last executing test programs: 11.520709496s ago: executing program 3 (id=59): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000680)={'bond0\x00'}) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bonding_masters\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='+bond0\n', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r2, &(0x7f0000000100)='-bond_slave_0\n', 0xf) write(r2, &(0x7f0000000100)='-bond_slave_1\n', 0xf) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond0/bonding/mode\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='active-backup\n', 0xe) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/net/bond0/bonding/arp_interval\x00', 0x2, 0x0) write(r4, &(0x7f0000000300)='100\n', 0x4) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/net/bond0/bonding/arp_ip_target\x00', 0x2, 0x0) write(r5, &(0x7f0000000400)='+192.168.1.1\n', 0xd) close(r5) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000500)={'bond_slave_0\x00', 0x1002}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r7, &(0x7f0000000600)='+bond_slave_0\n', 0xe) 10.135781022s ago: executing program 3 (id=67): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x8042, 0x20) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r3, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) socketpair$unix(0x1, 0x1, 0x0, 0x0) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x300) socket$can_j1939(0x1d, 0x2, 0x7) 8.219710832s ago: executing program 1 (id=72): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='path_group G1 /bin/tr', 0x15) write(r0, &(0x7f0000000300)='delete path_group G1 /bin/true\n', 0x1f) 7.21395421s ago: executing program 1 (id=74): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='1\n', 0x2) close(r0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='/dev/nullb1\n', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r4, &(0x7f0000000740)='loop\n', 0x5) close(r4) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) write(r5, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e) close(r5) nanosleep(&(0x7f0000000940)={0x0, 0x1dcd6500}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/nvme0n1\x00', 0x2, 0x0) ioctl(r6, 0xc0101282, &(0x7f0000000a00)="00000000000000000100"/80) 7.20326664s ago: executing program 0 (id=75): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000680)={'bond0\x00'}) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bonding_masters\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='+bond0\n', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r2, &(0x7f0000000100)='-bond_slave_0\n', 0xf) write(r2, &(0x7f0000000100)='-bond_slave_1\n', 0xf) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond0/bonding/mode\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='active-backup\n', 0xe) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/net/bond0/bonding/arp_interval\x00', 0x2, 0x0) write(r4, &(0x7f0000000300)='100\n', 0x4) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/net/bond0/bonding/arp_ip_target\x00', 0x2, 0x0) write(r5, &(0x7f0000000400)='+192.168.1.1\n', 0xd) close(r5) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000500)={'bond_slave_0\x00', 0x1002}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r7, &(0x7f0000000600)='+bond_slave_0\n', 0xe) 7.150258843s ago: executing program 3 (id=76): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, &(0x7f00000003c0)={0x7, 0x9, 0x37fffd, 0x3, 0x7fffffff, 0xffffffffffbffff7, 0x9, 0x0, 0x1, 0x6, 0x20000007, 0x3, 0xfffffffffffff04f, 0x3, 0x200000080000000, 0xfffffffffffffff8, 0xfffffffffffffffe, 0x200000005, 0x1, 0x100, 0x6, 0x2, 0x5, 0x7, 0x34, 0x800}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x81}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000000500)={r4, 0x0, 0x7, 0x3, 0x9, 0x5, 0x0, 0x2, {0x0, @in={{0x2, 0x4e23, @empty}}, 0x40000, 0x7ff, 0xc8000000, 0x10000, 0x5}}, &(0x7f00000005c0)=0xb0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x24000f02) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0xdf96}, 0x94) bpf$ITER_CREATE(0xb, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r5 = socket(0x40000000015, 0x5, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x4000000, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}, 0x4}, 0x10) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r6, @ANYBLOB="01000000"], 0x40) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r7}, 0x20) syz_open_dev$ptys(0xc, 0x3, 0x0) 6.960662522s ago: executing program 0 (id=78): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/ubifs/chk_lprops\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='1', 0x1) 5.93606938s ago: executing program 2 (id=79): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f00000002c0)='1\n', 0x2) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r1, &(0x7f00000003c0)='rdma\n', 0x5) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r3, &(0x7f00000004c0)='4420\n', 0x5) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) close(r4) symlinkat(&(0x7f00000005c0)='./config/nvmet/subsystems/n\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/subsystems/n\x00') 5.847836644s ago: executing program 0 (id=80): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/tpm_tis\x00', 0x0, 0x0) 5.809224436s ago: executing program 1 (id=81): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, &(0x7f00000003c0)={0x7, 0x9, 0x37fffd, 0x3, 0x7fffffff, 0xffffffffffbffff7, 0x9, 0x0, 0x1, 0x6, 0x20000007, 0x3, 0xfffffffffffff04f, 0x3, 0x200000080000000, 0xfffffffffffffff8, 0xfffffffffffffffe, 0x200000005, 0x1, 0x100, 0x6, 0x2, 0x5, 0x7, 0x34, 0x800}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x81}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000000500)={r4, 0x0, 0x7, 0x3, 0x9, 0x5, 0x0, 0x2, {0x0, @in={{0x2, 0x4e23, @empty}}, 0x40000, 0x7ff, 0xc8000000, 0x10000, 0x5}}, &(0x7f00000005c0)=0xb0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x24000f02) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0xdf96}, 0x94) bpf$ITER_CREATE(0xb, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r5 = socket(0x40000000015, 0x5, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x4000000, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}, 0x4}, 0x10) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/47, @ANYRES32=r6, @ANYBLOB="0100000002"], 0x40) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r7}, 0x20) syz_open_dev$ptys(0xc, 0x3, 0x0) 5.659842313s ago: executing program 0 (id=82): r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x80000}}}, &(0x7f0000000300)=0x0) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r0, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x30, &(0x7f0000000680)={0x30, 0x1, {0x0, 0x9, 0xc, 0xc, 0x9, 0x8}}}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, &(0x7f0000000a00)=@buf_4k}}, &(0x7f0000000b00)=0x0) nanosleep(&(0x7f0000001a00)={0x1}, 0x0) r9 = getpid() syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r0, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x0, 0x0, r9}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) nanosleep(&(0x7f0000001a40)={0x1}, 0x0) r10 = syz_open_dev$ublk_bdev(&(0x7f0000003000), r5, 0x4002) pwrite64$ublk_bdev(r10, &(0x7f0000800000)='\x00'/4096, 0x1000, 0x0) syz_ublk_process_io(r8, 0x0, 0x1, &(0x7f0000000e00), 0x0) 5.52165483s ago: executing program 2 (id=83): r0 = syz_open_dev$video4linux(&(0x7f0000000040), 0x5, 0x0) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fanotify_mark(0xffffffffffffffff, 0x1, 0x1033, 0xffffffffffffffff, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) fcntl$lock(r1, 0x410, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x109) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x2}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000003e00010324bd7002fadbdf250100000015c808d7fb6f859e5ee606a1c63a3edc28797f2a0c7b9524844601e45d9eceab8765253d2adb194f6dba4e47ecb70d3ac6d164cd3fcadcdc564021f5f5cd07db8dfc733b019e238a7be3d52e5acd789d6e74b228743d7ef48136a9136419b39db6b0cf7949c5c23ba8436da54694ce8caf5883d0f95933b6dafc40730e581fced77d"], 0x14}}, 0xc084) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000050000000900010073797a30000000002c000000030a010100081a0000000000050000000900010073797a30000000000900030073797a300000000054000000060a010400000000000000000500000008000b40000000002c0069942800018008000100667764001c0002800800024000000017080003400000000a08000140000000090900010073797a30000000001400000011000100000000"], 0xc8}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) fremovexattr(r2, &(0x7f0000000000)=@known='system.posix_acl_default\x00') ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0\x00'}) ioctl$UFFDIO_MOVE(r6, 0xc028aa05, &(0x7f0000000240)={&(0x7f000016c000/0x3000)=nil, &(0x7f000008e000/0x3000)=nil, 0x3000}) syz_ublk_setup_io_uring(0x5774, &(0x7f0000000080)={0x0, 0x1a4e, 0x40, 0x0, 0xeb, 0x0, r6}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r0, 0xc0305602, &(0x7f00000002c0)={0x0, 0x8, 0x2007, 0x1}) 4.659872651s ago: executing program 1 (id=84): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 4.392279243s ago: executing program 2 (id=85): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1', 0x1) 3.649343108s ago: executing program 0 (id=86): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='1\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='1\n', 0x2) close(r1) write(0xffffffffffffffff, &(0x7f0000000400)='1\n', 0x2) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='/dev/nullb1\n', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000600)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000740)='loop\n', 0x5) close(0xffffffffffffffff) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) write(r4, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e) close(r4) nanosleep(&(0x7f0000000940)={0x0, 0x1dcd6500}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/nvme0n1\x00', 0x2, 0x0) ioctl(r5, 0xc0101282, &(0x7f0000000a00)="00000000000000000100"/80) 3.639810558s ago: executing program 2 (id=87): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)='nfsd 127.0.0.1 2147483647 localhost\n\x00', 0x24) write(0xffffffffffffffff, &(0x7f0000000c00)='tcp 2049\n\x00', 0x9) r0 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000e00)='1\n\x00', 0x2) close(r0) 3.59350165s ago: executing program 3 (id=88): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, &(0x7f00000003c0)={0x7, 0x9, 0x37fffd, 0x3, 0x7fffffff, 0xffffffffffbffff7, 0x9, 0x0, 0x1, 0x6, 0x20000007, 0x3, 0xfffffffffffff04f, 0x3, 0x200000080000000, 0xfffffffffffffff8, 0xfffffffffffffffe, 0x200000005, 0x1, 0x100, 0x6, 0x2, 0x5, 0x7, 0x34, 0x800}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x81}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000000500)={r4, 0x0, 0x7, 0x3, 0x9, 0x5, 0x0, 0x2, {0x0, @in={{0x2, 0x4e23, @empty}}, 0x40000, 0x7ff, 0xc8000000, 0x10000, 0x5}}, &(0x7f00000005c0)=0xb0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x24000f02) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0xdf96}, 0x94) bpf$ITER_CREATE(0xb, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r5 = socket(0x40000000015, 0x5, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x4000000, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}, 0x4}, 0x10) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r6, @ANYBLOB="0100000002"], 0x40) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x40) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r7}, 0x20) syz_open_dev$ptys(0xc, 0x3, 0x0) 3.311754144s ago: executing program 2 (id=89): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r1 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r1, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={0x0, 0x18}, 0x1, 0x0, 0x0, 0x10}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount$tmpfs(0x0, 0x0, 0x0, 0x80, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) connect$unix(0xffffffffffffffff, 0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f0000000000)='./file1\x00', 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000400)) socket(0x2d, 0x2, 0x0) ioctl$USBDEVFS_RELEASE_PORT(r3, 0x80045519, &(0x7f0000000100)=0x3) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@default_permissions}]}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x1, &(0x7f0000000180), 0x4) r5 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/card0/oss_mixer\x00', 0x2, 0x0) r6 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_SET_VOLTAGE(r6, 0x6f43, 0x0) write$proc_mixer(r5, &(0x7f0000000340)=ANY=[@ANYBLOB='LINE \''], 0x8c) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x4, 0x10000, 0x5, 0x7, 0x800003, 0xfffffffd, {0x400000080001, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x10009, 0x3, 0xfffffffc, 0x6000, 0x0, 0x0, 0x0, 0xd, 0x7}}, {0x0, 0x13}}}, 0xa0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000080), 0x7f03) 2.54286179s ago: executing program 3 (id=90): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x8042, 0x20) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x300) socket$can_j1939(0x1d, 0x2, 0x7) 2.353531449s ago: executing program 0 (id=91): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='1\n', 0x2) close(r0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='/dev/nullb1\n', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r4, &(0x7f0000000740)='loop\n', 0x5) close(r4) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) write(r5, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e) close(r5) nanosleep(&(0x7f0000000940)={0x0, 0x1dcd6500}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/nvme0n1\x00', 0x2, 0x0) ioctl(r6, 0xc0101282, &(0x7f0000000a00)="00000000000000000100"/80) 511.165196ms ago: executing program 3 (id=92): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, &(0x7f00000003c0)={0x7, 0x9, 0x37fffd, 0x3, 0x7fffffff, 0xffffffffffbffff7, 0x9, 0x0, 0x1, 0x6, 0x20000007, 0x3, 0xfffffffffffff04f, 0x3, 0x200000080000000, 0xfffffffffffffff8, 0xfffffffffffffffe, 0x200000005, 0x1, 0x100, 0x6, 0x2, 0x5, 0x7, 0x34, 0x800}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x81}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000000500)={r4, 0x0, 0x7, 0x3, 0x9, 0x5, 0x0, 0x2, {0x0, @in={{0x2, 0x4e23, @empty}}, 0x40000, 0x7ff, 0xc8000000, 0x10000, 0x5}}, &(0x7f00000005c0)=0xb0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x24000f02) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0xdf96}, 0x94) bpf$ITER_CREATE(0xb, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r5 = socket(0x40000000015, 0x5, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x4000000, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}, 0x4}, 0x10) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r6, @ANYBLOB="0100000002"], 0x40) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x40) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r7}, 0x20) syz_open_dev$ptys(0xc, 0x3, 0x0) 420.20502ms ago: executing program 1 (id=93): r0 = syz_open_dev$video4linux(&(0x7f0000000040), 0x5, 0x0) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fanotify_mark(0xffffffffffffffff, 0x1, 0x1033, 0xffffffffffffffff, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) fcntl$lock(r1, 0x410, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x109) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x2}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000003e00010324bd7002fadbdf250100000015c808d7fb6f859e5ee606a1c63a3edc28797f2a0c7b9524844601e45d9eceab8765253d2adb194f6dba4e47ecb70d3ac6d164cd3fcadcdc564021f5f5cd07db8dfc733b019e238a7be3d52e5acd789d6e74b228743d7ef48136a9136419b39db6b0cf7949c5c23ba8436da54694ce8caf5883d0f95933b6dafc40730e581fced77d"], 0x14}}, 0xc084) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000050000000900010073797a30000000002c000000030a010100081a0000000000050000000900010073797a30000000000900030073797a300000000054000000060a010400000000000000000500000008000b40000000002c0069942800018008000100667764001c0002800800024000000017080003400000000a08000140000000090900010073797a30000000001400000011000100"/197], 0xc8}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) fremovexattr(r2, &(0x7f0000000000)=@known='system.posix_acl_default\x00') ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0\x00'}) ioctl$UFFDIO_MOVE(r6, 0xc028aa05, &(0x7f0000000240)={&(0x7f000016c000/0x3000)=nil, &(0x7f000008e000/0x3000)=nil, 0x3000}) syz_ublk_setup_io_uring(0x5774, &(0x7f0000000080)={0x0, 0x1a4e, 0x40, 0x0, 0xeb, 0x0, r6}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r0, 0xc0305602, &(0x7f00000002c0)={0x0, 0x8, 0x2007, 0x1}) 419.26392ms ago: executing program 2 (id=94): socket$inet(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bonding_masters\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='+bond0\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='-bond_slave_0\n', 0xf) write(r1, &(0x7f0000000100)='-bond_slave_1\n', 0xf) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond0/bonding/mode\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='active-backup\n', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/net/bond0/bonding/arp_interval\x00', 0x2, 0x0) write(r3, &(0x7f0000000300)='100\n', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/net/bond0/bonding/arp_ip_target\x00', 0x2, 0x0) write(r4, &(0x7f0000000400)='+192.168.1.1\n', 0xd) close(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000500)={'bond_slave_0\x00', 0x1002}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r6, &(0x7f0000000600)='+bond_slave_0\n', 0xe) 0s ago: executing program 1 (id=95): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000680)={'bond0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bonding_masters\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='+bond0\n', 0x7) close(r1) openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r2, &(0x7f0000000200)='active-backup\n', 0xe) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.152' (ED25519) to the list of known hosts. [ 74.034747][ T5758] cgroup: Unknown subsys name 'net' [ 74.135682][ T5758] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.516347][ T5758] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.435430][ T5781] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.443659][ T5781] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.451506][ T5781] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 77.452589][ T5782] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.461298][ T5781] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 77.467558][ T5782] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.480947][ T5781] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 77.481137][ T5782] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 77.498010][ T5784] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.498800][ T5782] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 77.512615][ T5784] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.521099][ T5784] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.525939][ T5782] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.535957][ T5784] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 77.536420][ T5782] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 77.550317][ T5784] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 77.550994][ T5782] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 77.569363][ T5782] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 77.577197][ T5782] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 77.585275][ T5784] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 77.585275][ T5782] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.600103][ T5782] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 77.600138][ T5784] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 77.614704][ T5781] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 77.997329][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 78.153958][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.161869][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.169346][ T5772] bridge_slave_0: entered allmulticast mode [ 78.176432][ T5772] bridge_slave_0: entered promiscuous mode [ 78.186753][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 78.205043][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 78.226482][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.235266][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.243999][ T5772] bridge_slave_1: entered allmulticast mode [ 78.251509][ T5772] bridge_slave_1: entered promiscuous mode [ 78.337098][ T5770] chnl_net:caif_netlink_parms(): no params data found [ 78.366041][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.378503][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.404088][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.413415][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.420757][ T5773] bridge_slave_0: entered allmulticast mode [ 78.427451][ T5773] bridge_slave_0: entered promiscuous mode [ 78.473912][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.482888][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.490823][ T5773] bridge_slave_1: entered allmulticast mode [ 78.497507][ T5773] bridge_slave_1: entered promiscuous mode [ 78.525203][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.532397][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.540109][ T5771] bridge_slave_0: entered allmulticast mode [ 78.546796][ T5771] bridge_slave_0: entered promiscuous mode [ 78.557017][ T5772] team0: Port device team_slave_0 added [ 78.577589][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.584835][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.592306][ T5771] bridge_slave_1: entered allmulticast mode [ 78.599379][ T5771] bridge_slave_1: entered promiscuous mode [ 78.607468][ T5772] team0: Port device team_slave_1 added [ 78.623031][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.663396][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.670467][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.696953][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.711774][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.748141][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.755384][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.762761][ T5770] bridge_slave_0: entered allmulticast mode [ 78.769732][ T5770] bridge_slave_0: entered promiscuous mode [ 78.786575][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.793661][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.819780][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.845189][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.852876][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.860244][ T5770] bridge_slave_1: entered allmulticast mode [ 78.866932][ T5770] bridge_slave_1: entered promiscuous mode [ 78.875429][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.897865][ T5773] team0: Port device team_slave_0 added [ 78.916783][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.945183][ T5773] team0: Port device team_slave_1 added [ 78.966560][ T5772] hsr_slave_0: entered promiscuous mode [ 78.977132][ T5772] hsr_slave_1: entered promiscuous mode [ 79.028216][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.041942][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.054440][ T5771] team0: Port device team_slave_0 added [ 79.061135][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.068105][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.096547][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.117502][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.124793][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.151181][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.170759][ T5771] team0: Port device team_slave_1 added [ 79.198806][ T5770] team0: Port device team_slave_0 added [ 79.222920][ T5770] team0: Port device team_slave_1 added [ 79.247175][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.254465][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.280717][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.300040][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.307022][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.333046][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.396959][ T5773] hsr_slave_0: entered promiscuous mode [ 79.403576][ T5773] hsr_slave_1: entered promiscuous mode [ 79.410552][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 79.418572][ T5773] Cannot create hsr debugfs directory [ 79.452195][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.459970][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.486406][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.499567][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.506633][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.533671][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.643460][ T5771] hsr_slave_0: entered promiscuous mode [ 79.649982][ T5776] Bluetooth: hci3: command tx timeout [ 79.649996][ T51] Bluetooth: hci2: command tx timeout [ 79.655632][ T5776] Bluetooth: hci0: command tx timeout [ 79.662310][ T5781] Bluetooth: hci1: command tx timeout [ 79.673096][ T5771] hsr_slave_1: entered promiscuous mode [ 79.679517][ T5771] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 79.687079][ T5771] Cannot create hsr debugfs directory [ 79.711263][ T5770] hsr_slave_0: entered promiscuous mode [ 79.717709][ T5770] hsr_slave_1: entered promiscuous mode [ 79.724021][ T5770] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 79.732300][ T5770] Cannot create hsr debugfs directory [ 80.033091][ T5772] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 80.052084][ T5772] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 80.063528][ T5772] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 80.082047][ T5772] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 80.139462][ T5773] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 80.149623][ T5773] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 80.161271][ T5773] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 80.181854][ T5773] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 80.260146][ T5771] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 80.273134][ T5771] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 80.282650][ T5771] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.293913][ T5771] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.413576][ T5770] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.439883][ T5770] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.455208][ T5770] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.484042][ T5770] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 80.541003][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.587373][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.608579][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.616006][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.639616][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.652916][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.660348][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.705834][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.730578][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.750556][ T994] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.757694][ T994] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.767527][ T994] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.774716][ T994] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.840512][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.881949][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.889174][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.905178][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.912322][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.935423][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.036502][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.060398][ T5771] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 81.103864][ T3464] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.111100][ T3464] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.125383][ T3464] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.132619][ T3464] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.236704][ T5770] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 81.417324][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.483092][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.585672][ T5772] veth0_vlan: entered promiscuous mode [ 81.604813][ T5772] veth1_vlan: entered promiscuous mode [ 81.627115][ T5773] veth0_vlan: entered promiscuous mode [ 81.651860][ T5773] veth1_vlan: entered promiscuous mode [ 81.668099][ T5772] veth0_macvtap: entered promiscuous mode [ 81.686590][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.701889][ T5772] veth1_macvtap: entered promiscuous mode [ 81.730055][ T5781] Bluetooth: hci1: command tx timeout [ 81.730164][ T5776] Bluetooth: hci2: command tx timeout [ 81.735487][ T5781] Bluetooth: hci0: command tx timeout [ 81.741189][ T5776] Bluetooth: hci3: command tx timeout [ 81.758392][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.789872][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.800948][ T5772] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.810431][ T5772] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.819756][ T5772] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.828488][ T5772] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.846798][ T5773] veth0_macvtap: entered promiscuous mode [ 81.859952][ T5773] veth1_macvtap: entered promiscuous mode [ 81.870616][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.982649][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.005359][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.018658][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.053464][ T5771] veth0_vlan: entered promiscuous mode [ 82.071563][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.082743][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.095183][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.117231][ T1096] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.153136][ T1096] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.178537][ T5771] veth1_vlan: entered promiscuous mode [ 82.198558][ T5773] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.208233][ T5773] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.218032][ T5773] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.228604][ T5773] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.242997][ T1096] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.260043][ T1096] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.301806][ T5770] veth0_vlan: entered promiscuous mode [ 82.408091][ T5771] veth0_macvtap: entered promiscuous mode [ 82.432219][ T5771] veth1_macvtap: entered promiscuous mode [ 82.471181][ T5770] veth1_vlan: entered promiscuous mode [ 82.499147][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.507022][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.602528][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.618957][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.633236][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.667746][ T5841] PM: suspend entry (s2idle) [ 82.673760][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.689096][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.705236][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.726344][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.755277][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.774816][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.786886][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.799151][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.810974][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.829915][ T5770] veth0_macvtap: entered promiscuous mode [ 82.848249][ T5771] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.866262][ T5771] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.875223][ T5771] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.890412][ T5771] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.907153][ T5770] veth1_macvtap: entered promiscuous mode [ 83.003283][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.017228][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.028094][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.039281][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.049269][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.059935][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.073613][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.098225][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.111478][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.121838][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.132979][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.143217][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.153918][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.165520][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.192698][ T5770] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.202149][ T5770] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.211257][ T5770] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.220239][ T5770] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.234942][ T1096] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.251909][ T1096] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.315976][ T1096] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.338189][ T1096] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.406237][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.419507][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.470331][ T5841] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 83.477290][ T5841] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 83.515509][ T1096] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.526520][ T1096] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.533548][ T5841] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 83.543294][ T5848] tipc: Started in network mode [ 83.552879][ T5848] tipc: Node identity 1001001, cluster identity 4711 [ 83.552933][ T5841] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 83.564166][ T5848] tipc: Node number set to 16781313 [ 83.566189][ T5841] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 83.580811][ T5848] tipc: Enabled bearer , priority 0 [ 83.608467][ T5841] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 83.622798][ T5841] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 83.660759][ T5841] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 83.681889][ T5841] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 83.720452][ T5841] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 83.728034][ T5841] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 83.744966][ T5841] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 83.857853][ T5855] PM: suspend entry (s2idle) [ 83.864055][ T5855] PM: suspend exit [ 84.239132][ T5845] NFSD: attempt to initialize umh client tracking in a container ignored. [ 84.248549][ T5845] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 84.261082][ T5845] NFSD: Unable to initialize client recovery tracking! (-22) [ 84.268663][ T5845] NFSD: starting 90-second grace period (net f00003d4) [ 84.929721][ T5776] Bluetooth: hci0: command 0x0419 tx timeout [ 85.579418][ T5776] Bluetooth: hci1: command 0x0419 tx timeout [ 85.612487][ T5854] NFSD: attempt to initialize umh client tracking in a container ignored. [ 85.621329][ T5854] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 85.630490][ T5854] NFSD: Unable to initialize client recovery tracking! (-22) [ 85.637868][ T5854] NFSD: starting 90-second grace period (net f00003ea) [ 85.649574][ T5776] Bluetooth: hci3: command 0x0419 tx timeout [ 85.731783][ T5776] Bluetooth: hci2: command 0x0419 tx timeout [ 86.099527][ T5838] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 86.304586][ T5838] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 86.315859][ T5838] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 86.325719][ T5838] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 86.335012][ T5838] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.346743][ T5838] usb 1-1: config 0 descriptor?? [ 86.776125][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.783983][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.791370][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.798564][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.806745][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.814012][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.822805][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.830643][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.837813][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.845125][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.852455][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.859702][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.866863][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.874049][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.881246][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.888374][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.895654][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.902883][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.910155][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.919042][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.926212][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.933562][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.940870][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.948019][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.955219][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.962642][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.970452][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.977649][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.984872][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.992090][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 86.999280][ T5838] konepure 0003:1E7D:2DBE.0001: unknown main item tag 0x0 [ 87.011148][ T5776] Bluetooth: hci0: command 0x0419 tx timeout [ 87.022855][ T5838] konepure 0003:1E7D:2DBE.0001: hidraw0: USB HID v0.00 Device [HID 1e7d:2dbe] on usb-dummy_hcd.0-1/input0 [ 87.089852][ T5858] NFSD: attempt to initialize umh client tracking in a container ignored. [ 87.092668][ T1200] cfg80211: failed to load regulatory.db [ 87.098726][ T5858] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 87.120859][ T5841] Freezing user space processes [ 87.142387][ T5858] NFSD: Unable to initialize client recovery tracking! (-22) [ 87.150697][ T5858] NFSD: starting 90-second grace period (net f00003d4) [ 87.224040][ T5841] Freezing user space processes completed (elapsed 0.085 seconds) [ 87.232796][ T5841] OOM killer disabled. [ 87.236894][ T5841] Freezing remaining freezable tasks [ 87.245770][ T5841] Freezing remaining freezable tasks completed (elapsed 0.003 seconds) [ 87.255999][ T5841] printk: Suspending console(s) (use no_console_suspend to debug) [ 87.382339][ T5841] vhci_hcd vhci_hcd.14: suspend vhci_hcd [ 87.431269][ T5841] vhci_hcd vhci_hcd.13: suspend vhci_hcd [ 87.470934][ T5841] vhci_hcd vhci_hcd.12: suspend vhci_hcd [ 87.513211][ T5841] vhci_hcd vhci_hcd.11: suspend vhci_hcd [ 87.551109][ T5841] vhci_hcd vhci_hcd.10: suspend vhci_hcd [ 87.592356][ T5841] vhci_hcd vhci_hcd.9: suspend vhci_hcd [ 87.640343][ T5841] vhci_hcd vhci_hcd.8: suspend vhci_hcd [ 87.651328][ T5776] Bluetooth: hci1: command 0x0419 tx timeout [ 87.681382][ T5841] vhci_hcd vhci_hcd.7: suspend vhci_hcd [ 87.730232][ T5776] Bluetooth: hci3: command 0x0419 tx timeout [ 87.731794][ T5841] vhci_hcd vhci_hcd.6: suspend vhci_hcd [ 87.770486][ T5841] vhci_hcd vhci_hcd.5: suspend vhci_hcd [ 87.809514][ T5776] Bluetooth: hci2: command 0x0419 tx timeout [ 87.811558][ T5841] vhci_hcd vhci_hcd.4: suspend vhci_hcd [ 87.850467][ T5841] vhci_hcd vhci_hcd.3: suspend vhci_hcd [ 87.891857][ T5841] vhci_hcd vhci_hcd.2: suspend vhci_hcd [ 87.931228][ T5841] vhci_hcd vhci_hcd.1: suspend vhci_hcd [ 87.971019][ T5841] vhci_hcd vhci_hcd.0: suspend vhci_hcd [ 88.030508][ T994] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 88.223477][ T5841] PM: suspend debug: Waiting for 0 second(s). [ 88.679365][ T5919] usb 1-1: reset high-speed USB device number 2 using dummy_hcd [ 89.095176][ T5776] Bluetooth: hci0: command 0x0419 tx timeout [ 89.729089][ T5776] Bluetooth: hci1: command 0x0419 tx timeout [ 89.819192][ T5776] Bluetooth: hci3: command 0x0419 tx timeout [ 89.889050][ T5776] Bluetooth: hci2: command 0x0419 tx timeout [ 91.169083][ T5776] Bluetooth: hci0: command 0x0419 tx timeout [ 91.809395][ T5776] Bluetooth: hci1: command 0x0419 tx timeout [ 91.889822][ T5776] Bluetooth: hci3: command 0x0419 tx timeout [ 91.968971][ T5776] Bluetooth: hci2: command 0x0419 tx timeout [ 93.890101][ T5919] usb 1-1: device descriptor read/64, error -110 [ 94.159714][ T5919] usb 1-1: reset high-speed USB device number 2 using dummy_hcd [ 94.309190][ T5919] usb 1-1: device descriptor read/64, error -32 [ 94.579113][ T5919] usb 1-1: reset high-speed USB device number 2 using dummy_hcd [ 94.609821][ T5919] usb 1-1: device descriptor read/8, error -32 [ 94.879109][ T5919] usb 1-1: reset high-speed USB device number 2 using dummy_hcd [ 94.909493][ T5919] usb 1-1: device descriptor read/8, error -32 [ 95.075000][ T5841] OOM killer enabled. [ 95.075574][ T5841] Restarting tasks ... [ 95.077019][ T5760] usb 1-1: USB disconnect, device number 2 [ 95.100547][ T5841] done. [ 95.102977][ T5841] random: crng reseeded on system resumption [ 95.137137][ T5841] PM: suspend exit [ 96.625429][ T5992] Bluetooth: MGMT ver 1.22 [ 96.970487][ T5995] nvmet: adding nsid 1 to subsystem testsubsys [ 97.072843][ T6002] bonding: bond0 is being created... [ 97.075121][ T6002] bonding: bond0 already exists [ 97.079861][ T6002] bond0: option mode: unable to set because the bond device has slaves [ 97.088133][ T5985] null_blk: disk nullb1 created [ 97.264212][ T5994] block device autoloading is deprecated and will be removed. [ 97.279794][ T5814] nvmet: connect request for invalid subsystem testsubsys! [ 97.287413][ T5990] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 97.307295][ T6007] svc: failed to register nfsdv3 RPC service (errno 111). [ 97.312756][ T6007] svc: failed to register nfsaclv3 RPC service (errno 111). [ 97.442752][ T5760] nvmet: connect by host nqn.2014-08.org.nvmexpress:uuid:5ca0844e-8206-4daa-9641-29059576d4c9 for subsystem testsubsys not allowed [ 97.459256][ T5985] nvme nvme0: Connect for subsystem testsubsys is not allowed, hostnqn: nqn.2014-08.org.nvmexpress:uuid:5ca0844e-8206-4daa-9641-29059576d4c9 [ 98.969017][ T5839] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 99.190719][ T6031] bonding: bond0 is being created... [ 99.191851][ T6031] bonding: bond0 already exists [ 99.194464][ T5839] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 99.194952][ T6031] bond0: option mode: unable to set because the bond device has slaves [ 99.195745][ T5839] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.198013][ T5839] usb 3-1: Product: syz [ 99.198655][ T5839] usb 3-1: Manufacturer: syz [ 99.204332][ T5839] usb 3-1: SerialNumber: syz [ 100.189866][ T6020] NFSD: attempt to initialize umh client tracking in a container ignored. [ 100.204342][ T6020] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 100.215169][ T5839] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -71 [ 100.225464][ T6020] NFSD: Unable to initialize client recovery tracking! (-22) [ 100.247581][ T6020] NFSD: starting 90-second grace period (net f0000460) [ 100.361760][ T5839] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -71 [ 100.413987][ T5839] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -71 [ 100.426385][ T5839] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 100.460066][ T5839] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 100.494951][ T5839] lan78xx: probe of 3-1:1.0 failed with error -71 [ 100.535818][ T5839] usb 3-1: USB disconnect, device number 2 [ 100.655050][ T6047] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 100.684610][ T5980] nvmet: creating nvm controller 1 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:5ca0844e-8206-4daa-9641-29059576d4c9. [ 100.696997][ T6047] nvme nvme0: creating 2 I/O queues. [ 100.701823][ T6047] nvme nvme0: new ctrl: "testsubsys" [ 101.180121][ T5980] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 101.381598][ T5980] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.383364][ T5980] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 101.384709][ T5980] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.387584][ T5980] usb 3-1: config 0 descriptor?? [ 101.797952][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.799291][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.801274][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.802477][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.803586][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.804630][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.805652][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.806659][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.807637][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.808785][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.813092][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.814401][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.816100][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.817169][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.818212][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.819515][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.820686][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.821806][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.823075][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.824086][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.825107][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.826115][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.827135][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.828130][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.829431][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.830522][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.831621][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.832735][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.833741][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.834777][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.835818][ T5980] konepure 0003:1E7D:2DBE.0002: unknown main item tag 0x0 [ 101.839409][ T6035] NFSD: attempt to initialize umh client tracking in a container ignored. [ 101.840789][ T6035] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 101.842058][ T6035] NFSD: Unable to initialize client recovery tracking! (-22) [ 101.843189][ T6035] NFSD: starting 90-second grace period (net f00003d4) [ 101.844733][ T5980] konepure 0003:1E7D:2DBE.0002: hidraw0: USB HID v0.00 Device [HID 1e7d:2dbe] on usb-dummy_hcd.2-1/input0 [ 102.010829][ T6058] rtc_cmos 00:00: in use; can't configure [ 102.012921][ T6058] i8042 kbd 00:01: in use; can't configure [ 102.014598][ T6058] i8042 aux 00:02: in use; can't configure [ 102.016340][ T6058] serial 00:03: in use; can't configure [ 102.017920][ T6058] serial 00:04: in use; can't configure [ 102.020909][ T6058] serial 00:05: in use; can't configure [ 102.022989][ T6058] serial 00:06: in use; can't configure [ 102.170368][ T6063] bonding: bond0 is being created... [ 102.172297][ T6063] bonding: bond0 already exists [ 102.175319][ T6063] bond0: option mode: unable to set because the bond device has slaves [ 103.171165][ T6055] NFSD: attempt to initialize umh client tracking in a container ignored. [ 103.172680][ T6055] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 103.173916][ T6055] NFSD: Unable to initialize client recovery tracking! (-22) [ 103.175078][ T6055] NFSD: starting 90-second grace period (net f00003ea) [ 104.408898][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 104.528896][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 104.899021][ T6085] bonding: bond0 is being created... [ 104.904685][ T6085] bonding: bond0 already exists [ 104.924135][ T6085] bond0: option mode: unable to set because the bond device has slaves [ 107.198784][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.258784][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 107.402763][ T5760] usb 3-1: USB disconnect, device number 3 [ 107.764716][ T6112] bonding: bond0 is being created... [ 107.775156][ T6112] bonding: bond0 already exists [ 107.794211][ T6112] bond0: option mode: unable to set because the bond device has slaves [ 109.237139][ T6122] sched: RT throttling activated [ 111.687798][ T6137] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 111.835008][ T5819] nvmet: creating nvm controller 2 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:5ca0844e-8206-4daa-9641-29059576d4c9. [ 111.899894][ T6137] nvme nvme1: creating 2 I/O queues. [ 111.917225][ T6137] nvme nvme1: new ctrl: "testsubsys" [ 112.092491][ T6147] bonding: bond0 is being created... [ 112.098285][ T6147] bonding: bond0 already exists [ 112.148834][ T5814] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 112.379137][ T5814] usb 1-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice= 1.00 [ 112.388351][ T5814] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.437648][ T5814] usb 1-1: Product: syz [ 112.448809][ T5814] usb 1-1: Manufacturer: syz [ 112.453486][ T5814] usb 1-1: SerialNumber: syz [ 113.458350][ T5814] kalmia 1-1:1.0 (unnamed net_device) (uninitialized): Unexpected init result length: 0 [ 113.468795][ T5814] kalmia 1-1:1.0 (unnamed net_device) (uninitialized): Did not send all of init packet. Bytes sent: 0 [ 113.505546][ T5814] kalmia 1-1:1.0 (unnamed net_device) (uninitialized): Unexpected init result length: 0 [ 114.293701][ T5814] kalmia 1-1:1.0 wwan0: register 'kalmia' at usb-dummy_hcd.0-1, Samsung Kalmia LTE USB dongle, 12:7c:a3:38:94:21 [ 114.310564][ T6170] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.675294][ T6182] bonding: bond0 is being created... [ 114.694914][ T5979] usb 1-1: USB disconnect, device number 4 [ 114.704443][ T6182] bonding: bond0 already exists [ 114.714036][ T5979] kalmia 1-1:1.0 wwan0: unregister 'kalmia' usb-dummy_hcd.0-1, Samsung Kalmia LTE USB dongle [ 115.977712][ T6198] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 116.145844][ T6207] binder: 6202:6207 ioctl 80045017 200000000400 returned -22 [ 116.213910][ T6210] overlayfs: failed to resolve './file0': -2 [ 116.922711][ T5818] nvmet: creating nvm controller 3 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:5ca0844e-8206-4daa-9641-29059576d4c9. [ 117.020494][ T6198] nvme nvme2: creating 2 I/O queues. [ 117.076055][ T6198] nvme nvme2: new ctrl: "testsubsys" [ 117.301263][ T6219] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 117.357151][ T6219] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 118.277080][ T6233] Zero length message leads to an empty skb [ 118.727599][ T6240] block device autoloading is deprecated and will be removed. [ 119.306330][ T1200] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 119.585865][ T5819] nvmet: creating nvm controller 4 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:5ca0844e-8206-4daa-9641-29059576d4c9. [ 119.611395][ T6255] nvme nvme3: creating 2 I/O queues. [ 119.743391][ T1200] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 119.750102][ T6255] nvme nvme3: new ctrl: "testsubsys" [ 119.758113][ T1200] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 119.771208][ T1200] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 119.998892][ T1200] usb 2-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 120.187630][ T1200] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 120.476913][ T1200] usb 2-1: Product: syz [ 120.481539][ T1200] usb 2-1: Manufacturer: syz [ 120.551335][ T6271] binder: 6269:6271 ioctl 80045017 200000000400 returned -22 [ 120.621858][ T6273] overlayfs: failed to resolve './file0': -2 [ 120.634476][ T6239] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 120.827441][ T6239] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 120.990851][ T6239] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 121.208004][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 122.574738][ T1200] redrat3 2-1:1.0: Problem fetching firmware ID [ 122.634570][ T6283] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 122.658032][ T1200] redrat3 2-1:1.0: Failed to read timeout from hardware [ 122.765615][ T6290] bonding: bond0 is being created... [ 122.806233][ T5819] nvmet: creating nvm controller 5 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:5ca0844e-8206-4daa-9641-29059576d4c9. [ 122.835229][ T6283] nvme nvme4: creating 2 I/O queues. [ 122.838353][ T6290] bonding: bond0 already exists [ 122.855037][ T6283] nvme nvme4: new ctrl: "testsubsys" [ 122.887991][ T1200] rc_core: IR keymap rc-hauppauge not found [ 122.893964][ T1200] Registered IR keymap rc-empty [ 122.911664][ T6290] bond0: (slave bond_slave_0): Releasing backup interface [ 122.943245][ T1200] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/rc/rc0 [ 123.003388][ T1200] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/rc/rc0/input5 [ 123.035594][ T6295] bond0: (slave bond_slave_1): Releasing backup interface [ 123.084069][ T1200] redrat3 2-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 123.105529][ T1200] redrat3 2-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 123.134234][ T6299] bonding: bond0 is being created... [ 123.138501][ T1200] redrat3 2-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 123.145597][ T6299] bonding: bond0 already exists [ 123.186199][ T1200] redrat3: probe of 2-1:1.0 failed with error -5 [ 123.200421][ T6290] bond0: (slave bond_slave_0): making interface the new active one [ 123.222272][ T1200] usb 2-1: USB disconnect, device number 2 [ 123.229190][ T5141] ================================================================== [ 123.237283][ T5141] BUG: KASAN: slab-use-after-free in string+0x204/0x290 [ 123.244266][ T5141] Read of size 1 at addr ffff8880702b3760 by task udevd/5141 [ 123.251651][ T5141] [ 123.254006][ T5141] CPU: 0 PID: 5141 Comm: udevd Not tainted syzkaller #0 [ 123.260955][ T5141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 123.271133][ T5141] Call Trace: [ 123.274424][ T5141] [ 123.277365][ T5141] dump_stack_lvl+0x18c/0x250 [ 123.282062][ T5141] ? __lock_acquire+0x7d80/0x7d80 [ 123.287103][ T5141] ? show_regs_print_info+0x20/0x20 [ 123.292322][ T5141] ? load_image+0x420/0x420 [ 123.296843][ T5141] ? __virt_addr_valid+0x10c/0x380 [ 123.301983][ T5141] ? __virt_addr_valid+0x10c/0x380 [ 123.307117][ T5141] ? __virt_addr_valid+0x10c/0x380 [ 123.312247][ T5141] print_report+0xa8/0x210 [ 123.316727][ T5141] ? string+0x204/0x290 [ 123.320894][ T5141] kasan_report+0x117/0x150 [ 123.325401][ T5141] ? string+0x204/0x290 [ 123.329563][ T5141] string+0x204/0x290 [ 123.333551][ T5141] vsnprintf+0xf72/0x1ba0 [ 123.337874][ T5141] add_uevent_var+0x1d1/0x460 [ 123.342557][ T5141] ? vfs_read+0x486/0x990 [ 123.346882][ T5141] ? kobject_uevent_env+0x890/0x890 [ 123.352083][ T5141] rc_dev_uevent+0x15f/0x190 [ 123.356680][ T5141] dev_uevent+0x53a/0x7c0 [ 123.361044][ T5141] ? dev_uevent_name+0xa0/0xa0 [ 123.365822][ T5141] uevent_show+0x196/0x300 [ 123.370264][ T5141] dev_attr_show+0x54/0xc0 [ 123.374682][ T5141] sysfs_kf_seq_show+0x34d/0x4c0 [ 123.379642][ T5141] ? device_get_ownership+0xb0/0xb0 [ 123.384837][ T5141] seq_read_iter+0x464/0xc50 [ 123.389422][ T5141] ? common_file_perm+0x198/0x1f0 [ 123.394440][ T5141] vfs_read+0x486/0x990 [ 123.398592][ T5141] ? kernel_read+0x1e0/0x1e0 [ 123.403185][ T5141] ? __x64_sys_newfstat+0x1c4/0x250 [ 123.408377][ T5141] ? do_sys_openat2+0x170/0x1d0 [ 123.413222][ T5141] ? __fdget_pos+0x2ba/0x330 [ 123.417805][ T5141] ksys_read+0x151/0x260 [ 123.422043][ T5141] ? vfs_write+0x9a0/0x9a0 [ 123.426457][ T5141] ? lockdep_hardirqs_on+0x98/0x150 [ 123.431652][ T5141] do_syscall_64+0x55/0xb0 [ 123.436066][ T5141] ? clear_bhb_loop+0x40/0x90 [ 123.440749][ T5141] ? clear_bhb_loop+0x40/0x90 [ 123.445421][ T5141] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 123.451405][ T5141] RIP: 0033:0x7f9eae2a7407 [ 123.455814][ T5141] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 123.475411][ T5141] RSP: 002b:00007ffd48333400 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 123.483829][ T5141] RAX: ffffffffffffffda RBX: 00007f9eae947880 RCX: 00007f9eae2a7407 [ 123.491792][ T5141] RDX: 0000000000001000 RSI: 000055cecc52a550 RDI: 000000000000000c [ 123.499756][ T5141] RBP: 00007f9eae3efff0 R08: 0000000000000000 R09: 0000000000000000 [ 123.507721][ T5141] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 123.515693][ T5141] R13: 00007f9eae3efea0 R14: 0000000000000000 R15: 000055cecc51c7a0 [ 123.523666][ T5141] [ 123.526675][ T5141] [ 123.528994][ T5141] Allocated by task 1200: [ 123.533305][ T5141] kasan_set_track+0x4e/0x70 [ 123.537892][ T5141] __kasan_kmalloc+0x8f/0xa0 [ 123.542476][ T5141] redrat3_dev_probe+0x3f9/0x23d0 [ 123.547492][ T5141] usb_probe_interface+0x6eb/0xcf0 [ 123.552601][ T5141] really_probe+0x247/0xae0 [ 123.557097][ T5141] __driver_probe_device+0x1f5/0x390 [ 123.562398][ T5141] driver_probe_device+0x4f/0x420 [ 123.567412][ T5141] __device_attach_driver+0x2ca/0x510 [ 123.572773][ T5141] bus_for_each_drv+0x252/0x2e0 [ 123.577614][ T5141] __device_attach+0x2c1/0x420 [ 123.582365][ T5141] bus_probe_device+0x180/0x260 [ 123.587208][ T5141] device_add+0x87c/0xc40 [ 123.591612][ T5141] usb_set_configuration+0x1ad0/0x2150 [ 123.597064][ T5141] usb_generic_driver_probe+0x8d/0x150 [ 123.602516][ T5141] usb_probe_device+0x12a/0x260 [ 123.607352][ T5141] really_probe+0x247/0xae0 [ 123.611843][ T5141] __driver_probe_device+0x1f5/0x390 [ 123.617134][ T5141] driver_probe_device+0x4f/0x420 [ 123.622190][ T5141] __device_attach_driver+0x2ca/0x510 [ 123.627550][ T5141] bus_for_each_drv+0x252/0x2e0 [ 123.632391][ T5141] __device_attach+0x2c1/0x420 [ 123.637168][ T5141] bus_probe_device+0x180/0x260 [ 123.642012][ T5141] device_add+0x87c/0xc40 [ 123.646335][ T5141] usb_new_device+0x995/0x1550 [ 123.651091][ T5141] hub_event+0x29d5/0x4a80 [ 123.655497][ T5141] process_scheduled_works+0xa60/0x1600 [ 123.661041][ T5141] worker_thread+0xa5e/0xfe0 [ 123.665623][ T5141] kthread+0x2fa/0x390 [ 123.669680][ T5141] ret_from_fork+0x48/0x80 [ 123.674093][ T5141] ret_from_fork_asm+0x11/0x20 [ 123.678859][ T5141] [ 123.681170][ T5141] Freed by task 1200: [ 123.685142][ T5141] kasan_set_track+0x4e/0x70 [ 123.689720][ T5141] kasan_save_free_info+0x28/0x40 [ 123.694734][ T5141] ____kasan_slab_free+0x126/0x1f0 [ 123.699832][ T5141] slab_free_freelist_hook+0x130/0x1a0 [ 123.705364][ T5141] __kmem_cache_free+0xba/0x1f0 [ 123.710216][ T5141] redrat3_dev_probe+0x1b73/0x23d0 [ 123.715317][ T5141] usb_probe_interface+0x6eb/0xcf0 [ 123.720418][ T5141] really_probe+0x247/0xae0 [ 123.724917][ T5141] __driver_probe_device+0x1f5/0x390 [ 123.730188][ T5141] driver_probe_device+0x4f/0x420 [ 123.735197][ T5141] __device_attach_driver+0x2ca/0x510 [ 123.740556][ T5141] bus_for_each_drv+0x252/0x2e0 [ 123.745396][ T5141] __device_attach+0x2c1/0x420 [ 123.750148][ T5141] bus_probe_device+0x180/0x260 [ 123.754997][ T5141] device_add+0x87c/0xc40 [ 123.759401][ T5141] usb_set_configuration+0x1ad0/0x2150 [ 123.764852][ T5141] usb_generic_driver_probe+0x8d/0x150 [ 123.770301][ T5141] usb_probe_device+0x12a/0x260 [ 123.775135][ T5141] really_probe+0x247/0xae0 [ 123.779625][ T5141] __driver_probe_device+0x1f5/0x390 [ 123.784900][ T5141] driver_probe_device+0x4f/0x420 [ 123.789918][ T5141] __device_attach_driver+0x2ca/0x510 [ 123.795280][ T5141] bus_for_each_drv+0x252/0x2e0 [ 123.800122][ T5141] __device_attach+0x2c1/0x420 [ 123.804869][ T5141] bus_probe_device+0x180/0x260 [ 123.809715][ T5141] device_add+0x87c/0xc40 [ 123.814034][ T5141] usb_new_device+0x995/0x1550 [ 123.818783][ T5141] hub_event+0x29d5/0x4a80 [ 123.823274][ T5141] process_scheduled_works+0xa60/0x1600 [ 123.828811][ T5141] worker_thread+0xa5e/0xfe0 [ 123.833412][ T5141] kthread+0x2fa/0x390 [ 123.837493][ T5141] ret_from_fork+0x48/0x80 [ 123.841909][ T5141] ret_from_fork_asm+0x11/0x20 [ 123.846695][ T5141] [ 123.849012][ T5141] The buggy address belongs to the object at ffff8880702b3000 [ 123.849012][ T5141] which belongs to the cache kmalloc-2k of size 2048 [ 123.863161][ T5141] The buggy address is located 1888 bytes inside of [ 123.863161][ T5141] freed 2048-byte region [ffff8880702b3000, ffff8880702b3800) [ 123.877132][ T5141] [ 123.879463][ T5141] The buggy address belongs to the physical page: [ 123.886006][ T5141] page:ffffea0001c0ac00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x702b0 [ 123.896159][ T5141] head:ffffea0001c0ac00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 123.905081][ T5141] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 123.913058][ T5141] page_type: 0xffffffff() [ 123.917393][ T5141] raw: 00fff00000000840 ffff888017c42000 ffffea0001f55a00 0000000000000002 [ 123.925965][ T5141] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 123.934532][ T5141] page dumped because: kasan: bad access detected [ 123.940960][ T5141] page_owner tracks the page as allocated [ 123.946658][ T5141] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5770, tgid 5770 (syz-executor), ts 80439855464, free_ts 80367689454 [ 123.968043][ T5141] post_alloc_hook+0x1c1/0x200 [ 123.972804][ T5141] get_page_from_freelist+0x2181/0x22a0 [ 123.978346][ T5141] __alloc_pages+0x1f0/0x460 [ 123.982938][ T5141] alloc_slab_page+0x5d/0x180 [ 123.987605][ T5141] new_slab+0x87/0x2d0 [ 123.991662][ T5141] ___slab_alloc+0xc5c/0x12f0 [ 123.996332][ T5141] __kmem_cache_alloc_node+0x11f/0x250 [ 124.001786][ T5141] kmalloc_trace+0x2a/0xe0 [ 124.006200][ T5141] rtnl_newlink+0x10d/0x2170 [ 124.010783][ T5141] rtnetlink_rcv_msg+0x843/0xf90 [ 124.015712][ T5141] netlink_rcv_skb+0x235/0x4c0 [ 124.020482][ T5141] netlink_unicast+0x7b1/0x930 [ 124.025341][ T5141] netlink_sendmsg+0x8d0/0xbf0 [ 124.030097][ T5141] __sys_sendto+0x4a9/0x6b0 [ 124.034693][ T5141] __x64_sys_sendto+0xde/0xf0 [ 124.039403][ T5141] do_syscall_64+0x55/0xb0 [ 124.043827][ T5141] page last free stack trace: [ 124.048504][ T5141] free_unref_page_prepare+0x7d7/0x8f0 [ 124.054016][ T5141] free_unref_page+0x32/0x2e0 [ 124.058687][ T5141] __unfreeze_partials+0x1cf/0x210 [ 124.063799][ T5141] put_cpu_partial+0x17c/0x250 [ 124.068550][ T5141] __slab_free+0x319/0x400 [ 124.072960][ T5141] qlist_free_all+0x75/0xd0 [ 124.077455][ T5141] kasan_quarantine_reduce+0x143/0x160 [ 124.082913][ T5141] __kasan_slab_alloc+0x22/0x80 [ 124.087791][ T5141] slab_post_alloc_hook+0x6a/0x4d0 [ 124.092900][ T5141] kmem_cache_alloc_node+0x1af/0x310 [ 124.098192][ T5141] kmalloc_reserve+0x95/0x240 [ 124.102879][ T5141] __alloc_skb+0x138/0x2c0 [ 124.107287][ T5141] netlink_sendmsg+0x66a/0xbf0 [ 124.112038][ T5141] __sys_sendto+0x4a9/0x6b0 [ 124.116539][ T5141] __x64_sys_sendto+0xde/0xf0 [ 124.121209][ T5141] do_syscall_64+0x55/0xb0 [ 124.125618][ T5141] [ 124.127929][ T5141] Memory state around the buggy address: [ 124.133543][ T5141] ffff8880702b3600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 124.141598][ T5141] ffff8880702b3680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 124.149644][ T5141] >ffff8880702b3700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 124.157689][ T5141] ^ [ 124.164870][ T5141] ffff8880702b3780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 124.172944][ T5141] ffff8880702b3800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 124.180990][ T5141] ================================================================== [ 124.194036][ T6290] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 124.224743][ T5141] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 124.231995][ T5141] CPU: 1 PID: 5141 Comm: udevd Not tainted syzkaller #0 [ 124.238957][ T5141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 124.249024][ T5141] Call Trace: [ 124.252311][ T5141] [ 124.255244][ T5141] dump_stack_lvl+0x18c/0x250 [ 124.259947][ T5141] ? show_regs_print_info+0x20/0x20 [ 124.265171][ T5141] ? load_image+0x420/0x420 [ 124.269703][ T5141] panic+0x2ca/0x720 [ 124.273621][ T5141] ? bpf_jit_dump+0xd0/0xd0 [ 124.278141][ T5141] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 124.284142][ T5141] ? _raw_spin_unlock+0x40/0x40 [ 124.289002][ T5141] ? print_memory_metadata+0x314/0x400 [ 124.294485][ T5141] ? string+0x204/0x290 [ 124.298663][ T5141] check_panic_on_warn+0x84/0xa0 [ 124.303617][ T5141] ? string+0x204/0x290 [ 124.307782][ T5141] end_report+0x6f/0x130 [ 124.312033][ T5141] kasan_report+0x128/0x150 [ 124.316549][ T5141] ? string+0x204/0x290 [ 124.320719][ T5141] string+0x204/0x290 [ 124.324945][ T5141] vsnprintf+0xf72/0x1ba0 [ 124.329495][ T5141] add_uevent_var+0x1d1/0x460 [ 124.334194][ T5141] ? vfs_read+0x486/0x990 [ 124.338543][ T5141] ? kobject_uevent_env+0x890/0x890 [ 124.343761][ T5141] rc_dev_uevent+0x15f/0x190 [ 124.348367][ T5141] dev_uevent+0x53a/0x7c0 [ 124.352720][ T5141] ? dev_uevent_name+0xa0/0xa0 [ 124.357501][ T5141] uevent_show+0x196/0x300 [ 124.361940][ T5141] dev_attr_show+0x54/0xc0 [ 124.366380][ T5141] sysfs_kf_seq_show+0x34d/0x4c0 [ 124.371342][ T5141] ? device_get_ownership+0xb0/0xb0 [ 124.376562][ T5141] seq_read_iter+0x464/0xc50 [ 124.381175][ T5141] ? common_file_perm+0x198/0x1f0 [ 124.386227][ T5141] vfs_read+0x486/0x990 [ 124.390406][ T5141] ? kernel_read+0x1e0/0x1e0 [ 124.395001][ T5141] ? __x64_sys_newfstat+0x1c4/0x250 [ 124.400194][ T5141] ? do_sys_openat2+0x170/0x1d0 [ 124.405039][ T5141] ? __fdget_pos+0x2ba/0x330 [ 124.409625][ T5141] ksys_read+0x151/0x260 [ 124.413897][ T5141] ? vfs_write+0x9a0/0x9a0 [ 124.418315][ T5141] ? lockdep_hardirqs_on+0x98/0x150 [ 124.423501][ T5141] do_syscall_64+0x55/0xb0 [ 124.427916][ T5141] ? clear_bhb_loop+0x40/0x90 [ 124.432592][ T5141] ? clear_bhb_loop+0x40/0x90 [ 124.437262][ T5141] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 124.443146][ T5141] RIP: 0033:0x7f9eae2a7407 [ 124.447551][ T5141] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 124.467320][ T5141] RSP: 002b:00007ffd48333400 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 124.475723][ T5141] RAX: ffffffffffffffda RBX: 00007f9eae947880 RCX: 00007f9eae2a7407 [ 124.483684][ T5141] RDX: 0000000000001000 RSI: 000055cecc52a550 RDI: 000000000000000c [ 124.491646][ T5141] RBP: 00007f9eae3efff0 R08: 0000000000000000 R09: 0000000000000000 [ 124.499607][ T5141] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 124.507564][ T5141] R13: 00007f9eae3efea0 R14: 0000000000000000 R15: 000055cecc51c7a0 [ 124.515531][ T5141] [ 124.518805][ T5141] Kernel Offset: disabled [ 124.523126][ T5141] Rebooting in 86400 seconds..