last executing test programs: 7.191517475s ago: executing program 4 (id=90): r0 = socket$unix(0x1, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x40802, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x10, 0x803, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048810}, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x48, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x8, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_INDEV={0x14, 0x2, 'batadv0\x00'}]}}]}, 0x48}}, 0x0) 6.17244797s ago: executing program 4 (id=94): ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc0009"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) read$char_usb(r0, &(0x7f00000002c0)=""/151, 0x97) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) close(r0) sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) eventfd2(0x8, 0x1) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) 5.413229215s ago: executing program 2 (id=102): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000022c0)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x5, 0xfff1}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0xf7513c36066f8950}, 0x20000010) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r2, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r10, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200000214000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f00000004c0)="f058050000007f8f", 0x300}], 0x2}, 0x5) 5.140063503s ago: executing program 2 (id=103): sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, 0x0, 0x400c4) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) mount$9p_rdma(&(0x7f00000000c0), 0x0, &(0x7f00000001c0), 0x10000, &(0x7f0000000440)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq', 0x3d, 0x9}}]}}) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000500), 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x40305828, &(0x7f0000000180)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_open_dev$loop(0x0, 0xffffffff7ffffffd, 0x160862) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) 4.104021315s ago: executing program 4 (id=106): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f00000007c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @null, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) connect$rose(r0, &(0x7f0000000040)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, 0x1c) connect$rose(r0, &(0x7f0000000240)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @null}, 0x1c) 3.907706367s ago: executing program 3 (id=108): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0x0, 0x3}, [@TCA_NETEM_RATE={0x14, 0x6, {0x7, 0x55c, 0x1, 0x7}}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x5, 0x7, 0x40, 0x1, 0x0, 0xa}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r6, 0x0, 0x0, 0x40) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) writev(r6, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x4) 3.776153372s ago: executing program 3 (id=109): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, 0x0, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x200000, 0xe, 0x7, 0x7, 0x9, 0x40, 0xffffffff, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040098}, 0x4000) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r8, &(0x7f0000000140)="bad330fbc9b5544972e7a5ea0756", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x1a, r7, 0x1, 0xd8, 0x6, @random="98c8ca7122df"}, 0x14) sendto$packet(r8, &(0x7f0000000480)="c1858aec1d0a21756f66b4805f3a", 0xe, 0x40000, &(0x7f0000000240)={0x11, 0xf8, r7, 0x1, 0x5, 0x6, @random="24f51e8e0a5a"}, 0x14) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000940)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r11, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x6, 0x8d, 0x6, 0xd07f, 0xfff, 0x7, 0x10000, 0x5, 0x8, 0x8, 0x7fffffff, 0x5, 0x0, 0x10001, 0xb85, 0xd, 0x6, 0xbac07f81, 0x9, 0x0, 0x4, 0x200, 0xffffffff, 0xffffffff, 0x7, 0x648, 0x80000001, 0x9, 0x81, 0x8000, 0x10000, 0x9, 0x9, 0x1, 0x3, 0x5, 0x6, 0x10000, 0x5, 0x101, 0xb67d, 0x8e, 0x8, 0x6, 0xfffff801, 0x5, 0xfff, 0x6, 0x1, 0x400, 0x7, 0x10001, 0x80, 0x4, 0x2, 0x0, 0x9, 0x40, 0x4, 0x8878, 0x0, 0x8ce, 0x7b, 0x6, 0x100, 0x0, 0x1, 0x400, 0x2, 0x8, 0x2b, 0x7f, 0x5, 0xfc7, 0x0, 0x6, 0x7, 0x1, 0x0, 0x2, 0x3ff, 0x1, 0x8, 0x5, 0x2, 0x1, 0x1, 0x2, 0x2, 0x4, 0x7, 0x10000000, 0x2, 0xc, 0x8, 0x64e, 0x1, 0x4, 0x3, 0x4, 0x7f, 0x3ff, 0x1, 0x4, 0x1, 0x400, 0x9, 0xc4c, 0x8000, 0x12d170f1, 0x8, 0x7f, 0x2, 0x1, 0xa27a, 0x764, 0x0, 0xc, 0x2, 0x2, 0x7, 0x5, 0x1000, 0x0, 0x0, 0x3, 0xcc4a, 0x4, 0x40, 0x6, 0x9, 0xc, 0x3, 0x3, 0x5, 0x5, 0x6, 0xbf, 0xf, 0x312, 0x4, 0x6, 0x800, 0x9, 0x8f7, 0x7, 0xfffffffe, 0x1ff, 0xfff, 0x9, 0x1, 0x4, 0xf, 0x6b5, 0x0, 0x40, 0x7, 0xb, 0x7, 0xc4, 0x3, 0x5, 0x3, 0x6, 0x5, 0x100, 0x1d6, 0x3, 0x7f, 0x6d5, 0xb9de, 0x0, 0x7fffffff, 0x7, 0x8, 0x9, 0xc54, 0x8001, 0x4, 0x7fffffff, 0x8, 0x81, 0x1, 0x8, 0x6, 0x8, 0x5, 0xf3, 0x9, 0x81, 0x5, 0x10000, 0xfff, 0x64, 0x5, 0xf1f8, 0x0, 0xe, 0xfffff001, 0x8, 0x8001, 0x2b0000, 0x7f, 0x5, 0x6, 0xffffffff, 0xc7, 0x7ff00000, 0x9, 0x200, 0xb9c, 0x2, 0x4, 0x800, 0x7, 0x7f, 0x8, 0x20000, 0x7, 0xac6, 0x9, 0x9, 0xfffffce9, 0x1, 0x2, 0x80, 0x38, 0x16e1d229, 0x8, 0x9, 0x4, 0x6, 0x80000000, 0x4, 0x5, 0x3, 0xb3e1, 0x0, 0x100, 0x4, 0x7, 0x1, 0x8, 0x7fffffff, 0x2, 0x7fffffff, 0xe3, 0x7, 0x5, 0x9, 0x3, 0x2, 0x7ff, 0x8, 0x3, 0x30000000]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg(r0, &(0x7f00000023c0)=[{{&(0x7f0000000040)=@ll={0x11, 0x17, r12, 0x1, 0x4}, 0x80, 0x0}}], 0x1, 0x40000) 3.395041769s ago: executing program 3 (id=111): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 3.355520132s ago: executing program 1 (id=112): bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x0, 0x0, &(0x7f00000003c0), 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80202, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x20200, 0x0) r1 = memfd_create(&(0x7f0000000b00)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x01\x83y\xf3\xb2\xe6b$\a\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\b\x00\x00\x00LR\xa1\x00\x00\x17\x1f$^\xe1\x00\x04\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xae>/\x05\x00\xce\xd5O\xcc\b\x9e\x19\x19#\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\xb7\xbe`\'\xcb\xb6\xaf\xdc\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$h\x0ew\x00&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\xd0\xe1{\x84\xb5\x82q\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x01\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xff\x06\xe7j\x9fTJ;T\xf3\xfa\xef{h\xb0\xc0:\x8f|\x8f\x06\xf8T\x826`M\x11\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x00\x00\x00\x00\x00\x00\x00\x0f\x81\xf3\x05\xa3{\x96\xf9\xba\x9em\xe9\"\x03\x933P\xbb\xd6\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10\x00\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\"\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x131\x9c\t\xa7\x80\x1b:\xbb\x04\xd7\xd1\x06\xa0\xe9\xbah\xb6\xb2\xea/{Q\xca\x14\x13\x9ajWt\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DY\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~\xc1\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9d\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96cu\x97\xe7\xc7a\tm\xe8F\xc7j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xdfx\x1cPl\t#\xc1\x8e\xddW\x00\x00\x00\x8fw\xa9A\xf7m\xeec\xb6\\\xa4T\xeej\xe2\xba\xb2V\xacc\xc6|\xae]\xdb\x10\xb3\x80z\xd5\n\xa3u\xfb\b\x03\xe5\xca;\xe5uH<\x9a\x12\x84(\x9f\xd2\xe1k\x955;J\xa4\x81Lm\x90\x1a\xfdI}\xb0\xa1\xfa9\x17\xd1\xa2\xc7\xca\x98\xaeS\x92Ew`\xd2\x02\xda\xc9\xd4\xea\x02\x1d\xd3\xd5\x81\xdb\xd9~\xd6-:\xee\xe8\t\xf7\xe6\xf1\x88\x86\xb0\x04\x9ep\xb1\x93\x16\xf9\xdb\x15\x8a\xa3h<\xaf\xa0\xb5\xb0\x05ir\xff\xff\xff\xff\x00\x00\x00\x00\x83\x91\xad\x11\xf4\xbcz\x9b\x8bp]o\au\x175I\x1d\xe2\x97\xb6\x06\xdc\x14\x9b>\xd7F\xdb?\xc7%0n/\xf5S\xb5\xe8\xa5\xd1\xddN\xf9ir\xd1r\xf4L\t3\xadDz\\\xf4`\x13\xf7)\x91w\a\xcc+E\xdd\xe9\xdbb\x9c\xff\x98\x03\xb7\x0e=\xba\xa3um\xde\xff$|\xb7\x86j+\x00\x00\x00\x00\x00\x00\x00Z\xef\xd6\xf4Zs\xfc\ro\x03\xabB\x18\xdc\a\xe3\r\x00\x00\x00\x00\x00\x00', 0x6) lseek(r1, 0xa3c, 0x1) r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x1501) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x41, &(0x7f00000004c0)={0x0, 0x3, 0x14, 0x10}, 0x8, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0}) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r3 = socket(0x10, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2010}, 0x8000) connect$inet6(r4, &(0x7f0000000340)={0xa, 0x5, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000480)=@gcm_256={{0x303}, "000200", "e123c5876ff425b1ebe250a8486be34705f4f827ae60ecb65e528248d5552bff", "7e25837b", "15d0db2c77179e1a"}, 0x38) write$binfmt_script(r4, &(0x7f0000000500)={'#! ', './file0'}, 0xb) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd87}, &(0x7f0000000240)=0x40) writev(r4, &(0x7f0000000100)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1) close_range(r3, r4, 0x0) socket$phonet(0x23, 0x2, 0x1) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r5, 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 3.3491823s ago: executing program 0 (id=113): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0xcb, 0x0, 0x0) close(r1) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) ioctl$PPPIOCSMAXCID(r4, 0x40047451, 0x0) r5 = syz_genetlink_get_family_id$tipc(0x0, r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000003c0)={'syzkaller0\x00', @multicast}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x74fb01, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0x1, 0xc1, 0xe23, 0x3, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x60000) sendmsg$nl_route_sched(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x7fffc, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xfff2, 0xb}, {0x6, 0x5}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x38, 0x2, {{0x0, 0x1, 0x406, 0x4, 0x7fffffff, 0xe}, [@TCA_NETEM_LOSS={0x1c, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18, 0x1, {0xe1f0, 0x9, 0xc1c5, 0xfffffffb}}]}]}}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4004060}, 0x4008000) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000000300)={'syzkaller0\x00', @random="2b0100004ec6"}) 3.224878987s ago: executing program 3 (id=114): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={0x0, 0x44}}, 0x0) 3.224073607s ago: executing program 4 (id=115): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f00000007c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @null, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) connect$rose(r0, &(0x7f0000000040)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, 0x1c) connect$rose(r0, &(0x7f0000000240)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @null}, 0x1c) 3.18888828s ago: executing program 3 (id=116): ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc0009"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) read$char_usb(r0, &(0x7f00000002c0)=""/151, 0x97) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) close(r0) sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) eventfd2(0x8, 0x1) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) 3.13674106s ago: executing program 0 (id=117): r0 = socket$unix(0x1, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x40802, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x10, 0x803, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048810}, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x34, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x8, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) 3.051878864s ago: executing program 1 (id=118): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) 2.932476021s ago: executing program 0 (id=119): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x3, 0xd}, {}, {0x3, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x40004) 2.897797044s ago: executing program 1 (id=120): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x4000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x6f67}, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$inet(0xffffffffffffffff, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x0, 0x0}) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) epoll_create1(0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) 2.114129035s ago: executing program 0 (id=121): socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/uts\x00') r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xffff, @loopback}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x4000) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000015c0), 0x2300, 0x0) ioctl$PPPIOCATTCHAN(r2, 0x40047438, &(0x7f0000000040)=0x1) bpf$MAP_CREATE(0x0, 0x0, 0x48) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000000)=0x3) 2.016584306s ago: executing program 4 (id=122): writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)="8724866f", 0x4}], 0x1) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64\x00'}, 0x58) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x8, 0x5, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x44, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) 2.013402745s ago: executing program 2 (id=123): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0x5, 0x9}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xb, 0xfff3}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x5, 0x4c1}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x3, 0xd73, 0xffffffffffffffff, 0x80, 0x401}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4) 703.574955ms ago: executing program 0 (id=124): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, 0x0, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_LOOPBACK(r3, 0x65, 0x3, 0x0, &(0x7f0000000040)) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000240)={0x50, 0xffffffffffffffda, 0x0, {0x7, 0x2d, 0x7fffffff, 0x1008004, 0x71a7, 0xfffb, 0x3800, 0x1d, 0x0, 0x0, 0x4, 0xfc21}}, 0x50) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x4004041}, 0x20000000) r4 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r4, &(0x7f0000002940)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000800}], 0x492492492492515, 0x4054) recvmsg(r4, &(0x7f0000001580)={0x0, 0x0, 0x0}, 0x20f2) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuseblk(&(0x7f0000002440), &(0x7f0000000040)='./file0\x00', &(0x7f00000003c0), 0x200840d, 0x0) 659.878886ms ago: executing program 1 (id=125): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x7fff}}]}, 0x38}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x40004) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x3fff, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x1}, {0xffff, 0xffff}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0xdc}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r4) 591.677923ms ago: executing program 2 (id=126): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) 532.849763ms ago: executing program 4 (id=127): r0 = syz_init_net_socket$ax25(0x3, 0x5, 0xca) bind$ax25(r0, &(0x7f0000000280)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @bcast, @null]}, 0x48) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000000)={0x0, 0xf32f, 0xfe000000}, &(0x7f00000000c0)=0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1e000000000000002200000009", @ANYRES16=r0, @ANYRES32=r0, @ANYRESHEX=r0], 0x33) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="0008000000000000400034801400350076657468315f766c616e0000000000001400350076657468305f746f5f7465616d00000014003500776c616e3000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x20004010) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'tunl0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f0000000100)={'wg1\x00'}) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000840)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB], 0x14}, 0x1, 0x0, 0x0, 0x6400c095}, 0x8010) socket$inet_udp(0x2, 0x2, 0x0) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, 0x0, 0x4008080) r8 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r8, 0x890b, &(0x7f00000007c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @null, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) connect$rose(r8, &(0x7f0000000040)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, 0x1c) connect$rose(r8, &(0x7f0000000240)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @null}, 0x1c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001100)={r2, 0x0, &(0x7f00000003c0)=""/61}, 0x20) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000100)={0x6, 0x810, 0x208, 0xe, 0x2, 0x3, 0x8, 0x9, r1}, 0x20) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) connect$ax25(r0, &(0x7f0000000180)={{0x3, @bcast, 0x5}, [@bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) syz_emit_ethernet(0x80, &(0x7f0000000580)=ANY=[], 0x0) 355.905398ms ago: executing program 2 (id=128): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x1070bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x20048884) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r5, 0x0, 0x0) 327.440733ms ago: executing program 1 (id=129): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/69, 0x328000, 0x800, 0x2, 0x3}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, 0x0, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00'}) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000180)=0x100000, 0x4) bind$xdp(r1, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000140)={0x0, 0x1004000, 0x800, 0x3, 0x3}, 0x1c) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, 0x0, &(0x7f00000000c0)) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000001a40)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000000)="2e000300010000", 0x7) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="81010000", @ANYRES16=r4, @ANYBLOB="20002dbd7000ffdbdf250b000000080002000000000008000200080000000500050006000000050005000600000034000180060005004e2200000600010002000000060005004e20000008000300ac1414aa060005004e210000060005004e2400000500050002000000"], 0x70}, 0x1, 0x0, 0x0, 0x4800}, 0x4004) getsockopt$inet6_int(r3, 0x29, 0x1, 0x0, &(0x7f00000001c0)) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f00000001c0)={0x28, 0x1d, 0xffeffffb, 0xffffffff}, 0x10) write(r6, &(0x7f0000000040)="240000001e005f0214f6fffffffffff8070000001f00000000000000080009000d000000", 0x24) 212.51792ms ago: executing program 2 (id=130): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40048a0}, 0x4880) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r5, &(0x7f0000000480)="422239d0fa5ce94efd1900ea17564aeb3e3167be3baf8fc27ef04b148aadec23ad381459133ec0", 0x27, 0x1840, &(0x7f00000000c0)={0x11, 0x88a8, r4, 0x1, 0xd8, 0x6, @multicast}, 0x14) 103.59277ms ago: executing program 0 (id=131): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x3, 0xd}, {}, {0x3, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x40004) 88.784387ms ago: executing program 3 (id=132): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0x0, 0x3}, [@TCA_NETEM_RATE={0x14, 0x6, {0x7, 0x55c, 0x1, 0x7}}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x5, 0x7, 0x40, 0x1, 0x0, 0xa}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r6, 0x0, 0x0, 0x40) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x4) 0s ago: executing program 1 (id=133): sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, 0x0, 0x400c4) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000140)='.\x00', 0x0, 0x10000, &(0x7f0000000440)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq', 0x3d, 0x9}}]}}) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000500), 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x40305828, &(0x7f0000000180)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_open_dev$loop(0x0, 0xffffffff7ffffffd, 0x160862) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.86' (ED25519) to the list of known hosts. [ 49.203019][ T4171] cgroup: Unknown subsys name 'net' [ 49.362661][ T4171] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 50.594552][ T4171] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 52.389900][ T4198] chnl_net:caif_netlink_parms(): no params data found [ 52.422457][ T4191] chnl_net:caif_netlink_parms(): no params data found [ 52.440254][ T4186] chnl_net:caif_netlink_parms(): no params data found [ 52.464533][ T4185] chnl_net:caif_netlink_parms(): no params data found [ 52.517181][ T4184] chnl_net:caif_netlink_parms(): no params data found [ 52.582931][ T4198] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.590213][ T4198] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.598990][ T4198] device bridge_slave_0 entered promiscuous mode [ 52.628295][ T4198] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.635369][ T4198] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.643527][ T4198] device bridge_slave_1 entered promiscuous mode [ 52.684584][ T4185] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.691777][ T4185] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.700005][ T4185] device bridge_slave_0 entered promiscuous mode [ 52.708457][ T4191] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.715521][ T4191] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.723550][ T4191] device bridge_slave_0 entered promiscuous mode [ 52.735893][ T4186] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.743117][ T4186] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.751346][ T4186] device bridge_slave_0 entered promiscuous mode [ 52.764888][ T4185] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.772818][ T4185] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.781152][ T4185] device bridge_slave_1 entered promiscuous mode [ 52.788356][ T4191] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.795408][ T4191] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.803240][ T4191] device bridge_slave_1 entered promiscuous mode [ 52.814608][ T4186] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.821813][ T4186] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.830140][ T4186] device bridge_slave_1 entered promiscuous mode [ 52.844708][ T4198] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 52.862810][ T4198] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 52.904639][ T4186] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 52.921600][ T4184] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.928799][ T4184] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.936390][ T4184] device bridge_slave_0 entered promiscuous mode [ 52.946043][ T4191] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 52.957109][ T4186] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 52.967929][ T4191] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 52.978583][ T4185] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 52.994577][ T4184] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.002148][ T4184] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.010480][ T4184] device bridge_slave_1 entered promiscuous mode [ 53.028654][ T4185] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 53.039975][ T4198] team0: Port device team_slave_0 added [ 53.070967][ T4191] team0: Port device team_slave_0 added [ 53.078298][ T4198] team0: Port device team_slave_1 added [ 53.099259][ T4186] team0: Port device team_slave_0 added [ 53.108435][ T4184] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 53.119005][ T4191] team0: Port device team_slave_1 added [ 53.133299][ T4185] team0: Port device team_slave_0 added [ 53.146039][ T4186] team0: Port device team_slave_1 added [ 53.153071][ T4184] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 53.182514][ T4198] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 53.189823][ T4198] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.216293][ T4198] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 53.229244][ T4185] team0: Port device team_slave_1 added [ 53.235357][ T4198] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 53.242333][ T4198] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.268484][ T4198] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 53.293562][ T4184] team0: Port device team_slave_0 added [ 53.301783][ T4184] team0: Port device team_slave_1 added [ 53.323789][ T4191] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 53.330850][ T4191] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.357743][ T4191] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 53.376019][ T4191] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 53.383409][ T4191] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.409377][ T4191] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 53.434745][ T4186] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 53.441793][ T4186] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.468363][ T4186] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 53.495023][ T4184] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 53.502099][ T4184] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.528420][ T4184] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 53.540429][ T4185] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 53.547442][ T4185] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.574117][ T4185] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 53.586686][ T4186] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 53.593715][ T4186] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.619810][ T4186] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 53.632103][ T4184] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 53.639522][ T4184] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.665647][ T4184] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 53.684512][ T4185] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 53.691481][ T4185] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.717425][ T4185] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 53.764752][ T4198] device hsr_slave_0 entered promiscuous mode [ 53.772258][ T4198] device hsr_slave_1 entered promiscuous mode [ 53.782793][ T4191] device hsr_slave_0 entered promiscuous mode [ 53.789933][ T4191] device hsr_slave_1 entered promiscuous mode [ 53.796485][ T4191] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 53.804436][ T4191] Cannot create hsr debugfs directory [ 53.863647][ T4185] device hsr_slave_0 entered promiscuous mode [ 53.870856][ T4185] device hsr_slave_1 entered promiscuous mode [ 53.877416][ T4185] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 53.884957][ T4185] Cannot create hsr debugfs directory [ 53.894030][ T4186] device hsr_slave_0 entered promiscuous mode [ 53.901166][ T4186] device hsr_slave_1 entered promiscuous mode [ 53.908135][ T4186] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 53.915683][ T4186] Cannot create hsr debugfs directory [ 53.931494][ T4184] device hsr_slave_0 entered promiscuous mode [ 53.938697][ T4184] device hsr_slave_1 entered promiscuous mode [ 53.945213][ T4184] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 53.953178][ T4184] Cannot create hsr debugfs directory [ 54.057410][ T4192] Bluetooth: hci0: command 0x0409 tx timeout [ 54.057410][ T4173] Bluetooth: hci2: command 0x0409 tx timeout [ 54.057942][ T4173] Bluetooth: hci1: command 0x0409 tx timeout [ 54.136927][ T4192] Bluetooth: hci4: command 0x0409 tx timeout [ 54.152190][ T4173] Bluetooth: hci3: command 0x0409 tx timeout [ 54.267953][ T4191] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 54.281226][ T4191] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 54.290896][ T4191] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 54.301441][ T4191] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 54.336993][ T4198] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 54.346317][ T4198] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 54.355442][ T4198] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 54.367743][ T4198] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 54.440527][ T4186] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 54.461006][ T4186] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 54.470193][ T4186] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 54.493990][ T4186] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 54.525303][ T4184] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 54.548503][ T4191] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.555710][ T4184] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 54.565950][ T4184] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 54.588500][ T4184] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 54.613284][ T4191] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.624672][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 54.634850][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.651878][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 54.661749][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.671743][ T151] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.679096][ T151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.722657][ T4198] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.730845][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 54.741421][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 54.750630][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 54.759664][ T151] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.766788][ T151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.777753][ T4185] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 54.792105][ T4185] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 54.801816][ T4185] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 54.819361][ T4198] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.832159][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 54.841944][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 54.851127][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.860440][ T4185] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 54.888553][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 54.897510][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.909591][ T151] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.916791][ T151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.948688][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 54.957433][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 54.966378][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 54.978020][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 54.986481][ T151] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.993773][ T151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.001978][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 55.037330][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 55.046423][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 55.057662][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 55.066377][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 55.075798][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 55.084793][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 55.094076][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 55.102688][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 55.112049][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 55.121114][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 55.130128][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 55.139440][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 55.148352][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 55.158192][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 55.166130][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 55.183961][ T4186] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.204397][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 55.213514][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 55.222195][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 55.231233][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 55.240261][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.248664][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.259636][ T4191] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 55.269313][ T4198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 55.289128][ T4186] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.313129][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 55.329507][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 55.368017][ T1388] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.375136][ T1388] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.410996][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 55.428286][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 55.440599][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 55.449435][ T1388] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.456598][ T1388] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.470013][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 55.482012][ T4184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.518156][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 55.532987][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 55.543586][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 55.554684][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 55.564491][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 55.574516][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 55.590244][ T4185] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.608902][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.617985][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.628935][ T4184] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.643228][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 55.652739][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 55.669614][ T4185] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.684814][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.694018][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.701963][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 55.709741][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 55.717921][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 55.727719][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 55.736144][ T155] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.743250][ T155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.751850][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 55.761517][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 55.770245][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 55.782500][ T4186] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 55.799658][ T4191] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.812102][ T4198] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.829457][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 55.838373][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 55.847481][ T1388] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.854636][ T1388] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.862677][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 55.875014][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 55.883694][ T1388] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.890801][ T1388] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.898763][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 55.906279][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 55.914082][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 55.922905][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 55.982974][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 55.999603][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.013902][ T151] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.021135][ T151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.029548][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.038435][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.047560][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 56.056447][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.066304][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.075031][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 56.085248][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.093869][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 56.103566][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.112735][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 56.122119][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 56.130910][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.137135][ T4192] Bluetooth: hci0: command 0x041b tx timeout [ 56.138335][ T4233] Bluetooth: hci1: command 0x041b tx timeout [ 56.146223][ T4192] Bluetooth: hci2: command 0x041b tx timeout [ 56.151154][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.175217][ T4184] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 56.185808][ T4184] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 56.217543][ T4231] Bluetooth: hci3: command 0x041b tx timeout [ 56.223761][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 56.232762][ T4231] Bluetooth: hci4: command 0x041b tx timeout [ 56.240614][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.250944][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 56.260680][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 56.271302][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 56.280128][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 56.289172][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 56.298739][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 56.307216][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 56.316346][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 56.325197][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 56.334756][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 56.343824][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 56.352243][ T4185] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 56.389460][ T4198] device veth0_vlan entered promiscuous mode [ 56.396832][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 56.405167][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 56.443377][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 56.454912][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 56.463772][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 56.472614][ T1388] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 56.485391][ T4186] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.517865][ T4198] device veth1_vlan entered promiscuous mode [ 56.531708][ T4191] device veth0_vlan entered promiscuous mode [ 56.562177][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 56.577455][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 56.597096][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 56.608051][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 56.616020][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 56.642641][ T4191] device veth1_vlan entered promiscuous mode [ 56.677636][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 56.686412][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 56.698315][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 56.705786][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 56.720823][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 56.729745][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 56.742949][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 56.751902][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 56.764477][ T4184] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.778422][ T4185] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.790483][ T4186] device veth0_vlan entered promiscuous mode [ 56.807927][ T4198] device veth0_macvtap entered promiscuous mode [ 56.826441][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 56.835780][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 56.844664][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 56.854334][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 56.864904][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 56.873732][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 56.881993][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 56.892261][ T4191] device veth0_macvtap entered promiscuous mode [ 56.902562][ T4198] device veth1_macvtap entered promiscuous mode [ 56.918406][ T4186] device veth1_vlan entered promiscuous mode [ 56.937305][ T4191] device veth1_macvtap entered promiscuous mode [ 56.958690][ T4198] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 56.987772][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 56.996338][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 57.005188][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 57.014046][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 57.022596][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 57.030728][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 57.039904][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 57.049428][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 57.058199][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 57.079256][ T4198] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.094986][ T4198] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.112229][ T4198] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.124314][ T4198] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.137708][ T4198] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.152310][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 57.160998][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 57.172315][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 57.182146][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 57.191116][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 57.199234][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 57.210350][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 57.222805][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.234400][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.241907][ T4185] device veth0_vlan entered promiscuous mode [ 57.258307][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 57.268511][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 57.280099][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 57.291177][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.302266][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.326914][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 57.335564][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 57.344480][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 57.353082][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 57.368001][ T4191] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.376933][ T4191] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.385622][ T4191] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.395703][ T4191] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.406457][ T4186] device veth0_macvtap entered promiscuous mode [ 57.435489][ T4185] device veth1_vlan entered promiscuous mode [ 57.451391][ T4186] device veth1_macvtap entered promiscuous mode [ 57.459644][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 57.469201][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 57.477518][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 57.485515][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 57.494307][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 57.539485][ T4184] device veth0_vlan entered promiscuous mode [ 57.557956][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 57.566082][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 57.575434][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 57.594646][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 57.602652][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 57.662159][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 57.678829][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.689215][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 57.699674][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.710612][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.718229][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 57.726907][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 57.735357][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 57.745040][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 57.757396][ T4185] device veth0_macvtap entered promiscuous mode [ 57.792425][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 57.803308][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.814250][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 57.825612][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.839381][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.848200][ T4184] device veth1_vlan entered promiscuous mode [ 57.859203][ T4185] device veth1_macvtap entered promiscuous mode [ 57.872492][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 57.881122][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 57.889554][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 57.900215][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 57.912434][ T4186] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.919924][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.926966][ T4186] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.929485][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.938554][ T4186] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.956115][ T4186] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.985871][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 57.988114][ T151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.002069][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.008907][ T151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.014523][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.031957][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.041930][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.052386][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.063799][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 58.075293][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 58.084775][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 58.093484][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 58.102630][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 58.151776][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 58.163873][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 58.181651][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 58.192796][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.208394][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 58.219476][ T4232] Bluetooth: hci1: command 0x040f tx timeout [ 58.222095][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.225565][ T4232] Bluetooth: hci2: command 0x040f tx timeout [ 58.239846][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 58.241636][ T4232] Bluetooth: hci0: command 0x040f tx timeout [ 58.257314][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.274273][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 58.290947][ T4184] device veth0_macvtap entered promiscuous mode [ 58.301074][ T4231] Bluetooth: hci4: command 0x040f tx timeout [ 58.307937][ T4184] device veth1_macvtap entered promiscuous mode [ 58.313519][ T4231] Bluetooth: hci3: command 0x040f tx timeout [ 58.320628][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 58.329054][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 58.338981][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 58.347712][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 58.361159][ T4185] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.371946][ T4185] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.383032][ T4185] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.392017][ T4185] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.417203][ T4252] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.424670][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.435747][ T4252] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.437898][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.455506][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.467621][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.477516][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.487995][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.498278][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.508855][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.520049][ T4184] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 58.535050][ T151] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.552962][ T151] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.567070][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 58.575237][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 58.586191][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 58.597366][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 58.608140][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 58.619512][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.630811][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 58.641572][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.652244][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 58.662991][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.673136][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 58.683886][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.695665][ T4184] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 58.735840][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 58.749493][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 58.764333][ T4184] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.779989][ T4184] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.797104][ T4184] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.805824][ T4184] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.917829][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.927402][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.969636][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 59.010430][ T4270] Zero length message leads to an empty skb [ 59.026757][ T151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.035229][ T151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.060015][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 59.077074][ T4252] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.084923][ T4252] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.174782][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 59.240692][ T151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.272373][ T4252] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.282001][ T1388] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.297557][ T4252] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.301576][ T151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.305492][ T1388] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.332835][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 59.343033][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 59.377080][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 59.438876][ T4281] device syzkaller0 entered promiscuous mode [ 59.537252][ T4286] device syzkaller0 entered promiscuous mode [ 59.709883][ T4291] device syzkaller0 entered promiscuous mode [ 59.746871][ T7] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 59.986677][ T7] usb 1-1: Using ep0 maxpacket: 32 [ 60.107015][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 60.123780][ T7] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 60.297759][ T7] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 60.307395][ T7] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 60.315580][ T7] usb 1-1: Product: syz [ 60.320588][ T7] usb 1-1: Manufacturer: syz [ 60.325202][ T7] usb 1-1: SerialNumber: syz [ 60.343989][ T7] usb 1-1: config 0 descriptor?? [ 60.353801][ T13] Bluetooth: hci0: command 0x0419 tx timeout [ 60.360328][ T13] Bluetooth: hci2: command 0x0419 tx timeout [ 60.368472][ T13] Bluetooth: hci1: command 0x0419 tx timeout [ 60.378451][ T4231] Bluetooth: hci3: command 0x0419 tx timeout [ 60.380512][ T13] Bluetooth: hci4: command 0x0419 tx timeout [ 60.624167][ T13] usb 1-1: USB disconnect, device number 2 [ 61.166579][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #280!!! [ 61.304176][ T4316] tipc: Started in network mode [ 61.325654][ T4316] tipc: Node identity b2e030739cb9, cluster identity 4711 [ 61.372624][ T4316] tipc: Enabled bearer , priority 0 [ 61.380909][ T4316] device syzkaller0 entered promiscuous mode [ 61.404344][ T4316] tipc: Resetting bearer [ 61.719835][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #40!!! [ 61.746576][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #02!!! [ 61.755561][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #02!!! [ 61.764765][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #02!!! [ 61.773774][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #02!!! [ 61.782747][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 61.791755][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 61.800755][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 61.809700][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 62.040284][ T4313] tipc: Resetting bearer [ 62.072985][ T4313] tipc: Disabling bearer [ 62.217880][ T4335] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.225773][ T4335] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.499539][ T4351] device syzkaller0 entered promiscuous mode [ 62.514767][ T4353] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 62.686651][ T7] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 62.721367][ T4364] device syzkaller0 entered promiscuous mode [ 62.926628][ T7] usb 3-1: Using ep0 maxpacket: 32 [ 63.046953][ T7] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 63.066639][ T7] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 63.246857][ T7] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 63.274248][ T7] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 63.300083][ T7] usb 3-1: Product: syz [ 63.320847][ T7] usb 3-1: Manufacturer: syz [ 63.333944][ T7] usb 3-1: SerialNumber: syz [ 63.340059][ T4374] device syzkaller0 entered promiscuous mode [ 63.363774][ T7] usb 3-1: config 0 descriptor?? [ 63.581549][ T4380] netlink: 4 bytes leftover after parsing attributes in process `syz.1.43'. [ 63.591243][ T4380] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 63.652047][ T4380] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 63.691406][ T4265] usb 3-1: USB disconnect, device number 2 [ 64.792026][ T4387] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 64.858992][ T4387] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 65.681301][ T4431] device syzkaller0 entered promiscuous mode [ 65.916919][ T13] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 66.888212][ T4439] device syzkaller0 entered promiscuous mode [ 66.906621][ T13] usb 4-1: Using ep0 maxpacket: 32 [ 67.027947][ T13] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 67.047940][ T13] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 67.108953][ T4454] device syzkaller0 entered promiscuous mode [ 67.136216][ T4456] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.143793][ T4456] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.240571][ T4461] device syzkaller0 entered promiscuous mode [ 67.286850][ T13] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 67.304657][ T13] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 67.313373][ T13] usb 4-1: Product: syz [ 67.317959][ T13] usb 4-1: Manufacturer: syz [ 67.322593][ T13] usb 4-1: SerialNumber: syz [ 67.330592][ T13] usb 4-1: config 0 descriptor?? [ 67.671643][ T4192] usb 4-1: USB disconnect, device number 2 [ 68.582252][ T4495] device syzkaller0 entered promiscuous mode [ 68.673457][ T4497] device syzkaller0 entered promiscuous mode [ 68.790258][ T4500] device syzkaller0 entered promiscuous mode [ 69.379661][ T4520] netlink: 4 bytes leftover after parsing attributes in process `syz.1.89'. [ 69.962031][ T4527] device syzkaller0 entered promiscuous mode [ 70.120411][ T4535] device syzkaller0 entered promiscuous mode [ 70.199059][ T4265] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 70.457016][ T4265] usb 5-1: Using ep0 maxpacket: 32 [ 70.576892][ T4265] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 70.713038][ T4550] device syzkaller0 entered promiscuous mode [ 70.766714][ T4265] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 70.775931][ T4265] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 70.794730][ T4265] usb 5-1: Product: syz [ 70.804180][ T4265] usb 5-1: Manufacturer: syz [ 70.821574][ T4265] usb 5-1: SerialNumber: syz [ 70.835261][ T4552] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 70.843990][ T4265] usb 5-1: config 0 descriptor?? [ 71.130439][ T1324] usb 5-1: USB disconnect, device number 2 [ 71.648845][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.669483][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.277023][ T4566] netlink: 4 bytes leftover after parsing attributes in process `syz.0.107'. [ 72.295550][ T4566] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 72.403397][ T4566] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 72.430243][ T4571] device syzkaller0 entered promiscuous mode [ 72.448371][ T4574] device syzkaller0 entered promiscuous mode [ 72.749379][ T4578] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 72.765177][ T4580] device syzkaller0 entered promiscuous mode [ 72.791744][ T4578] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 73.186689][ T4192] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 73.437310][ T4192] usb 4-1: Using ep0 maxpacket: 32 [ 73.608769][ T4192] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 73.837617][ T4192] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 73.881616][ T4192] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 74.067400][ T4192] usb 4-1: Product: syz [ 74.145255][ T4192] usb 4-1: Manufacturer: syz [ 74.280902][ T4192] usb 4-1: SerialNumber: syz [ 74.584454][ T4192] usb 4-1: config 0 descriptor?? [ 75.250552][ T4602] device syzkaller0 entered promiscuous mode [ 75.364220][ T4192] usb 4-1: USB disconnect, device number 3 [ 75.464745][ T4611] misc userio: Invalid payload size [ 76.731098][ T21] cfg80211: failed to load regulatory.db [ 76.937664][ C1] ================================================================== [ 76.946072][ C1] BUG: KASAN: use-after-free in ax25_heartbeat_expiry+0x10c/0x130 [ 76.953912][ C1] Read of size 4 at addr ffff888143fa8f50 by task syz.0.124/4615 [ 76.961637][ C1] [ 76.963987][ C1] CPU: 1 PID: 4615 Comm: syz.0.124 Not tainted syzkaller #0 [ 76.971273][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 76.981430][ C1] Call Trace: [ 76.984710][ C1] [ 76.987555][ C1] dump_stack_lvl+0x188/0x250 [ 76.992243][ C1] ? show_regs_print_info+0x20/0x20 [ 76.997455][ C1] ? _printk+0xda/0x130 [ 77.001619][ C1] ? ax25_heartbeat_expiry+0x10c/0x130 [ 77.007095][ C1] ? load_image+0x400/0x400 [ 77.011603][ C1] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 77.017079][ C1] print_address_description+0x60/0x2d0 [ 77.022633][ C1] ? ax25_heartbeat_expiry+0x10c/0x130 [ 77.028098][ C1] kasan_report+0xdf/0x130 [ 77.032545][ C1] ? ax25_heartbeat_expiry+0x10c/0x130 [ 77.038013][ C1] ? ax25_setup_timers+0xc0/0xc0 [ 77.042955][ C1] ax25_heartbeat_expiry+0x10c/0x130 [ 77.048332][ C1] call_timer_fn+0x17b/0x540 [ 77.052941][ C1] ? ax25_setup_timers+0xc0/0xc0 [ 77.057888][ C1] ? __run_timers+0x800/0x800 [ 77.062592][ C1] ? _raw_spin_unlock_irq+0x1f/0x40 [ 77.067797][ C1] ? lockdep_hardirqs_on+0x94/0x140 [ 77.072999][ C1] ? ax25_setup_timers+0xc0/0xc0 [ 77.077942][ C1] __run_timers+0x53e/0x800 [ 77.082552][ C1] ? detach_timer+0x2b0/0x2b0 [ 77.087232][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 77.093225][ C1] ? sched_clock_cpu+0x15/0x3c0 [ 77.098092][ C1] ? ktime_get_real_ts64+0x440/0x440 [ 77.103382][ C1] run_timer_softirq+0x63/0xf0 [ 77.108147][ C1] handle_softirqs+0x339/0x830 [ 77.112914][ C1] ? __irq_exit_rcu+0x13b/0x230 [ 77.117764][ C1] ? do_softirq+0x210/0x210 [ 77.122282][ C1] __irq_exit_rcu+0x13b/0x230 [ 77.126964][ C1] ? irq_exit_rcu+0x20/0x20 [ 77.131483][ C1] irq_exit_rcu+0x5/0x20 [ 77.135725][ C1] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 77.141362][ C1] [ 77.144289][ C1] [ 77.147231][ C1] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 77.153224][ C1] RIP: 0010:lock_release+0x5a4/0x8a0 [ 77.158527][ C1] Code: 80 00 00 00 f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 2c 04 f8 75 6f 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 2c 00 00 00 00 43 c7 44 2c 08 00 00 00 00 65 48 8b 04 25 [ 77.178129][ C1] RSP: 0018:ffffc900056f6b40 EFLAGS: 00000206 [ 77.184200][ C1] RAX: 0000000000000001 RBX: 1672b6fb0ac2f54d RCX: 0c1a617d2d132800 [ 77.192259][ C1] RDX: 0000000000000002 RSI: ffffffff8a2b3a20 RDI: ffffffff8a79f980 [ 77.200241][ C1] RBP: ffffc900056f6c50 R08: ffffffff8d89e36f R09: 1ffffffff1b13c6d [ 77.208219][ C1] R10: dffffc0000000000 R11: fffffbfff1b13c6e R12: 1ffff92000aded74 [ 77.216190][ C1] R13: dffffc0000000000 R14: ffff888021a0a8a0 R15: 0000000000000246 [ 77.224184][ C1] ? rcu_lock_acquire+0x30/0x30 [ 77.229042][ C1] ? __lock_acquire+0x7d10/0x7d10 [ 77.234081][ C1] charge_memcg+0x13d/0x2f0 [ 77.238586][ C1] ? __mem_cgroup_charge+0x80/0x80 [ 77.243708][ C1] __mem_cgroup_charge+0x21/0x80 [ 77.248648][ C1] shmem_add_to_page_cache+0xa98/0x14d0 [ 77.254212][ C1] ? put_page+0x200/0x200 [ 77.258548][ C1] ? mark_lock+0x94/0x320 [ 77.262878][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 77.268861][ C1] shmem_getpage_gfp+0x1796/0x2d40 [ 77.274004][ C1] shmem_write_begin+0xcd/0x1a0 [ 77.278862][ C1] generic_perform_write+0x2b6/0x550 [ 77.284234][ C1] ? atime_needs_update+0x780/0x780 [ 77.289455][ C1] ? grab_cache_page_write_begin+0xa0/0xa0 [ 77.295270][ C1] ? file_remove_privs+0x5d0/0x5d0 [ 77.300396][ C1] ? rwsem_write_trylock+0x135/0x1c0 [ 77.305680][ C1] ? clear_nonspinnable+0x60/0x60 [ 77.310711][ C1] __generic_file_write_iter+0x25f/0x4e0 [ 77.316349][ C1] generic_file_write_iter+0xa6/0x1b0 [ 77.321723][ C1] __kernel_write+0x51c/0x970 [ 77.326411][ C1] ? vfs_read+0xd60/0xd60 [ 77.330738][ C1] ? __up_read+0x2b2/0x6b0 [ 77.335155][ C1] ? up_read+0x20/0x20 [ 77.339243][ C1] ? get_dump_page+0x4cf/0x680 [ 77.344018][ C1] __dump_emit+0x249/0x370 [ 77.348444][ C1] ? wait_for_dump_helpers+0x3d0/0x3d0 [ 77.353904][ C1] ? dump_emit+0x153/0x3d0 [ 77.358341][ C1] dump_user_range+0x84/0x340 [ 77.363025][ C1] elf_core_dump+0x2fbd/0x3500 [ 77.367815][ C1] ? load_elf_library+0x920/0x920 [ 77.372844][ C1] ? verify_lock_unused+0x140/0x140 [ 77.378045][ C1] ? dump_vma_snapshot+0xb00/0xe40 [ 77.383192][ C1] ? rcu_read_lock_any_held+0xb0/0x130 [ 77.388656][ C1] ? getname_kernel+0x142/0x2e0 [ 77.393520][ C1] do_coredump+0x14c7/0x2ac0 [ 77.398130][ C1] ? nfs_stat_to_errno+0x190/0x190 [ 77.403263][ C1] ? lock_chain_count+0x20/0x20 [ 77.408133][ C1] ? _raw_spin_unlock_irq+0x1f/0x40 [ 77.413335][ C1] ? lockdep_hardirqs_on+0x94/0x140 [ 77.418535][ C1] get_signal+0x40a/0x12c0 [ 77.422970][ C1] arch_do_signal_or_restart+0xe7/0x12c0 [ 77.428620][ C1] ? force_sig_info_to_task+0x320/0x3d0 [ 77.434169][ C1] ? get_sigframe_size+0x10/0x10 [ 77.439110][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 77.445104][ C1] ? exit_to_user_mode_loop+0x3b/0x130 [ 77.450566][ C1] exit_to_user_mode_loop+0x9e/0x130 [ 77.456028][ C1] exit_to_user_mode_prepare+0xee/0x180 [ 77.461575][ C1] irqentry_exit_to_user_mode+0x5/0x30 [ 77.467037][ C1] exc_page_fault+0x88/0x100 [ 77.471632][ C1] asm_exc_page_fault+0x22/0x30 [ 77.476483][ C1] RIP: 0033:0x7f8f84b717a1 [ 77.480895][ C1] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 77.500496][ C1] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 77.506555][ C1] RAX: 0000000000000000 RBX: 00007f8f84deb090 RCX: 00007f8f84b71799 [ 77.514525][ C1] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 77.522478][ C1] RBP: 00007f8f84c07bd9 R08: 0000000000000000 R09: 0000000000000000 [ 77.530438][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 77.538397][ C1] R13: 00007f8f84deb128 R14: 00007f8f84deb090 R15: 00007ffe5fe4d618 [ 77.546464][ C1] [ 77.549469][ C1] [ 77.551772][ C1] Allocated by task 4552: [ 77.556071][ C1] __kasan_kmalloc+0xb5/0xf0 [ 77.560640][ C1] ax25_dev_device_up+0x50/0x580 [ 77.565555][ C1] ax25_device_event+0x483/0x4f0 [ 77.570470][ C1] raw_notifier_call_chain+0xcb/0x160 [ 77.575825][ C1] __dev_notify_flags+0x194/0x300 [ 77.580839][ C1] dev_change_flags+0xe3/0x1a0 [ 77.585586][ C1] dev_ifsioc+0x130/0xd50 [ 77.589895][ C1] dev_ioctl+0x545/0xe30 [ 77.594134][ C1] sock_do_ioctl+0x245/0x320 [ 77.598701][ C1] sock_ioctl+0x4d2/0x710 [ 77.603005][ C1] __se_sys_ioctl+0xfa/0x170 [ 77.607581][ C1] do_syscall_64+0x4c/0xa0 [ 77.611992][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 77.617866][ C1] [ 77.620166][ C1] Freed by task 4623: [ 77.624117][ C1] kasan_set_track+0x4b/0x70 [ 77.628687][ C1] kasan_set_free_info+0x1f/0x40 [ 77.633603][ C1] ____kasan_slab_free+0xd5/0x110 [ 77.638613][ C1] slab_free_freelist_hook+0xea/0x170 [ 77.643988][ C1] kfree+0xef/0x2a0 [ 77.647781][ C1] ax25_release+0x661/0x870 [ 77.652264][ C1] sock_close+0xd5/0x240 [ 77.656491][ C1] __fput+0x234/0x930 [ 77.660460][ C1] task_work_run+0x125/0x1a0 [ 77.665033][ C1] get_signal+0x1222/0x12c0 [ 77.669513][ C1] arch_do_signal_or_restart+0xe7/0x12c0 [ 77.675132][ C1] exit_to_user_mode_loop+0x9e/0x130 [ 77.680394][ C1] exit_to_user_mode_prepare+0xee/0x180 [ 77.685914][ C1] syscall_exit_to_user_mode+0x16/0x40 [ 77.691361][ C1] do_syscall_64+0x58/0xa0 [ 77.695780][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 77.701672][ C1] [ 77.703974][ C1] The buggy address belongs to the object at ffff888143fa8f00 [ 77.703974][ C1] which belongs to the cache kmalloc-192 of size 192 [ 77.718009][ C1] The buggy address is located 80 bytes inside of [ 77.718009][ C1] 192-byte region [ffff888143fa8f00, ffff888143fa8fc0) [ 77.731178][ C1] The buggy address belongs to the page: [ 77.736812][ C1] page:ffffea00050fea00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x143fa8 [ 77.747059][ C1] flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff) [ 77.754698][ C1] raw: 057ff00000000200 0000000000000000 0000000100000001 ffff888016c41a00 [ 77.763285][ C1] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 77.771851][ C1] page dumped because: kasan: bad access detected [ 77.778264][ C1] page_owner tracks the page as allocated [ 77.783957][ C1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 2502252186, free_ts 0 [ 77.798780][ C1] get_page_from_freelist+0x1bbd/0x1ca0 [ 77.804322][ C1] __alloc_pages+0x1ee/0x480 [ 77.808892][ C1] alloc_page_interleave+0x24/0x1e0 [ 77.814069][ C1] new_slab+0xc0/0x4b0 [ 77.818122][ C1] ___slab_alloc+0x80a/0xdd0 [ 77.822707][ C1] __kmalloc_track_caller+0x1cb/0x330 [ 77.828075][ C1] krealloc+0x5a/0xf0 [ 77.832059][ C1] add_sysfs_param+0xe8/0x930 [ 77.836840][ C1] kernel_add_sysfs_param+0xaf/0x120 [ 77.842143][ C1] param_sysfs_builtin+0x183/0x200 [ 77.847287][ C1] param_sysfs_init+0x66/0x70 [ 77.851959][ C1] do_one_initcall+0x272/0x730 [ 77.856705][ C1] do_initcall_level+0x137/0x1f0 [ 77.861630][ C1] do_initcalls+0x4b/0x90 [ 77.865934][ C1] kernel_init_freeable+0x3e9/0x570 [ 77.871113][ C1] kernel_init+0x19/0x1b0 [ 77.875436][ C1] page_owner free stack trace missing [ 77.880780][ C1] [ 77.883079][ C1] Memory state around the buggy address: [ 77.888691][ C1] ffff888143fa8e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 77.896740][ C1] ffff888143fa8e80: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.904783][ C1] >ffff888143fa8f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.912818][ C1] ^ [ 77.919463][ C1] ffff888143fa8f80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 77.927498][ C1] ffff888143fa9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 77.935534][ C1] ================================================================== [ 77.943573][ C1] Disabling lock debugging due to kernel taint [ 77.949841][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 77.957027][ C1] CPU: 1 PID: 4615 Comm: syz.0.124 Tainted: G B syzkaller #0 [ 77.965697][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 77.975730][ C1] Call Trace: [ 77.978991][ C1] [ 77.981812][ C1] dump_stack_lvl+0x188/0x250 [ 77.986484][ C1] ? show_regs_print_info+0x20/0x20 [ 77.991662][ C1] ? load_image+0x400/0x400 [ 77.996143][ C1] panic+0x2e5/0x810 [ 78.000138][ C1] ? asm_common_interrupt+0x22/0x40 [ 78.005405][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 78.009895][ C1] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 78.015790][ C1] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 78.021671][ C1] ? _raw_spin_unlock+0x40/0x40 [ 78.026624][ C1] ? ax25_heartbeat_expiry+0x10c/0x130 [ 78.032069][ C1] check_panic_on_warn+0x80/0xa0 [ 78.037109][ C1] ? ax25_heartbeat_expiry+0x10c/0x130 [ 78.042670][ C1] end_report+0x6d/0xf0 [ 78.046814][ C1] kasan_report+0x102/0x130 [ 78.051299][ C1] ? ax25_heartbeat_expiry+0x10c/0x130 [ 78.056744][ C1] ? ax25_setup_timers+0xc0/0xc0 [ 78.061688][ C1] ax25_heartbeat_expiry+0x10c/0x130 [ 78.066982][ C1] call_timer_fn+0x17b/0x540 [ 78.071733][ C1] ? ax25_setup_timers+0xc0/0xc0 [ 78.076653][ C1] ? __run_timers+0x800/0x800 [ 78.081325][ C1] ? _raw_spin_unlock_irq+0x1f/0x40 [ 78.086514][ C1] ? lockdep_hardirqs_on+0x94/0x140 [ 78.091712][ C1] ? ax25_setup_timers+0xc0/0xc0 [ 78.096714][ C1] __run_timers+0x53e/0x800 [ 78.101204][ C1] ? detach_timer+0x2b0/0x2b0 [ 78.105863][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 78.111833][ C1] ? sched_clock_cpu+0x15/0x3c0 [ 78.116677][ C1] ? ktime_get_real_ts64+0x440/0x440 [ 78.121955][ C1] run_timer_softirq+0x63/0xf0 [ 78.126728][ C1] handle_softirqs+0x339/0x830 [ 78.131489][ C1] ? __irq_exit_rcu+0x13b/0x230 [ 78.136348][ C1] ? do_softirq+0x210/0x210 [ 78.140845][ C1] __irq_exit_rcu+0x13b/0x230 [ 78.145517][ C1] ? irq_exit_rcu+0x20/0x20 [ 78.150007][ C1] irq_exit_rcu+0x5/0x20 [ 78.154250][ C1] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 78.159869][ C1] [ 78.162782][ C1] [ 78.165694][ C1] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 78.171667][ C1] RIP: 0010:lock_release+0x5a4/0x8a0 [ 78.176936][ C1] Code: 80 00 00 00 f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 2c 04 f8 75 6f 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 2c 00 00 00 00 43 c7 44 2c 08 00 00 00 00 65 48 8b 04 25 [ 78.196519][ C1] RSP: 0018:ffffc900056f6b40 EFLAGS: 00000206 [ 78.202663][ C1] RAX: 0000000000000001 RBX: 1672b6fb0ac2f54d RCX: 0c1a617d2d132800 [ 78.210617][ C1] RDX: 0000000000000002 RSI: ffffffff8a2b3a20 RDI: ffffffff8a79f980 [ 78.218588][ C1] RBP: ffffc900056f6c50 R08: ffffffff8d89e36f R09: 1ffffffff1b13c6d [ 78.226560][ C1] R10: dffffc0000000000 R11: fffffbfff1b13c6e R12: 1ffff92000aded74 [ 78.234517][ C1] R13: dffffc0000000000 R14: ffff888021a0a8a0 R15: 0000000000000246 [ 78.242480][ C1] ? rcu_lock_acquire+0x30/0x30 [ 78.247324][ C1] ? __lock_acquire+0x7d10/0x7d10 [ 78.252344][ C1] charge_memcg+0x13d/0x2f0 [ 78.256837][ C1] ? __mem_cgroup_charge+0x80/0x80 [ 78.261944][ C1] __mem_cgroup_charge+0x21/0x80 [ 78.266873][ C1] shmem_add_to_page_cache+0xa98/0x14d0 [ 78.272405][ C1] ? put_page+0x200/0x200 [ 78.276710][ C1] ? mark_lock+0x94/0x320 [ 78.281016][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 78.287409][ C1] shmem_getpage_gfp+0x1796/0x2d40 [ 78.292525][ C1] shmem_write_begin+0xcd/0x1a0 [ 78.297440][ C1] generic_perform_write+0x2b6/0x550 [ 78.302702][ C1] ? atime_needs_update+0x780/0x780 [ 78.307893][ C1] ? grab_cache_page_write_begin+0xa0/0xa0 [ 78.313701][ C1] ? file_remove_privs+0x5d0/0x5d0 [ 78.318805][ C1] ? rwsem_write_trylock+0x135/0x1c0 [ 78.324073][ C1] ? clear_nonspinnable+0x60/0x60 [ 78.329077][ C1] __generic_file_write_iter+0x25f/0x4e0 [ 78.334689][ C1] generic_file_write_iter+0xa6/0x1b0 [ 78.340037][ C1] __kernel_write+0x51c/0x970 [ 78.344697][ C1] ? vfs_read+0xd60/0xd60 [ 78.349001][ C1] ? __up_read+0x2b2/0x6b0 [ 78.353401][ C1] ? up_read+0x20/0x20 [ 78.357461][ C1] ? get_dump_page+0x4cf/0x680 [ 78.362229][ C1] __dump_emit+0x249/0x370 [ 78.366627][ C1] ? wait_for_dump_helpers+0x3d0/0x3d0 [ 78.372072][ C1] ? dump_emit+0x153/0x3d0 [ 78.376464][ C1] dump_user_range+0x84/0x340 [ 78.381126][ C1] elf_core_dump+0x2fbd/0x3500 [ 78.385871][ C1] ? load_elf_library+0x920/0x920 [ 78.390880][ C1] ? verify_lock_unused+0x140/0x140 [ 78.396062][ C1] ? dump_vma_snapshot+0xb00/0xe40 [ 78.401154][ C1] ? rcu_read_lock_any_held+0xb0/0x130 [ 78.406594][ C1] ? getname_kernel+0x142/0x2e0 [ 78.411443][ C1] do_coredump+0x14c7/0x2ac0 [ 78.416104][ C1] ? nfs_stat_to_errno+0x190/0x190 [ 78.421208][ C1] ? lock_chain_count+0x20/0x20 [ 78.426043][ C1] ? _raw_spin_unlock_irq+0x1f/0x40 [ 78.431221][ C1] ? lockdep_hardirqs_on+0x94/0x140 [ 78.436402][ C1] get_signal+0x40a/0x12c0 [ 78.440804][ C1] arch_do_signal_or_restart+0xe7/0x12c0 [ 78.446419][ C1] ? force_sig_info_to_task+0x320/0x3d0 [ 78.451956][ C1] ? get_sigframe_size+0x10/0x10 [ 78.456967][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 78.462951][ C1] ? exit_to_user_mode_loop+0x3b/0x130 [ 78.468404][ C1] exit_to_user_mode_loop+0x9e/0x130 [ 78.473665][ C1] exit_to_user_mode_prepare+0xee/0x180 [ 78.479185][ C1] irqentry_exit_to_user_mode+0x5/0x30 [ 78.484717][ C1] exc_page_fault+0x88/0x100 [ 78.489290][ C1] asm_exc_page_fault+0x22/0x30 [ 78.494122][ C1] RIP: 0033:0x7f8f84b717a1 [ 78.498523][ C1] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 78.518222][ C1] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 78.524362][ C1] RAX: 0000000000000000 RBX: 00007f8f84deb090 RCX: 00007f8f84b71799 [ 78.532315][ C1] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 78.540282][ C1] RBP: 00007f8f84c07bd9 R08: 0000000000000000 R09: 0000000000000000 [ 78.548337][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 78.556286][ C1] R13: 00007f8f84deb128 R14: 00007f8f84deb090 R15: 00007ffe5fe4d618 [ 78.564338][ C1] [ 78.567683][ C1] Kernel Offset: disabled [ 78.571995][ C1] Rebooting in 86400 seconds..