40 [ 82.562307][ T4824] netlink_unicast+0x774/0x920 [ 82.567605][ T4824] netlink_sendmsg+0x8ba/0xbe0 [ 82.572906][ T4824] sock_write_iter+0x2a6/0x3a0 [ 82.578248][ T4824] do_iter_readv_writev+0x47e/0x5f0 [ 82.583989][ T4824] do_iter_write+0x205/0x7b0 [ 82.589138][ T4824] do_writev+0x281/0x480 [ 82.593915][ T4824] do_syscall_64+0x4c/0xa0 [ 82.598890][ T4824] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.605321][ T4824] [ 82.605321][ T4824] other info that might help us debug this: [ 82.605321][ T4824] [ 82.615562][ T4824] Possible unsafe locking scenario: [ 82.615562][ T4824] [ 82.623023][ T4824] CPU0 CPU1 [ 82.628402][ T4824] ---- ---- [ 82.633876][ T4824] lock(&h->lhash2[i].lock); [ 82.638587][ T4824] lock(sk_lock-AF_INET6); [ 82.645633][ T4824] lock(&h->lhash2[i].lock); [ 82.652848][ T4824] lock(sk_lock-AF_INET6); [ 82.657365][ T4824] [ 82.657365][ T4824] *** DEADLOCK *** [ 82.657365][ T4824] [ 82.665515][ T4824] 6 locks held by syz.2.208/4824: [ 82.670544][ T4824] #0: ffffffff8d4466e8 (sock_diag_mutex){+.+.}-{3:3}, at: sock_diag_rcv+0x17/0x40 [ 82.679876][ T4824] #1: ffffffff8d4465a8 (sock_diag_table_mutex){+.+.}-{3:3}, at: sock_diag_rcv_msg+0x217/0x3e0 [ 82.690246][ T4824] #2: ffff888074732698 (nlk_cb_mutex-SOCK_DIAG){+.+.}-{3:3}, at: __netlink_dump_start+0x11f/0x700 [ 82.700969][ T4824] #3: ffffffff8d520588 (inet_diag_table_mutex){+.+.}-{3:3}, at: __inet_diag_dump+0x181/0x380 [ 82.711275][ T4824] #4: ffffffff8c31eaa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 [ 82.720605][ T4824] #5: ffffc900017f00b8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: mptcp_diag_dump+0x917/0x12b0 [ 82.730645][ T4824] [ 82.730645][ T4824] stack backtrace: [ 82.736550][ T4824] CPU: 0 PID: 4824 Comm: syz.2.208 Not tainted syzkaller #0 [ 82.743843][ T4824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 82.753934][ T4824] Call Trace: [ 82.757235][ T4824] [ 82.760187][ T4824] dump_stack_lvl+0x188/0x250 [ 82.764884][ T4824] ? load_image+0x400/0x400 [ 82.769409][ T4824] ? show_regs_print_info+0x20/0x20 [ 82.774631][ T4824] ? print_circular_bug+0x12b/0x1a0 [ 82.779855][ T4824] check_noncircular+0x296/0x330 [ 82.784820][ T4824] ? add_chain_block+0x940/0x940 [ 82.789780][ T4824] ? lockdep_lock+0xf1/0x1f0 [ 82.794475][ T4824] ? __lock_acquire+0x13bc/0x7d10 [ 82.799541][ T4824] ? mark_lock+0x94/0x320 [ 82.803885][ T4824] __lock_acquire+0x2c42/0x7d10 [ 82.808766][ T4824] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 82.814784][ T4824] ? verify_lock_unused+0x140/0x140 [ 82.820028][ T4824] ? lockdep_hardirqs_on_prepare+0x770/0x770 [ 82.826032][ T4824] ? verify_lock_unused+0x140/0x140 [ 82.831363][ T4824] ? __local_bh_enable_ip+0xd7/0x1c0 [ 82.836659][ T4824] ? __local_bh_enable_ip+0x136/0x1c0 [ 82.842042][ T4824] ? lockdep_hardirqs_on+0x94/0x140 [ 82.847271][ T4824] ? __local_bh_enable_ip+0x136/0x1c0 [ 82.852644][ T4824] ? _local_bh_enable+0xa0/0xa0 [ 82.857500][ T4824] ? nla_put+0x130/0x1e0 [ 82.861823][ T4824] lock_acquire+0x19e/0x400 [ 82.866325][ T4824] ? inet_sk_diag_fill+0xf5e/0x1ca0 [ 82.871547][ T4824] ? read_lock_is_recursive+0x10/0x10 [ 82.876920][ T4824] ? rcu_lock_release+0x5/0x20 [ 82.881692][ T4824] ? __lock_acquire+0x7d10/0x7d10 [ 82.886705][ T4824] ? inet_sk_diag_fill+0xf5e/0x1ca0 [ 82.891902][ T4824] mptcp_diag_get_info+0x1f2/0x9e0 [ 82.897055][ T4824] ? inet_sk_diag_fill+0xf5e/0x1ca0 [ 82.902266][ T4824] inet_sk_diag_fill+0xf5e/0x1ca0 [ 82.907312][ T4824] ? inet_diag_msg_attrs_fill+0x930/0x930 [ 82.913059][ T4824] ? do_raw_spin_lock+0x128/0x2f0 [ 82.918091][ T4824] ? __rwlock_init+0x140/0x140 [ 82.922865][ T4824] ? inet_diag_bc_sk+0x18b/0x1120 [ 82.927953][ T4824] mptcp_diag_dump+0xce6/0x12b0 [ 82.929262][ T4173] usb 2-1: failed to restore interface 228 altsetting 255 (error=-71) [ 82.932861][ T4824] ? mptcp_token_join_cookie_init_state+0x460/0x460 [ 82.947699][ T4824] __inet_diag_dump+0x1f6/0x380 [ 82.952580][ T4824] netlink_dump+0x694/0xcf0 [ 82.957118][ T4824] ? netlink_lookup+0x1d0/0x1d0 [ 82.961997][ T4824] ? __inet_diag_dump_start+0x805/0x970 [ 82.962163][ T4173] usb 2-1: USB disconnect, device number 5 [ 82.967557][ T4824] __netlink_dump_start+0x523/0x700 [ 82.967581][ T4824] inet_diag_handler_cmd+0x1d3/0x2b0 [ 82.983861][ T4824] ? rcu_lock_release+0x20/0x20 [ 82.988739][ T4824] ? inet_diag_handler_get_info+0xb90/0xb90 [ 82.994665][ T4824] ? inet_diag_dump_start+0x20/0x20 [ 82.999892][ T4824] ? inet_diag_dump+0x50/0x50 [ 83.004623][ T4824] ? rcu_lock_release+0x20/0x20 [ 83.009502][ T4824] sock_diag_rcv_msg+0x164/0x3e0 [ 83.014474][ T4824] netlink_rcv_skb+0x1f5/0x440 [ 83.019270][ T4824] ? sock_diag_bind+0xa0/0xa0 [ 83.023969][ T4824] ? netlink_ack+0xb50/0xb50 [ 83.028609][ T4824] ? __lock_acquire+0x7d10/0x7d10 [ 83.033654][ T4824] sock_diag_rcv+0x26/0x40 [ 83.038083][ T4824] netlink_unicast+0x774/0x920 [ 83.042842][ T4824] netlink_sendmsg+0x8ba/0xbe0 [ 83.047608][ T4824] ? netlink_getsockopt+0x570/0x570 [ 83.052805][ T4824] ? aa_sock_msg_perm+0x94/0x150 [ 83.057738][ T4824] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 83.063018][ T4824] ? security_socket_sendmsg+0x7c/0xa0 [ 83.068542][ T4824] sock_write_iter+0x2a6/0x3a0 [ 83.073300][ T4824] ? sock_read_iter+0x380/0x380 [ 83.078155][ T4824] do_iter_readv_writev+0x47e/0x5f0 [ 83.083341][ T4824] ? aa_path_link+0x880/0x880 [ 83.088017][ T4824] ? generic_file_rw_checks+0x280/0x280 [ 83.093571][ T4824] ? common_file_perm+0x171/0x1c0 [ 83.098593][ T4824] ? fsnotify_perm+0x5d/0x560 [ 83.103275][ T4824] ? security_file_permission+0x75/0xa0 [ 83.108816][ T4824] do_iter_write+0x205/0x7b0 [ 83.113411][ T4824] ? import_iovec+0x6f/0xa0 [ 83.117906][ T4824] do_writev+0x281/0x480 [ 83.122236][ T4824] ? do_readv+0x460/0x460 [ 83.126578][ T4824] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 83.132584][ T4824] ? lock_chain_count+0x20/0x20 [ 83.137453][ T4824] ? vtime_user_exit+0x2c8/0x3e0 [ 83.142390][ T4824] ? lockdep_hardirqs_on+0x94/0x140 [ 83.147602][ T4824] do_syscall_64+0x4c/0xa0 [ 83.152009][ T4824] ? clear_bhb_loop+0x30/0x80 [ 83.156696][ T4824] ? clear_bhb_loop+0x30/0x80 [ 83.161371][ T4824] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 83.167268][ T4824] RIP: 0033:0x7f10425c0799 [ 83.171691][ T4824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.191290][ T4824] RSP: 002b:00007f104081a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 83.199697][ T4824] RAX: ffffffffffffffda RBX: 00007f1042839fa0 RCX: 00007f10425c0799 [ 83.207665][ T4824] RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000004 [ 83.215629][ T4824] RBP: 00007f1042656bd9 R08: 0000000000000000 R09: 0000000000000000 [ 83.223588][ T4824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.231573][ T4824] R13: 00007f104283a038 R14: 00007f1042839fa0 R15: 00007ffe6c565b68 [ 83.239577][ T4824] [ 83.243511][ T4824] BUG: sleeping function called from invalid context at net/core/sock.c:3291 [ 83.253037][ T4824] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4824, name: syz.2.208 [ 83.262013][ T4824] INFO: lockdep is turned off. [ 83.266796][ T4824] Preemption disabled at: [ 83.266805][ T4824] [<0000000000000000>] 0x0 [ 83.275609][ T4824] CPU: 0 PID: 4824 Comm: syz.2.208 Not tainted syzkaller #0 [ 83.282901][ T4824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 83.292971][ T4824] Call Trace: [ 83.296260][ T4824] [ 83.299200][ T4824] dump_stack_lvl+0x188/0x250 [ 83.303900][ T4824] ? show_regs_print_info+0x20/0x20 [ 83.309118][ T4824] ? load_image+0x400/0x400 [ 83.313702][ T4824] ___might_sleep+0x493/0x610 [ 83.318400][ T4824] ? __might_sleep+0xf0/0xf0 [ 83.323009][ T4824] ? read_lock_is_recursive+0x10/0x10 [ 83.328407][ T4824] ? rcu_lock_release+0x5/0x20 [ 83.333211][ T4824] __lock_sock_fast+0x2f/0xe0 [ 83.337927][ T4824] ? inet_sk_diag_fill+0xf5e/0x1ca0 [ 83.343129][ T4824] mptcp_diag_get_info+0x1fe/0x9e0 [ 83.348237][ T4824] inet_sk_diag_fill+0xf5e/0x1ca0 [ 83.353282][ T4824] ? inet_diag_msg_attrs_fill+0x930/0x930 [ 83.359026][ T4824] ? do_raw_spin_lock+0x128/0x2f0 [ 83.364089][ T4824] ? __rwlock_init+0x140/0x140 [ 83.368869][ T4824] ? inet_diag_bc_sk+0x18b/0x1120 [ 83.373920][ T4824] mptcp_diag_dump+0xce6/0x12b0 [ 83.378801][ T4824] ? mptcp_token_join_cookie_init_state+0x460/0x460 [ 83.385424][ T4824] __inet_diag_dump+0x1f6/0x380 [ 83.390280][ T4824] netlink_dump+0x694/0xcf0 [ 83.394804][ T4824] ? netlink_lookup+0x1d0/0x1d0 [ 83.399660][ T4824] ? __inet_diag_dump_start+0x805/0x970 [ 83.405236][ T4824] __netlink_dump_start+0x523/0x700 [ 83.410471][ T4824] inet_diag_handler_cmd+0x1d3/0x2b0 [ 83.415772][ T4824] ? rcu_lock_release+0x20/0x20 [ 83.420642][ T4824] ? inet_diag_handler_get_info+0xb90/0xb90 [ 83.426558][ T4824] ? inet_diag_dump_start+0x20/0x20 [ 83.431785][ T4824] ? inet_diag_dump+0x50/0x50 [ 83.436505][ T4824] ? rcu_lock_release+0x20/0x20 [ 83.441385][ T4824] sock_diag_rcv_msg+0x164/0x3e0 [ 83.446346][ T4824] netlink_rcv_skb+0x1f5/0x440 [ 83.451126][ T4824] ? sock_diag_bind+0xa0/0xa0 [ 83.455821][ T4824] ? netlink_ack+0xb50/0xb50 [ 83.460428][ T4824] ? __lock_acquire+0x7d10/0x7d10 [ 83.465470][ T4824] sock_diag_rcv+0x26/0x40 [ 83.469901][ T4824] netlink_unicast+0x774/0x920 [ 83.474683][ T4824] netlink_sendmsg+0x8ba/0xbe0 [ 83.479468][ T4824] ? netlink_getsockopt+0x570/0x570 [ 83.484671][ T4824] ? aa_sock_msg_perm+0x94/0x150 [ 83.489615][ T4824] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 83.494891][ T4824] ? security_socket_sendmsg+0x7c/0xa0 [ 83.500344][ T4824] sock_write_iter+0x2a6/0x3a0 [ 83.505103][ T4824] ? sock_read_iter+0x380/0x380 [ 83.509960][ T4824] do_iter_readv_writev+0x47e/0x5f0 [ 83.515158][ T4824] ? aa_path_link+0x880/0x880 [ 83.519844][ T4824] ? generic_file_rw_checks+0x280/0x280 [ 83.525392][ T4824] ? common_file_perm+0x171/0x1c0 [ 83.530406][ T4824] ? fsnotify_perm+0x5d/0x560 [ 83.535100][ T4824] ? security_file_permission+0x75/0xa0 [ 83.540643][ T4824] do_iter_write+0x205/0x7b0 [ 83.545231][ T4824] ? import_iovec+0x6f/0xa0 [ 83.549734][ T4824] do_writev+0x281/0x480 [ 83.553975][ T4824] ? do_readv+0x460/0x460 [ 83.558296][ T4824] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 83.564269][ T4824] ? lock_chain_count+0x20/0x20 [ 83.569114][ T4824] ? vtime_user_exit+0x2c8/0x3e0 [ 83.574057][ T4824] ? lockdep_hardirqs_on+0x94/0x140 [ 83.579277][ T4824] do_syscall_64+0x4c/0xa0 [ 83.583699][ T4824] ? clear_bhb_loop+0x30/0x80 [ 83.588362][ T4824] ? clear_bhb_loop+0x30/0x80 [ 83.593042][ T4824] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 83.598944][ T4824] RIP: 0033:0x7f10425c0799 [ 83.603358][ T4824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.622987][ T4824] RSP: 002b:00007f104081a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 83.631405][ T4824] RAX: ffffffffffffffda RBX: 00007f1042839fa0 RCX: 00007f10425c0799 [ 83.639420][ T4824] RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000004 [ 83.647388][ T4824] RBP: 00007f1042656bd9 R08: 0000000000000000 R09: 0000000000000000 [ 83.655351][ T4824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.663317][ T4824] R13: 00007f104283a038 R14: 00007f1042839fa0 R15: 00007ffe6c565b68 [ 83.671295][ T4824] [ 83.674363][ T4824] BUG: scheduling while atomic: syz.2.208/4824/0x00000002 [ 83.681476][ T4824] INFO: lockdep is turned off. [ 83.686230][ T4824] Modules linked in: [ 83.690125][ T4824] Preemption disabled at: [ 83.690131][ T4824] [<0000000000000000>] 0x0 [ 83.698879][ T4824] Kernel panic - not syncing: scheduling while atomic: panic_on_warn set ... [ 83.707625][ T4824] CPU: 0 PID: 4824 Comm: syz.2.208 Tainted: G W syzkaller #0 [ 83.716281][ T4824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 83.726318][ T4824] Call Trace: [ 83.729588][ T4824] [ 83.732529][ T4824] dump_stack_lvl+0x188/0x250 [ 83.737210][ T4824] ? show_regs_print_info+0x20/0x20 [ 83.742413][ T4824] ? load_image+0x400/0x400 [ 83.746911][ T4824] panic+0x2e5/0x810 [ 83.750812][ T4824] ? bpf_jit_dump+0xd0/0xd0 [ 83.755314][ T4824] ? vprintk_emit+0xf9/0x150 [ 83.759890][ T4824] ? _printk+0xda/0x130 [ 83.764058][ T4824] check_panic_on_warn+0x80/0xa0 [ 83.768996][ T4824] __schedule_bug+0x193/0x1f0 [ 83.773667][ T4824] ? raw_spin_rq_unlock_irq+0x90/0x90 [ 83.779027][ T4824] __schedule+0x1324/0x43c0 [ 83.783523][ T4824] ? trace_hardirqs_off_finish+0xca/0x1f0 [ 83.789232][ T4824] ? prepare_to_wait_exclusive+0xc5/0x220 [ 83.794954][ T4824] ? do_raw_spin_lock+0x128/0x2f0 [ 83.799970][ T4824] ? __kthread_should_park+0xa2/0xe0 [ 83.805254][ T4824] ? lock_chain_count+0x20/0x20 [ 83.810106][ T4824] ? lock_release+0xb5/0x8a0 [ 83.814691][ T4824] ? lockdep_hardirqs_on_prepare+0x770/0x770 [ 83.820670][ T4824] ? __lock_sock+0x159/0x2b0 [ 83.825263][ T4824] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 83.831145][ T4824] ? release_firmware_map_entry+0x190/0x190 [ 83.837038][ T4824] ? __lock_sock+0x159/0x2b0 [ 83.841620][ T4824] ? __local_bh_enable_ip+0x136/0x1c0 [ 83.846991][ T4824] ? _local_bh_enable+0xa0/0xa0 [ 83.851845][ T4824] schedule+0x11b/0x1e0 [ 83.856005][ T4824] __lock_sock+0x15e/0x2b0 [ 83.860413][ T4824] ? sk_page_frag_refill+0x200/0x200 [ 83.865776][ T4824] ? do_raw_spin_lock+0x128/0x2f0 [ 83.870786][ T4824] ? init_wait_entry+0xd0/0xd0 [ 83.875543][ T4824] ? __rwlock_init+0x140/0x140 [ 83.880291][ T4824] ? rcu_lock_release+0x5/0x20 [ 83.885050][ T4824] ? __lock_sock_fast+0x43/0xe0 [ 83.889894][ T4824] __lock_sock_fast+0x78/0xe0 [ 83.894581][ T4824] ? inet_sk_diag_fill+0xf5e/0x1ca0 [ 83.899776][ T4824] mptcp_diag_get_info+0x1fe/0x9e0 [ 83.904887][ T4824] inet_sk_diag_fill+0xf5e/0x1ca0 [ 83.909915][ T4824] ? inet_diag_msg_attrs_fill+0x930/0x930 [ 83.915632][ T4824] ? do_raw_spin_lock+0x128/0x2f0 [ 83.920654][ T4824] ? __rwlock_init+0x140/0x140 [ 83.925407][ T4824] ? inet_diag_bc_sk+0x18b/0x1120 [ 83.930429][ T4824] mptcp_diag_dump+0xce6/0x12b0 [ 83.935275][ T4824] ? mptcp_token_join_cookie_init_state+0x460/0x460 [ 83.941857][ T4824] __inet_diag_dump+0x1f6/0x380 [ 83.946716][ T4824] netlink_dump+0x694/0xcf0 [ 83.951221][ T4824] ? netlink_lookup+0x1d0/0x1d0 [ 83.956068][ T4824] ? __inet_diag_dump_start+0x805/0x970 [ 83.961692][ T4824] __netlink_dump_start+0x523/0x700 [ 83.966897][ T4824] inet_diag_handler_cmd+0x1d3/0x2b0 [ 83.972180][ T4824] ? rcu_lock_release+0x20/0x20 [ 83.977033][ T4824] ? inet_diag_handler_get_info+0xb90/0xb90 [ 83.982915][ T4824] ? inet_diag_dump_start+0x20/0x20 [ 83.988105][ T4824] ? inet_diag_dump+0x50/0x50 [ 83.992773][ T4824] ? rcu_lock_release+0x20/0x20 [ 83.997617][ T4824] sock_diag_rcv_msg+0x164/0x3e0 [ 84.002544][ T4824] netlink_rcv_skb+0x1f5/0x440 [ 84.007301][ T4824] ? sock_diag_bind+0xa0/0xa0 [ 84.011980][ T4824] ? netlink_ack+0xb50/0xb50 [ 84.016571][ T4824] ? __lock_acquire+0x7d10/0x7d10 [ 84.021610][ T4824] sock_diag_rcv+0x26/0x40 [ 84.026020][ T4824] netlink_unicast+0x774/0x920 [ 84.030776][ T4824] netlink_sendmsg+0x8ba/0xbe0 [ 84.035534][ T4824] ? netlink_getsockopt+0x570/0x570 [ 84.040724][ T4824] ? aa_sock_msg_perm+0x94/0x150 [ 84.045657][ T4824] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 84.050935][ T4824] ? security_socket_sendmsg+0x7c/0xa0 [ 84.056401][ T4824] sock_write_iter+0x2a6/0x3a0 [ 84.061169][ T4824] ? sock_read_iter+0x380/0x380 [ 84.066024][ T4824] do_iter_readv_writev+0x47e/0x5f0 [ 84.071210][ T4824] ? aa_path_link+0x880/0x880 [ 84.075902][ T4824] ? generic_file_rw_checks+0x280/0x280 [ 84.081459][ T4824] ? common_file_perm+0x171/0x1c0 [ 84.086478][ T4824] ? fsnotify_perm+0x5d/0x560 [ 84.091163][ T4824] ? security_file_permission+0x75/0xa0 [ 84.096707][ T4824] do_iter_write+0x205/0x7b0 [ 84.101300][ T4824] ? import_iovec+0x6f/0xa0 [ 84.105810][ T4824] do_writev+0x281/0x480 [ 84.110043][ T4824] ? do_readv+0x460/0x460 [ 84.114393][ T4824] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 84.120370][ T4824] ? lock_chain_count+0x20/0x20 [ 84.125229][ T4824] ? vtime_user_exit+0x2c8/0x3e0 [ 84.130172][ T4824] ? lockdep_hardirqs_on+0x94/0x140 [ 84.135377][ T4824] do_syscall_64+0x4c/0xa0 [ 84.139788][ T4824] ? clear_bhb_loop+0x30/0x80 [ 84.144465][ T4824] ? clear_bhb_loop+0x30/0x80 [ 84.149144][ T4824] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 84.155043][ T4824] RIP: 0033:0x7f10425c0799 [ 84.159548][ T4824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.179164][ T4824] RSP: 002b:00007f104081a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 84.187576][ T4824] RAX: ffffffffffffffda RBX: 00007f1042839fa0 RCX: 00007f10425c0799 [ 84.195533][ T4824] RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000004 [ 84.203489][ T4824] RBP: 00007f1042656bd9 R08: 0000000000000000 R09: 0000000000000000 [ 84.211595][ T4824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.219579][ T4824] R13: 00007f104283a038 R14: 00007f1042839fa0 R15: 00007ffe6c565b68 [ 84.227573][ T4824] [ 84.230678][ T4824] Kernel Offset: disabled [ 84.235125][ T4824] Rebooting in 86400 seconds..