last executing test programs: 5.476037365s ago: executing program 1 (id=2): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010428bd700001000000000000", @ANYRES32=0x0, @ANYBLOB="080000000000010014000300776c616e30000000000000000000000008000a00", @ANYRES32=r2, @ANYBLOB="3a0841b581f948f8e8716097f76f7cc45190c3f5b387908d0a6281810fcd55f11d0d6e533944a8fed825b774196277cfb303ae76c6c8fc854cacde3b59f5d43bfa"], 0x3c}, 0x1, 0x0, 0x0, 0x240008c4}, 0x20008004) memfd_create(0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)=0x0) ptrace$setsig(0x4203, r3, 0x4a90, &(0x7f0000000300)={0x5, 0x7fff, 0x81a}) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4a) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') ftruncate(0xffffffffffffffff, 0x6000004) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x4000) 4.558078534s ago: executing program 2 (id=3): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000080)}) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x161140, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000015c0)={0x1, 0x0, [{0x1, 0x9, 0x7, 0x1, 0x8}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f00000000c0)=0x3) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000880)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1000700000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34cf2645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd673c1eeda4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d06c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235eaa92143ce4bb5c5acb290e8976dcac779ff0000f5620000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05be23dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe656c9c46bffbe9dd03970800000000000000d372bdd6f89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4.334748551s ago: executing program 0 (id=1): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010428bd700001000000000000", @ANYRES32=0x0, @ANYBLOB="080000000000010014000300776c616e30000000000000000000000008000a00", @ANYRES32=r2, @ANYBLOB="3a0841b581f948f8e8716097f76f7cc45190c3f5b387908d0a6281810fcd55f11d0d6e533944a8fed825b774196277cfb303ae76c6c8fc854cacde3b59f5d43bfa"], 0x3c}, 0x1, 0x0, 0x0, 0x240008c4}, 0x20008004) memfd_create(0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)=0x0) ptrace$setsig(0x4203, r3, 0x4a90, &(0x7f0000000300)={0x5, 0x7fff, 0x81a}) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4a) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x103a42, 0x0) ftruncate(r5, 0x6000004) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x4000) 4.329091751s ago: executing program 3 (id=4): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x6) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) epoll_create(0x7) request_key(0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="04060306c900502dc24b2113b33392b07bdfa8882e96170f34bbd31935245958"], 0x6) write$P9_RREMOVE(r1, &(0x7f0000000180)={0x7, 0x7b, 0x1}, 0x7) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/udp\x00') read$FUSE(r3, &(0x7f0000001300)={0x2020}, 0x2020) preadv(r3, &(0x7f0000000440)=[{&(0x7f0000000340)=""/255, 0xff}], 0x1, 0x7, 0x7) getsockopt$IPT_SO_GET_ENTRIES(r3, 0x0, 0x41, 0x0, &(0x7f0000000100)) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40408d4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x7c}, [@ldst={0x6, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'ip6gretap0\x00'}) r5 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000bc0)={0x1, @sdr={0x41416770, 0x66c2}}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={0x0}, 0x1, 0x0, 0x0, 0x890}, 0x8000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) 2.988938484s ago: executing program 1 (id=5): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000280000"], 0x0, 0x42}, 0x28) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_SETTRIGGER(0xffffffffffffffff, 0x40045010, &(0x7f00000000c0)=0x3) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, 0x0, 0x0) r5 = socket(0x40000000015, 0x5, 0x0) connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) recvmmsg(r5, &(0x7f0000001740), 0x0, 0x2, 0x0) ioctl$KDFONTOP_GET(r0, 0x4b72, &(0x7f0000000840)={0x1, 0x0, 0x1d, 0x12, 0x1cc, &(0x7f0000000440)}) 2.453276271s ago: executing program 0 (id=6): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = socket(0x2, 0x400000000002, 0x0) setsockopt(r0, 0x0, 0x22, &(0x7f0000000080)="01", 0x1) socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) socket$tipc(0x1e, 0x5, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000540)={'ip6gre0\x00', &(0x7f00000004c0)={'syztnl0\x00', 0x0, 0x29, 0x6, 0xf, 0x0, 0x0, @private0, @empty, 0x8000, 0x721, 0x1, 0x1}}) sendmsg$nl_route_sched(r2, 0x0, 0x800) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$rxrpc(0x21, 0x2, 0xa) getpgid(0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r5 = socket$inet6(0xa, 0x3, 0x7) r6 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r6, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @dev, 0x2}, 0xff32, 0x0}, 0xe07e872420dfefca) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000004001000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000000)={@loopback, 0x0, 0x0, 0xff, 0x1, 0xc, 0x4f0}, 0x20) r8 = syz_open_dev$audion(&(0x7f0000000080), 0x9, 0x8000) ioctl$sock_kcm_SIOCKCMUNATTACH(r8, 0x89e1, &(0x7f0000000180)={r4}) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x12, 0x7, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x6, '\x00', r3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000340)={r2, 0xffffffffffffffff, 0x4, r10}, 0x10) 2.414971292s ago: executing program 3 (id=7): r0 = openat$dsp(0xffffff9c, 0x0, 0x100, 0x0) ioctl$SNDCTL_DSP_POST(r0, 0x5008, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8983, &(0x7f0000000680)={0x7, 'vlan1\x00', {0xb}, 0x1}) syz_emit_vhci(&(0x7f0000000300)=@HCI_EVENT_PKT={0x4, @hci_ev_encrypt_change={{0x8, 0x4}, {0x80, 0xc9, 0x4}}}, 0x7) r2 = socket(0x2, 0x5, 0x0) openat$proc_mixer(0xffffff9c, &(0x7f0000000240)='/proc/asound/card1/oss_mixer\x00', 0xa2000, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f0000000180)={0x3c, r4, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x40d6}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) openat$procfs(0xffffff9c, &(0x7f0000000100)='/proc/crypto\x00', 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="00012900"/14], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x804) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGKBTYPE(r6, 0x4b48, &(0x7f0000000080)) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000000)={0x1f, 0x3}, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) pread64(0xffffffffffffffff, &(0x7f0000000700)=""/115, 0x73, 0x5) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec02010902"], 0x0) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000003d0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000d0082006c325f64726f7073003400000500870000000000"], 0x4c}}, 0x0) close(0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000001980)={0x11, 0x13, &(0x7f0000000940)=ANY=[@ANYBLOB="18000000ffffffff000000004b00000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000710f0000850000002d0000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b00300008000000085000000060000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x94) ioctl$XFS_IOC_GETVERSION(r6, 0x80047601, &(0x7f00000002c0)) 869.206662ms ago: executing program 1 (id=8): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'netdevsim0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x401, 0x0, 0x80000, {0x0, 0x0, 0x0, 0x0, 0x2458a}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_ACTIVE_SLAVE={0x8, 0x2, r1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000050}, 0x4000040) 100.909626ms ago: executing program 2 (id=9): socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x400000000000128, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x101840) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000080)={0xa, 0x0, 0x1, {0xe7ff, 0x1, 0x406, 0x870}}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000180)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000200)={0x28, 0x7, r4, 0x0, &(0x7f0000c00000/0x400000)=nil, 0x400000, 0x1004000}) ioctl$IOMMU_HWPT_ALLOC$TEST(r3, 0x3b89, &(0x7f0000000140)={0x28, 0x4, r5, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000100)}) socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) migrate_pages(0x0, 0x5, &(0x7f0000000000)=0x9, 0x0) r6 = socket(0x2b, 0x6, 0x3a) setsockopt$MRT6_ADD_MFC(r6, 0x29, 0xcc, &(0x7f00000003c0)={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0xa, 0x4e22, 0xfffffffd, @local}, 0x0, {[0xfffffffd, 0x0, 0x1, 0x0, 0x0, 0x9]}}, 0x5c) r7 = socket$inet6(0xa, 0x400000000001, 0x7fffffff) sendto$inet6(r7, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4}, 0xffffffffffffff18) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x9}]}) fsopen(0x0, 0x1) close_range(r8, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) io_uring_setup(0xf08, &(0x7f0000000780)={0x0, 0x80003125, 0x3cd0, 0x3, 0x400182}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000080) r9 = syz_open_dev$cec(&(0x7f00000029c0), 0x0, 0x20b41) ioctl$CEC_ADAP_S_LOG_ADDRS(r9, 0xc05c6104, &(0x7f0000002a00)={"8ae484be", 0x3, 0x5, 0x3, 0x3, 0x2, "3446c9426366e6dd08ca51320aa57b", 'ng].', "2baa0d1a", "7895169a", ["efa3f1a1691f20cdf2dca736", "b862fe2ddf691f3de8c3a97d", "324b9b52e04bd98dc0047012", "c99790e23a4e91a9a8e22bcf"]}) 0s ago: executing program 0 (id=10): openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x101000, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r0, 0xc0285628, &(0x7f0000000080)={0x3, @win={{0x7, 0x4, 0x9, 0x4}, 0x2, 0x401a, &(0x7f00000021c0)={{0x6, 0x2, 0x5, 0x40}}, 0x3317, 0x0, 0x8}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) ioctl$vim2m_VIDIOC_G_FMT(r0, 0xc0285629, &(0x7f0000000080)={0x0, @pix_mp={0x7, 0x7, 0x34524742, 0x6, 0x0, [{0x4, 0x10}, {0x80000001, 0xffff}, {0xe, 0x3ff}, {0x1, 0x800000}, {0x2eb700, 0xf5}, {0x4, 0xd}, {0x100, 0x2}, {0x0, 0x1ff}], 0xf9, 0x0, 0x2, 0x0, 0x2}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.57' (ED25519) to the list of known hosts. [ 62.585170][ T5758] cgroup: Unknown subsys name 'net' [ 62.718704][ T5758] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 64.057245][ T5758] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 65.569917][ T5776] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 65.578497][ T5776] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 65.586404][ T5776] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 65.594586][ T5776] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 65.602318][ T5776] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 65.609890][ T5776] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 65.614171][ T5782] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 65.617788][ T5776] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 65.632787][ T5776] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 65.633817][ T5782] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 65.641901][ T5776] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 65.647582][ T5784] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 65.654994][ T5776] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 65.669679][ T5784] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 65.669718][ T5782] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 65.685535][ T5782] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 65.692807][ T5776] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 65.700755][ T5785] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 65.710138][ T5785] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 65.714001][ T5776] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 65.717574][ T5785] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 65.725100][ T5776] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 65.742794][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 65.762177][ T5776] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 66.048982][ T5770] chnl_net:caif_netlink_parms(): no params data found [ 66.178864][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 66.214768][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 66.241066][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.248781][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.256224][ T5770] bridge_slave_0: entered allmulticast mode [ 66.263806][ T5770] bridge_slave_0: entered promiscuous mode [ 66.277148][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.284309][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.291577][ T5770] bridge_slave_1: entered allmulticast mode [ 66.298532][ T5770] bridge_slave_1: entered promiscuous mode [ 66.404753][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.420089][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.446456][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.453751][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.460885][ T5773] bridge_slave_0: entered allmulticast mode [ 66.467876][ T5773] bridge_slave_0: entered promiscuous mode [ 66.474881][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 66.486240][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.494052][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.501170][ T5773] bridge_slave_1: entered allmulticast mode [ 66.508669][ T5773] bridge_slave_1: entered promiscuous mode [ 66.546672][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.554097][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.561358][ T5772] bridge_slave_0: entered allmulticast mode [ 66.568310][ T5772] bridge_slave_0: entered promiscuous mode [ 66.603584][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.610714][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.618198][ T5772] bridge_slave_1: entered allmulticast mode [ 66.625615][ T5772] bridge_slave_1: entered promiscuous mode [ 66.655171][ T5770] team0: Port device team_slave_0 added [ 66.670534][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.683315][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.694391][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.706781][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.717236][ T5770] team0: Port device team_slave_1 added [ 66.787040][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.794106][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.820191][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.833953][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.840901][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.866962][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.884749][ T5773] team0: Port device team_slave_0 added [ 66.895900][ T5772] team0: Port device team_slave_0 added [ 66.909357][ T5772] team0: Port device team_slave_1 added [ 66.924954][ T5773] team0: Port device team_slave_1 added [ 66.941081][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.948390][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.955772][ T5771] bridge_slave_0: entered allmulticast mode [ 66.962780][ T5771] bridge_slave_0: entered promiscuous mode [ 66.994960][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.002085][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.010465][ T5771] bridge_slave_1: entered allmulticast mode [ 67.017296][ T5771] bridge_slave_1: entered promiscuous mode [ 67.035358][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.042629][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.068538][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.098354][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.105764][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.131952][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.162529][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.169492][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.195623][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.231056][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.238223][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.264523][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.277592][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.289875][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.311335][ T5770] hsr_slave_0: entered promiscuous mode [ 67.317763][ T5770] hsr_slave_1: entered promiscuous mode [ 67.357444][ T5772] hsr_slave_0: entered promiscuous mode [ 67.363708][ T5772] hsr_slave_1: entered promiscuous mode [ 67.369693][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.378199][ T5772] Cannot create hsr debugfs directory [ 67.409309][ T5771] team0: Port device team_slave_0 added [ 67.449326][ T5773] hsr_slave_0: entered promiscuous mode [ 67.455689][ T5773] hsr_slave_1: entered promiscuous mode [ 67.462569][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.470142][ T5773] Cannot create hsr debugfs directory [ 67.477785][ T5771] team0: Port device team_slave_1 added [ 67.555335][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.562718][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.589058][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.629589][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.636720][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.663016][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.693054][ T5776] Bluetooth: hci0: command tx timeout [ 67.772702][ T5776] Bluetooth: hci2: command tx timeout [ 67.772760][ T5781] Bluetooth: hci3: command tx timeout [ 67.825829][ T5771] hsr_slave_0: entered promiscuous mode [ 67.834647][ T5771] hsr_slave_1: entered promiscuous mode [ 67.840684][ T5771] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.848843][ T5771] Cannot create hsr debugfs directory [ 67.855068][ T5781] Bluetooth: hci1: command tx timeout [ 67.943375][ T5770] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 67.962860][ T5770] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 67.983328][ T5770] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 67.994183][ T5770] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 68.068444][ T5772] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.101850][ T5772] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.140431][ T5772] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.149781][ T5772] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.216742][ T5773] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 68.226118][ T5773] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 68.239345][ T5773] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 68.248921][ T5773] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 68.328241][ T5771] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 68.345878][ T5771] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 68.355904][ T5771] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 68.370903][ T5771] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 68.451020][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.484426][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.524205][ T4332] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.531470][ T4332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.541272][ T4332] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.548438][ T4332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.608113][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.627979][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.657225][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.673552][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.688286][ T4438] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.695469][ T4438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.716196][ T4438] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.723481][ T4438] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.740291][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.769556][ T4332] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.776720][ T4332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.792705][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.815954][ T4332] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.823123][ T4332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.865173][ T4332] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.872350][ T4332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.931121][ T4332] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.938280][ T4332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.005750][ T5772] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 69.017073][ T5772] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 69.233502][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.321600][ T5770] veth0_vlan: entered promiscuous mode [ 69.366778][ T5770] veth1_vlan: entered promiscuous mode [ 69.423361][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.458862][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.524913][ T5770] veth0_macvtap: entered promiscuous mode [ 69.539027][ T5770] veth1_macvtap: entered promiscuous mode [ 69.561771][ T5771] veth0_vlan: entered promiscuous mode [ 69.577855][ T5773] veth0_vlan: entered promiscuous mode [ 69.588469][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.609856][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.624035][ T5771] veth1_vlan: entered promiscuous mode [ 69.637142][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.656610][ T5773] veth1_vlan: entered promiscuous mode [ 69.669035][ T5770] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.680935][ T5770] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.690662][ T5770] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.701003][ T5770] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.773653][ T5781] Bluetooth: hci0: command tx timeout [ 69.798129][ T5772] veth0_vlan: entered promiscuous mode [ 69.817379][ T5771] veth0_macvtap: entered promiscuous mode [ 69.850565][ T5773] veth0_macvtap: entered promiscuous mode [ 69.852635][ T5781] Bluetooth: hci2: command tx timeout [ 69.861832][ T5781] Bluetooth: hci3: command tx timeout [ 69.869062][ T5771] veth1_macvtap: entered promiscuous mode [ 69.889076][ T5772] veth1_vlan: entered promiscuous mode [ 69.900170][ T5773] veth1_macvtap: entered promiscuous mode [ 69.917735][ T4543] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.928276][ T4543] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.943625][ T5781] Bluetooth: hci1: command tx timeout [ 69.986079][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.999096][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.010591][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.027633][ T4558] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.036060][ T5772] veth0_macvtap: entered promiscuous mode [ 70.043649][ T4558] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.053829][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.064494][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.076358][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.086878][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.098428][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.119805][ T5772] veth1_macvtap: entered promiscuous mode [ 70.128712][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.139519][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.151500][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.163002][ T5773] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.171720][ T5773] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.183798][ T5773] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.192641][ T5773] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.216471][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.227302][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.238824][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.249704][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.269203][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.307218][ T5771] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.332172][ T5771] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.340891][ T5771] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.362213][ T5771] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.375410][ T5832] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2'. [ 70.393820][ T5832] syz.1.2[5832]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 70.404826][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.416652][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.429821][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.440765][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.454129][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.465047][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.477240][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.517897][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.528750][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.538858][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.549927][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.559972][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.580899][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.599356][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.635469][ T5772] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.646688][ T5772] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.656719][ T5772] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.666240][ T5772] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.735208][ T1328] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.760188][ T1328] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.915144][ T4558] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.928264][ T4558] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.019491][ T1328] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.039513][ T1328] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.061250][ T4543] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.071831][ T4543] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.167546][ T4438] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.176021][ T4438] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.224050][ T4543] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.261212][ T4543] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.380500][ T5835] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 71.462090][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.470057][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.567128][ T5839] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1'. [ 72.035200][ T5781] Bluetooth: hci0: command tx timeout [ 72.040611][ T5781] Bluetooth: hci3: command tx timeout [ 72.046098][ T5781] Bluetooth: hci2: command tx timeout [ 72.051911][ T5781] Bluetooth: hci1: command tx timeout [ 72.600629][ T5840] Zero length message leads to an empty skb [ 72.670111][ T5843] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 72.733497][ T5843] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 73.482234][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 74.874718][ T5776] Bluetooth: hci1: command tx timeout [ 74.880159][ T5776] Bluetooth: hci2: command tx timeout [ 74.886062][ T5776] Bluetooth: hci3: command tx timeout [ 74.891470][ T5776] Bluetooth: hci0: command tx timeout [ 75.049370][ T5856] block nbd0: Unsupported socket: should be TCP or UNIX. [ 75.882646][ T5812] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 76.068375][ T27] audit: type=1326 audit(1781368466.651:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5861 comm="syz.2.9" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb00a39ce59 code=0x0 [ 76.091679][ T5812] usb 4-1: Using ep0 maxpacket: 32 [ 76.098947][ T5785] ------------[ cut here ]------------ [ 76.104702][ T5785] WARNING: CPU: 1 PID: 5785 at net/bluetooth/hci_conn.c:569 hci_conn_timeout+0xf9/0x290 [ 76.114496][ T5785] Modules linked in: [ 76.118389][ T5785] CPU: 1 PID: 5785 Comm: kworker/u5:8 Not tainted syzkaller #0 [ 76.125966][ T5785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 76.136029][ T5785] Workqueue: hci1 hci_conn_timeout [ 76.141145][ T5785] RIP: 0010:hci_conn_timeout+0xf9/0x290 [ 76.147774][ T5785] Code: f7 48 89 df e8 c8 e5 08 00 eb 07 e8 31 f3 ff f7 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 ec db fe ff e8 17 f3 ff f7 <0f> 0b eb 8e 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 38 ff ff ff 4c [ 76.167536][ T5785] RSP: 0018:ffffc900046efb90 EFLAGS: 00010293 [ 76.173931][ T5785] RAX: ffffffff89873879 RBX: ffff88802bffe000 RCX: ffff88802c291e00 [ 76.181900][ T5785] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 76.190095][ T5785] RBP: 00000000ffffffff R08: ffff88802bffe013 R09: 1ffff110057ffc02 [ 76.198100][ T5785] R10: dffffc0000000000 R11: ffffed10057ffc03 R12: dffffc0000000000 [ 76.206151][ T5785] R13: dffffc0000000000 R14: ffff88802bffe350 R15: ffff88802bffe010 [ 76.214151][ T5785] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 76.223108][ T5785] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.229675][ T5785] CR2: 00002000000b4030 CR3: 0000000023ed3000 CR4: 00000000003506e0 [ 76.237673][ T5785] Call Trace: [ 76.240955][ T5785] [ 76.243910][ T5785] ? process_scheduled_works+0x96f/0x15d0 [ 76.250121][ T5785] process_scheduled_works+0xa5d/0x15d0 [ 76.255812][ T5785] ? worker_attach_to_pool+0x380/0x380 [ 76.261269][ T5785] ? assign_work+0x3d2/0x5d0 [ 76.265874][ T5785] worker_thread+0xa55/0xfc0 [ 76.270454][ T5785] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 76.276369][ T5785] ? _raw_spin_unlock+0x40/0x40 [ 76.281209][ T5785] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 76.287143][ T5785] kthread+0x2fa/0x390 [ 76.291203][ T5785] ? pr_cont_work+0x560/0x560 [ 76.296210][ T5785] ? kthread_blkcg+0xd0/0xd0 [ 76.300812][ T5785] ret_from_fork+0x48/0x80 [ 76.305239][ T5785] ? kthread_blkcg+0xd0/0xd0 [ 76.309812][ T5785] ret_from_fork_asm+0x11/0x20 [ 76.314609][ T5785] [ 76.317617][ T5785] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 76.324970][ T5785] CPU: 1 PID: 5785 Comm: kworker/u5:8 Not tainted syzkaller #0 [ 76.332505][ T5785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 76.342556][ T5785] Workqueue: hci1 hci_conn_timeout [ 76.347657][ T5785] Call Trace: [ 76.350920][ T5785] [ 76.353841][ T5785] dump_stack_lvl+0x18c/0x250 [ 76.358505][ T5785] ? show_regs_print_info+0x20/0x20 [ 76.363688][ T5785] ? load_image+0x420/0x420 [ 76.368228][ T5785] panic+0x2dc/0x730 [ 76.372117][ T5785] ? bpf_jit_dump+0xd0/0xd0 [ 76.376623][ T5785] ? ret_from_fork_asm+0x11/0x20 [ 76.381569][ T5785] __warn+0x2e0/0x470 [ 76.385540][ T5785] ? hci_conn_timeout+0xf9/0x290 [ 76.390465][ T5785] ? hci_conn_timeout+0xf9/0x290 [ 76.395384][ T5785] report_bug+0x2be/0x4f0 [ 76.399697][ T5785] ? hci_conn_timeout+0xf9/0x290 [ 76.404618][ T5785] ? hci_conn_timeout+0xf9/0x290 [ 76.409537][ T5785] ? hci_conn_timeout+0xfb/0x290 [ 76.414465][ T5785] handle_bug+0xcf/0x120 [ 76.418700][ T5785] exc_invalid_op+0x1a/0x50 [ 76.423189][ T5785] asm_exc_invalid_op+0x1a/0x20 [ 76.428031][ T5785] RIP: 0010:hci_conn_timeout+0xf9/0x290 [ 76.433565][ T5785] Code: f7 48 89 df e8 c8 e5 08 00 eb 07 e8 31 f3 ff f7 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 ec db fe ff e8 17 f3 ff f7 <0f> 0b eb 8e 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 38 ff ff ff 4c [ 76.453163][ T5785] RSP: 0018:ffffc900046efb90 EFLAGS: 00010293 [ 76.459215][ T5785] RAX: ffffffff89873879 RBX: ffff88802bffe000 RCX: ffff88802c291e00 [ 76.467171][ T5785] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 76.475123][ T5785] RBP: 00000000ffffffff R08: ffff88802bffe013 R09: 1ffff110057ffc02 [ 76.483075][ T5785] R10: dffffc0000000000 R11: ffffed10057ffc03 R12: dffffc0000000000 [ 76.491028][ T5785] R13: dffffc0000000000 R14: ffff88802bffe350 R15: ffff88802bffe010 [ 76.498993][ T5785] ? hci_conn_timeout+0xf9/0x290 [ 76.503944][ T5785] ? process_scheduled_works+0x96f/0x15d0 [ 76.509651][ T5785] process_scheduled_works+0xa5d/0x15d0 [ 76.515193][ T5785] ? worker_attach_to_pool+0x380/0x380 [ 76.520639][ T5785] ? assign_work+0x3d2/0x5d0 [ 76.525214][ T5785] worker_thread+0xa55/0xfc0 [ 76.529792][ T5785] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 76.535671][ T5785] ? _raw_spin_unlock+0x40/0x40 [ 76.540503][ T5785] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 76.546390][ T5785] kthread+0x2fa/0x390 [ 76.550440][ T5785] ? pr_cont_work+0x560/0x560 [ 76.555103][ T5785] ? kthread_blkcg+0xd0/0xd0 [ 76.559674][ T5785] ret_from_fork+0x48/0x80 [ 76.564073][ T5785] ? kthread_blkcg+0xd0/0xd0 [ 76.568646][ T5785] ret_from_fork_asm+0x11/0x20 [ 76.573422][ T5785] [ 76.576573][ T5785] Kernel Offset: disabled [ 76.580920][ T5785] Rebooting in 86400 seconds..