Warning: Permanently added '[localhost]:23887' (ECDSA) to the list of known hosts. 2025/01/27 18:38:23 fuzzer started 2025/01/27 18:38:24 dialing manager at localhost:40883 syzkaller login: [ 69.678278] cgroup: Unknown subsys name 'net' [ 69.819960] cgroup: Unknown subsys name 'cpuset' [ 69.882400] cgroup: Unknown subsys name 'rlimit' [ 75.715022] kmemleak: 2 new suspected memory leaks (see /sys/kernel/debug/kmemleak) 2025/01/27 18:38:42 syscalls: 203 2025/01/27 18:38:42 code coverage: enabled 2025/01/27 18:38:42 comparison tracing: enabled 2025/01/27 18:38:42 extra coverage: enabled 2025/01/27 18:38:42 setuid sandbox: enabled 2025/01/27 18:38:42 namespace sandbox: enabled 2025/01/27 18:38:42 Android sandbox: enabled 2025/01/27 18:38:42 fault injection: enabled 2025/01/27 18:38:42 leak checking: enabled 2025/01/27 18:38:42 net packet injection: enabled 2025/01/27 18:38:42 net device setup: enabled 2025/01/27 18:38:42 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/01/27 18:38:42 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/01/27 18:38:42 USB emulation: enabled 2025/01/27 18:38:42 hci packet injection: enabled 2025/01/27 18:38:42 wifi device emulation: enabled 2025/01/27 18:38:42 802.15.4 emulation: enabled 2025/01/27 18:38:42 fetching corpus: 0, signal 0/0 (executing program) 2025/01/27 18:38:44 starting 8 fuzzer processes 18:38:44 executing program 0: setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000000)=0x4, 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x2}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3f}]}, 0x24}, 0x1, 0x0, 0x0, 0x4b01173b38c517e4}, 0x24004050) r2 = socket(0xf, 0x6, 0xffffffff) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000240)={'gre0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x7, 0x40, 0x8001, 0x4, {{0x1d, 0x4, 0x3, 0x1f, 0x74, 0x0, 0x0, 0x5, 0x2f, 0x0, @multicast1, @rand_addr=0x64010101, {[@cipso={0x86, 0x5e, 0x0, [{0x1, 0xe, "a7d8484811eb8a2a21388df5"}, {0x5, 0x11, "73cf50f3d9103ab061b7ca243a7abc"}, {0x0, 0xd, "2da3ea18a281696adcca68"}, {0x7, 0xe, "a8844d861666f62b79d35fc9"}, {0x0, 0xe, "a75810db155de37b9821d35c"}, {0x1, 0x7, "1f34dd2892"}, {0x0, 0x9, "5fd1cd0240a769"}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f00000002c0)={'erspan0\x00', &(0x7f0000000280)={'syztnl1\x00', r3, 0x1, 0x700, 0x80000001, 0x5, {{0x6, 0x4, 0x1, 0x8, 0x18, 0x68, 0x0, 0x1, 0x29, 0x0, @loopback, @remote, {[@noop]}}}}}) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r1, 0x8, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4810}, 0x20000804) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'wg0\x00'}) r4 = syz_open_dev$vcsn(&(0x7f0000000440), 0x9, 0xa0000) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r4, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x530000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x3c, r1, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x7c00}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4044040}, 0x0) ioctl$sock_ifreq(r2, 0xc8d234aa51731de2, &(0x7f0000000580)={'ip6_vti0\x00', @ifru_hwaddr=@broadcast}) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20050200}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x24, r1, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x5ccf}]}, 0x24}, 0x1, 0x0, 0x0, 0x10014}, 0x24004880) r5 = openat$zero(0xffffffffffffff9c, &(0x7f00000006c0), 0x381e40, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r5, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x2c, r1, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x801}, 0x1) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r5, &(0x7f00000008c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x1c, r1, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x81}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) setsockopt$inet_udp_int(r4, 0x11, 0x67, &(0x7f0000000900), 0x4) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000980), r2) sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x3c, r6, 0xa10, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1000}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x20}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}]}, 0x3c}}, 0x4000800) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000a80), 0x1, 0x0) 18:38:44 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f0000000000)={{0x2, 0x2, 0x1, 0x3, 0x80000000}, 0x6, 0x4, 'id0\x00', 'timer1\x00', 0x0, 0xfffffffffffffff7, 0x2, 0x5, 0x9}) setsockopt$inet_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) ioctl$TIOCGPTLCK(0xffffffffffffffff, 0x80045439, &(0x7f0000000140)) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000180)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x204000, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000280)={'syztnl0\x00', &(0x7f0000000200)={'syztnl0\x00', 0x0, 0x700, 0x7800, 0x6, 0xffff8674, {{0x10, 0x4, 0x3, 0x9, 0x40, 0x65, 0x0, 0x74, 0x29, 0x0, @multicast2, @loopback, {[@timestamp={0x44, 0x18, 0x82, 0x0, 0x5, [0x7fff, 0x0, 0x6, 0x80, 0x0]}, @timestamp={0x44, 0x14, 0xf2, 0x0, 0x6, [0x9, 0x8, 0x1, 0x8000]}]}}}}}) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000002c0)={0x3, 0x2, 0xb2, 0x3, 0x1}) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x41, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000340)={{0xffffffffffffffff, 0x3, 0x9, 0x2, 0x80000001}}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000380), 0x4000, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000003c0)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000400)={0x3, 0x2, 0x3, 0x1, 0x9}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000440)={{0x2, 0x1, 0x8, 0x3, 0xffff}}) ioctl$TIOCNXCL(r2, 0x540d) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000480)={{0x0, 0x3, 0x2, 0x7ca0e2d1ce49b278, 0xf518}, 0x5, 0x5, 'id1\x00', 'timer1\x00', 0x0, 0xf6a4, 0x5, 0xffffffffffffff2e, 0x5}) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000580), 0x2000) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r3, 0x54a3) 18:38:44 executing program 2: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDMKTONE(r0, 0x4b30, 0x7cf1) ioctl$VT_SETMODE(r0, 0x5602, &(0x7f0000000000)={0x1, 0x0, 0xb2, 0x5ba2, 0x50}) accept4$unix(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x6e, 0x800) ioctl$TIOCMIWAIT(r0, 0x545c, 0x0) ioctl$KDMKTONE(r0, 0x4b30, 0x401) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000000100)) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x2000804) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) mq_timedsend(r1, &(0x7f00000001c0)="ed9bfef59128ff7f8af505e9fbff7a1f6cb4badc119283ff55462489c839028472424e4aaf380333", 0x28, 0x4, &(0x7f0000000240)={r2, r3+10000000}) ioctl$TCGETS2(0xffffffffffffffff, 0x802c542a, &(0x7f0000000280)) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000002c0), 0x200400, 0x0) ioctl$TIOCNXCL(r4, 0x540d) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000300), 0x385000, 0x0) ioctl$KIOCSOUND(r5, 0x4b2f, 0x20) ioctl$KIOCSOUND(r5, 0x4b2f, 0x100000001) ioctl$TIOCL_SETVESABLANK(r1, 0x541c, &(0x7f0000000340)) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, &(0x7f0000000380)="83c2fbc4df7fae7faff724e224ea81a28b56d25ef5ee4fe428c0cddb1cbe72fe8296849812f34a3e52808659024df3c67d0f9cb4eaca68277934aac5853df2457c1954c2f3b71e1c2faa009a19644fb61ae961efd40d90fe0ad7306a5fef8bd9b351c8619c2d80b5099a34d240d93ffda38f2ed2f586bf0bdd016a04d546c177022024b4a33c75a017127792c23abb875670b007238a1d86645548a1b9534f42b6bb873bb73fc1b8e4b0572efd09bc4f190ca28ff810d907443edd5712b598de80ccd1313468c555fea6f7bd058e4fdfbd09d8c86454ee63bec51c81fb6872a0d8d5f787e2385272d93236b75f04837a5abfaf811bf6389b3a55b0ac28e257118a507b2ca4e0817202971d3b763af8c3bb75995d37d9efde99b763cbbcf1e0a84e95d840f708febe492a9e0df766aedb53ae063e3486d809ba50ad3b7eaba454b4b41cf011558c2dfc4887de7cb4437e37581ccf65bae3bf20a34a45ff876437ca2d7168edc382ad476cd1b8c370dfbe7723a058b40627b826f22c119b422b5b08b15450d370ac32c32b64c60fba2101457ddd0f297bf7064009a788e4d863b1a969159f204d1b8a522d1dc5a653af2fe802704915ec6aa3e0d14b55248f31bbcea301a879f4105327b1f3983324481cded512f5bbfca1c7da70e94607b5c753120ec1c9cc43ef71f92e6b43b7c5ff61d98e8f0160fa2b1ba0812e2361c4cd5661c458e11eb61f9bfb75fc13f79788a5abe041db6ec298248e1e5d4df5c77d7816eddec89f675280ae9c5ed68f0e25b564f376613d512f62c0e04e0a1f6d66def7df8e05f8f69971087740016dd4c156a1c764d259a9b2a07bcf5784bc7788c640331dfc4f133993b644866f30812aef8d9d8c66563da7ab6d1548ee76356e6155fbbbb24cff457939ac4b2e5f8f08a96ba5653f1a3b9725676df0e90302ff9d1b9940d0c6489727b041a4c0ec348e7d9a0a58e9adb14c266283987cb4312d6281b0640d7696a1743d14a48b2f648cd54bfd75f72e39ffed5591b6c9dff59c4b3c0389b632319cb9d95202ab81c33d1ec3c216e554eac953c642cf24960608b51d60c9474022b20fccf7b02b2c1d13e663045451f2f7bd64dad9cd0fc98f7608727d127543331797cb86dc63db44a63b82eeb6431c8ecb1045ca1e5a3e01affe8b5c7a599a8fc30894f798ad0fa3e8c09ea661aafc3091d3c6b82369e3c5e64ca61cf409b2da1cb437980bcebeb53a443cda9054d63ef2d34a1a104360102a788566dd836f54fbf1d60c2240552411c1105c3af0382409ffcae7e8cada03e3bc5d87957794a769946eee4c6d9e478037f53869a58ba907b7cbfb86a348516b58ab0b7246ad305f9493333b5bec94f0a486210918139e4ec7666a253fcd5bbf95869f4e4968da6cc219b958c58300f7e2c81912b3312a37dcc281dae783e475e687d96236336f741c81e40776784536f0b78ea9df33abc593e1174dd5ba5ed9e28a65accd45024ae416ce71003312ac55dd8473cd72e4fbf207b4cde418a398b94944b783860c00c43eb10ed5203d63888d1b5ddb53c5ab648ac21bf972dcfa4985f7887f601ccc8d48c2cc1b016c6b922ce8f762cb4bffaad395e500963c2d50321aa230bc28bfa170a8f09f5286c58e6bfcc81ad59fb7bcd2241742adbb0308a19f6232e6d19511770ae8569e9c598583c259ef204747e464c57209e4260ec16a1234b8b8c43dbefc516ab6257241f9f63772c88355dccdaadb22b2905bf645a042d3551759178774b29885cfd6042b3aebde68850000d3300aa25cc8839e127b08ead9fbc951e81d6642c71c12610ff0e0c310e87f95d69f1960bca7a6a8b7a11b9b2075d51f03a785a37d39473324e0ff5cdb0645f09f76cc9750f6d05de858663ba5ff0e9ed5450a604ea855c15c7c60290b6d5060c7060ed5a5dc28f381e856639efd06d5775c3bee481785c35d4ed9487a771e80a66615d296aa7874dd0f3f5d3b95e3e2ca31aff8c1453d78b03fe95dbfbe8738056b8e022ea1018451ebe65563aa98a74cb36ad226e6957ca2af03495e6278a45bca9b74cc1b84e8ffa177cb0bca3cfb7f7d6f9431be1f6b4b9cfb670af7ab9787d80c95cac64feac660d3bbe21d7f47b2d9cd1b77d7a21d06a1da320b7a2059e16f5c7c7388b39362b2cf627310ee956ec27d7840a449ba934ae5ae758303801ce3a30a8b19886b0c1b622770414814280adb744d51974a2fd8ab34afbec39d856dcdc570d8f9dcbac42e49c5b673070a59cf921b51eeb226026b1a6ccf36eb60561ff2e4331d3c4835df975c7ae26de1ab0e844deb1218ab0f92359749c399b78ea910a9a6f0684dc2faa68e7dc1029675d81606a856ce5161820ccf2090d5ea7fff931164ddf6c1f4f66ce4cbbe4c77b67a64226c058a116c48c1a92955fd320ecf634403e0df01993883aa7a2e06ec1e96b67638861615e799da9757c9e7cf15626f2a6eeb6f9d663f2b2433b64c072fc8ace7508cde55c328ee9081d43b19d7f010c833daabbea5030d19dc1032d0ec57b21a0fe23816250cbf83ba58d3f93435865c67b20b25a67f9d673ac0c27c6e4d5a2ffd5a8161448e2babc61d15be032d8d05a847dceb71ac014c08d54b113706529547dd2417a6a397cec5b6463814fb2b5a9eef012e2fed441635211f09c799e70ef6942d2c29f8ef7fdc10b80dfb0bcb2bf394cabac7abb2ab6c68c7403d31274af1da15484d1fd6add36e6178620d290dd6053f26b89c280cdebe651bf4df4e3b67253972221d02d9342b8553858c20404a5f867368d0e6bfaffecc596dfd177bcac73e2edae1b2fac8fbd56c02f12d61eead64265445d46f7a3993197e0e24b567e69cae86c4ffeaab6bbbb89532f74ee9d5ddc93c188c99292920ef84a917f65eb07c5bc2ef626f92816cfc6b6124ce9ef8e1d98ef01889bfb6d75068c867447cd2fea7200e8a9412d2479b890318207fe821e235ff70482a0dd0ee8c1fa464a8c54e7ec6a4b77b6d61b7ba6db479db48da3fd7e60916a8bc5a2509b58c3cd0a459834c13dd62c71ab63d02acd224009661a0498f516931c7f039c3e870581cc33ec3a265fb5a706e09ee340e02a2ff43ce95da7796e48c20db78ba47f5287afb882b4192d309f842c91fbc3ae6c38159a36e6f52b97a7dbba20d316209da0b53630a96059e67308248b65b037da7be6b32140128817030bccb914b4418f7d5b8bdfec5a86115f4ff50231218121f88935ea890a5f2a8caa9f8e27132f955635373e74a12fdc2b5ee275b2fbee8ed1bd63eb116934599dc9e986e8b9222d75d55b50ec97268876f52a685edb3d8f3d530eb6f64e74c33bd4b5ed9776335eb69ac5d3ee40b2490f11d6627a7df9ce7d73f5484f381d3be948c9f32a41220ce89bd80f165e3a58cd1008f53593e3be9a482af7f2acbb1449d88dc33ac500701225b18c3e5d7bafd304eddaf3cf076750164a02a354f66486346ba1b263b6197e9dd68e53b7d0f64aa4367138cb67350c76afcb65a2fd6e93f1961d2e65522f5ba1686d098674238568d74af093c2d34ce9f1d1ed141b749d3994989f38d2ac89898817b6220fe2f449e1e43f4586e26cddaf8e4b762d16df4b3656b18f2674e87aeccd1caaea8ccddf62e4b67fe523aa0c3dae6501af9bc71b3bb80c92dd563b7e2156c8cf8463f62d87405707cbf84c60ab9db630f46d802a8e6c004fbd78e5bbccc9af628e636de2906176faa5b83d43e8a267afd97bdba1b3e55ab50f7924687bcaf46e3e3435015f89b9e0537ee6d829f598055fc2e4c88d8e0bc22a57f65768057a0395646576fcf77bdb06827800a7cfaf8e54803273d1ecb3c5c95da1ec6b21ef0d906e2b5c5fd7589dab53ce0c31d40cc4494b721046871c819f343f420ee48ca38929e03f656647fb97a238b1cb7cf5fe9d1730047c6389779954af80d63c083cd9c27b8dd877e97f6302a0b662e5bf2f9058b501f16d88bea80e82156063a768a6cc9b0bed221a6feb6e9a72a1c3c23832825877f0460ad71d85e8d04ce70ebee81293fba69178447d493cee9f716950e6876fb2d69bf498973953c84097f84c4253bd752ccf8d9171a6021b9655c40e8d0b1dfd70c784a69ffbfd74826d43977bf4cabe1766e13933d12698539d2428c7cc0e2e884832ec0dd9544239068cce9dd6b81f30ec59395157baf51e6e53eec6c1391b64847dbf39bd1d4de4860061c753a208e65c5abd8436d1a724ba6a0c4979b6e55f7a288a9a93ef960b5822371d166b7b158c1af030397c6a4a018147b7c2f26e02903b486ba9c7ea4df9ca71ae601c2ddf703280def96ae9837990fea16ff6d73f8adb9f88d1a07744c69d8015eafceb833a38fff3a47531e0d61694d73ace21291b977c8f370ff2efbb4a465bc7fb3fc2e0d9cdba6a6feab22a0b2a23855c289435da5ae0f6d2c50655936943dac1419715e17b7af40703468c1e1553219ee3cbee4eb4065a10eee8a300ae8b5aea80e2274779ca39f82b12e76ef3234300067613f9be9f6f5f47ef1c6ca88cbde9856edf4ffee44a4a0fdfef47813c1e01467b312c06a2370387becdc0d24234b3d98cdb8f137776f105e05c35e9dd92f555fe31016a26b8af5d62192898307e8b166f195a8c09816c198ba35d81fa01dee8f9115e35583680e47fb40526bc1d49ef657e6b31cae3ba7fa9fd881ef1d0e3fe0a9335fbee80d5d61b7287316ccccc46be981886f356dde24b418ae6db880b33629fbbd83432e684167d799fbec77a239761072f1eb7f8db6fe5a9d75d8bcc77a34c68732259eb3626ca66d4ecaf1324a08db53d5d81bd45aab57533c1f8dcc2bf2fd4898a0d197766ede4b4e1fe3d7c05e64e3a1290dcc2a2aadb3330d3c2dac6ed0e54ffb31a350221a65705b74ea6a7ee586707dc5deeb9587d432ffc60c0216377e72848128a97c83b99e4f9932e0608c29dbcb44299dd82cc5ded5022249111721f0f64eb836333e3a1dea8510cbcdf7a453b4d40f2ea8641e0644e9d035ea20568655dc3a5201871eb68b2210fc5524aaf9d132baf42c3a2cbe7e528ae73d33d94eee831aef5ba5f4f7293e9ca4a6540ca32b027fa90757ec0bb13b21bc0e722b31ad2ece93a7d88a80d370310cf8d8ffc01b09d3085a7c52162a1257cb3c2b972d8e69246c53a57584779a9abe7d5dd376c9d437eafb7c90844e38642bf7c1d4e1efe08f20c48459b1ebee45ffcf82fc82e0f4f0a4d7d72bbffa01f5697ad52dd711283bc7dfce1270b2c1385cba0bac8bf5f9ddc6f0d4bd9dc61efd2ec7239495dea9154445cb1b12df14e07d612eef2eb3f4b6906a5ed8ebb73dd6f0c44bcc8f7dd932b4cde2157a8c7d1145bd88b4c59079ffe6ac22706f4eeaed720b69e09a48a95301f572ede9e5dd40be29e90e9b2bf5da3846799adf969f89c30f168fce6a09aea7d1395f4f0abceb58a02e6a50befee11fb3b943ce267e9d80b5bdf7772e20d8a13c90dbf3f363a21252b632c4486fc688c87ff82b9dc200c221db2e83292951ce49ace714eac909afb2ef4746693564c344d4959293b77b43f2dd1bbc832735ee136e925d5013a34dad8030094fcd05433873f112319f256ffb8c053fb14935577b71d217369c3b6c79ecc718569edf39227d43eb2d7a3b6d23413dd12aa85c496c5e22878ef96806091af96db1b204c19c98083b9fab3fd27aa9c790ff4a6a246fb6adf8ce8ffe3455a8ecf69c4a045c61811623b7ba2a7f16a2d7aff733c921011292cce439556c5892d95d602795e888c9a5") rt_sigtimedwait(&(0x7f0000001380)={[0x5]}, &(0x7f00000013c0), &(0x7f0000001440)={0x0, 0x989680}, 0x8) 18:38:44 executing program 3: ioctl$KDGETMODE(0xffffffffffffffff, 0x4b3b, &(0x7f0000000000)) syz_open_pts(0xffffffffffffffff, 0x450880) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000480)={0x0, 0x10, &(0x7f0000000080)}) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000004c0), 0x400001, 0x0) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f0000000500)={0x1f, 0x1, 0x2, 0x7, 0xff7f}) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) r3 = syz_open_pts(r2, 0x101001) ioctl$GIO_FONTX(r3, 0x4b6b, &(0x7f0000000940)={0x7c, 0x16, &(0x7f0000000540)}) ioctl$TIOCGSERIAL(r0, 0x541e, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=""/106}) ioctl$TIOCGPTLCK(r2, 0x80045439, &(0x7f0000000a80)) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000ac0), 0x90242, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r4, 0x0, 0x3, &(0x7f0000000b00), 0x4) r5 = syz_open_pts(r2, 0x440001) ioctl$PIO_UNISCRNMAP(r5, 0x4b6a, &(0x7f0000000b40)="6cd2fc8ffcb07216971b5807f070fec06553fed2f85b3589a23fbc577db70adc6d393a5ef68bc1e4f93014a5b4140a200a15c1f9bc3a93e03462d68470d647d0d777250d4997a2b28fd5eb6c5422db52ab761013aae1d60b5d92b7f9a82be59ccdfe1bb69620df31c90465589462f1175751dacabd2bec91d8151e524130c35b6e7cf1d0007e4d687b8c0d34a3abe5cf5fe523f51bad9f1bb15e1f62451d6e13c822dd1057946f9acc23de3cc71fb2d2785f2a616db6c6458c5089c48a0bbf7c25f4756d99268093499a496434fde63c34e12c11d84e3d5180d8faa1e5084012e9d3206d75a8c45b856e3f5d891f") ioctl$SNDRV_TIMER_IOCTL_STOP(0xffffffffffffffff, 0x54a1) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KIOCSOUND(r6, 0x4b2f, 0x3f) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000c40)) ioctl$TIOCGRS485(r2, 0x542e, &(0x7f0000000c80)) 18:38:44 executing program 4: ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000000)={0x0, 0x9559, 0x80, 0x3, 0xb, "659299cfe826356c"}) ioctl$TIOCGRS485(0xffffffffffffffff, 0x542e, &(0x7f0000000040)) r0 = syz_open_pts(0xffffffffffffffff, 0x10000) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000080)) clock_settime(0x5, &(0x7f00000000c0)={0x77359400}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000100)) ioctl$TIOCGPTLCK(r0, 0x80045439, &(0x7f0000000140)) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000180)={0x4, 0x9b, 0x101, 0x20, 0x12, "c18eddcb2377d957"}) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f00000001c0)={0x81, 0x2, 0x7f, 0x0, 0xf8, "f556d53d1f88f705d388c47b41c1e209b29f0e", 0xff, 0x5}) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x18) inotify_rm_watch(0xffffffffffffffff, r2) ioctl$KDFONTOP_COPY(r1, 0x4b72, &(0x7f0000000640)={0x3, 0x0, 0x5, 0x2, 0x1b9, &(0x7f0000000240)}) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000680)={0xe26, 0x2, 0xb33, 0x3, 0x3, 0x4}) ioctl$KDFONTOP_COPY(r0, 0x4b72, &(0x7f0000000ac0)={0x3, 0x1, 0x14, 0x2, 0x1fc, &(0x7f00000006c0)}) inotify_init() r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSERIAL(r3, 0x541e, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)=""/77}) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000000c00)) prctl$PR_SET_FPEXC(0xc, 0x20000) [ 90.083259] audit: type=1400 audit(1738003124.906:7): avc: denied { execmem } for pid=270 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 18:38:44 executing program 5: ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f0000000000)={{0x0, 0x1, 0x1, 0x3, 0x80000000}, 0x8, 0x800, 'id0\x00', 'timer1\x00', 0x0, 0x6, 0x2, 0x1, 0x2}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f0000000100)={{0x3, 0x1, 0xfffffffe, 0x3, 0x80000001}, 0x9, 0x70, 'id1\x00', 'timer0\x00', 0x0, 0x0, 0x5d3, 0x5, 0x3}) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f0000000200)={{0xffffffffffffffff, 0x2, 0x2, 0x3, 0x8001}, 0xfca, 0x7fffffff, 'id1\x00', 'timer1\x00', 0x0, 0x6, 0x3058, 0xe490, 0x4}) add_key$user(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x3}, &(0x7f0000000380)="ce1d1269430bcbf6cfc29e1b680d4e00b57621df197bc3d6e8af4102d1d803f531a32c83bfe1bb89475cfcb71aae84f1b8aa7f36e9999efae0b41a61942f403d18c609e42e26abc147f2f0e8d8251e5728af6b9aa067504fe8e35a12f6c9f84587a55dab6b1bf6f2e2321fbad89c49160c6e20e6bfeed75bfb5133b6b33977bb3643989e324458da09bee86f1318a1937b1dc6595b70c23c08eae9ce19689787a669b2910ff5fe5d8c9aeff17d27f0a053bc8afd9bbb54cd1d69dcb25d2556eb92746fe4dbb50110f8f4dbb89358c9cf8c67436c814158920f1e941ca469a36ce7a00f80b2fb9fddef05b5fb93ce81cccf", 0xf1, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000480)={0x2, 0x1, 0x2, 0x5, 0x7, 0x2}) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000004c0), 0x400200) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f0000000500)={0xffffffffffffffff, 0x2, 0x3fe0000, 0x2, 0xfffffff8}) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCGSERIAL(r2, 0x541e, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/174}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r3, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x3c, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x9b9}, @BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x6700}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8d}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2400c000}, 0x20040000) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000007c0), 0x141000, 0x0) ioctl$TIOCNXCL(r4, 0x540d) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r3, 0x40485404, &(0x7f0000000800)={{0x0, 0x2, 0x3, 0x3, 0x2}, 0x800, 0x7f0}) add_key$user(&(0x7f0000000880), &(0x7f00000008c0)={'syz', 0x1}, &(0x7f0000000900)="1f902903507d2ed0b0408586aa3c198389094b39aa13ab5bdd6268f5aa5ae81d2df1", 0x22, 0xffffffffffffffff) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000940), 0x101240, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r5, 0x54a0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000980), 0x103000) 18:38:44 executing program 6: recvmmsg(0xffffffffffffffff, &(0x7f0000001780)=[{{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000000000)=""/4096, 0x1000}, {&(0x7f0000001000)=""/197, 0xc5}, {&(0x7f0000001100)=""/44, 0x2c}, {&(0x7f0000001140)=""/235, 0xeb}, {&(0x7f0000001240)=""/62, 0x3e}, {&(0x7f0000001280)=""/226, 0xe2}], 0x6, &(0x7f0000001400)=""/215, 0xd7}, 0xc}, {{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000001500)=""/12, 0xc}, {&(0x7f0000001540)=""/247, 0xf7}], 0x2, &(0x7f0000001680)=""/237, 0xed}, 0x3}], 0x2, 0x10000, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001800), 0x10000, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000001880)={'batadv_slave_0\x00', 0x0}) r2 = getuid() sendmsg$nl_xfrm(r0, &(0x7f0000001cc0)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0xa55c858654fa89ee}, 0xc, &(0x7f0000001c80)={&(0x7f00000018c0)=@newsa={0x38c, 0x10, 0x20, 0x70bd25, 0x25dfdbfb, {{@in6=@loopback, @in6=@empty, 0x4e20, 0x2, 0x4e22, 0x7, 0xa, 0xa0, 0x20, 0x2b}, {@in6=@private0, 0x4d4, 0x6c}, @in=@multicast1, {0xd5, 0x8, 0x401, 0x0, 0x81, 0x2e63, 0x7, 0x7}, {0x7fff, 0x5, 0x74a3, 0x100000001}, {0x6, 0xaf6, 0x7f}, 0x70bd29, 0x3504, 0xa, 0x3, 0x6, 0x62}, [@lastused={0xc, 0xf, 0x8001}, @sa={0xe4, 0x6, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@broadcast, 0x4e24, 0x4, 0x4e23, 0x8, 0xa, 0x40, 0xc0, 0x33, r1, 0xee01}, {@in=@broadcast, 0x4d2, 0xff}, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, {0x8, 0xffff, 0x1, 0xfffffffffffffffb, 0x100000001, 0x2, 0x0, 0xfffffffffffffff7}, {0x800, 0x45, 0x0, 0x4f5}, {0x7f, 0x1ff, 0x80000001}, 0x70bd27, 0x3507, 0x0, 0x5, 0x3}}, @replay_esn_val={0x2c, 0x17, {0x4, 0x70bd27, 0x70bd26, 0x70bd2c, 0x70bd28, 0xdd, [0x0, 0x80, 0x7, 0x7fff]}}, @sa={0xe4, 0x6, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4e21, 0x0, 0x4e22, 0x2, 0xa, 0xa0, 0xa0, 0x73, 0x0, r2}, {@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d2}, @in=@empty, {0x926, 0x1000000000, 0x0, 0x6, 0x6, 0x400, 0x7fff, 0x7fff}, {0x80200000000, 0x4, 0x3, 0x7}, {0xfffffff9, 0x8, 0x1}, 0x70bd2a, 0x34ff, 0xe, 0x3, 0x20, 0x8}}, @migrate={0x9c, 0x11, [{@in=@remote, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x22}, 0x3c, 0x1, 0x0, 0x3507, 0x2, 0x2}, {@in6=@rand_addr=' \x01\x00', @in6=@private1, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@local, 0x0, 0x3, 0x0, 0x3503, 0x5, 0xa}]}]}, 0x38c}}, 0x0) r3 = getuid() sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000001dc0)={&(0x7f0000001d00)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001d80)={&(0x7f0000001d40)={0x24, 0x0, 0x2, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20044014) io_uring_setup(0xd45, &(0x7f0000001e00)={0x0, 0x55b8, 0x20, 0x1, 0x345, 0x0, r0}) r4 = getuid() getsockname(r0, &(0x7f0000001e80)=@pppoe={0x18, 0x0, {0x0, @dev}}, &(0x7f0000001f00)=0x80) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001f40), 0x460800, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000002100)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000020c0)={&(0x7f0000001fc0)=@newae={0xec, 0x1e, 0x2, 0x70bd2a, 0x25dfdbfc, {{@in6=@private1, 0x4d2, 0x2, 0x6c}, @in=@remote, 0x1, 0x3502}, [@XFRMA_IF_ID={0x8}, @offload={0xc, 0x1c, {r1, 0x3}}, @coaddr={0x14, 0xe, @in6=@private1={0xfc, 0x1, '\x00', 0x1}}, @sec_ctx={0x78, 0x8, {0x74, 0x8, 0x0, 0xb5, 0x6c, "29f2fc7b9edaa483a53e3c62ad4f8442bc5d1ae8444c39aebb8fc8da1eb3db5d8947911d96ca2a1ccb0d2e786629af80393e980e3acaf2e01dce6f9d4372e29949521492d307deffd32c449a41b9c076287da6cf0cd80bc3dc8da027a812ecf76722069de6e6a5cb8973c64b"}}, @policy_type={0xa, 0x10, {0x1}}]}, 0xec}, 0x1, 0x0, 0x0, 0x20000081}, 0x4000045) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000002140), 0x201, 0x0) sendmsg$BATADV_CMD_SET_HARDIF(r6, &(0x7f0000002240)={&(0x7f0000002180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000002200)={&(0x7f00000021c0)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x7ff}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x24}}, 0x400c5) r7 = socket(0xb, 0x2, 0xfffffffe) setsockopt$inet_udp_int(r7, 0x11, 0x66, &(0x7f0000002280)=0x5, 0x4) ioctl$KDGETMODE(r5, 0x4b3b, &(0x7f00000022c0)) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_IP_IPSEC_POLICY(r8, 0x0, 0x10, &(0x7f00000024c0)={{{@in6, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@loopback}}, &(0x7f00000025c0)=0xe8) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000002880)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000002840)={&(0x7f00000026c0)=@acquire={0x150, 0x17, 0x300, 0x70bd2b, 0x25dfdbfb, {{@in6=@empty, 0x4d4, 0x32}, @in=@local, {@in6=@private2, @in6=@private0, 0x4e22, 0x3, 0x4e22, 0x0, 0x2, 0x80, 0xa0, 0xc, 0x0, r3}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast1, 0x4e20, 0x8, 0x4e24, 0x7c, 0x2, 0x0, 0x0, 0x87, r9, r4}, {0x451c, 0x8, 0x9, 0x38c, 0x4, 0x7, 0x42, 0x1ff}, {0x64, 0x100000001, 0x9, 0x4}, 0x7fffffff, 0x6e6bb0, 0x1, 0x0, 0x0, 0x2}, 0x7, 0x7ff, 0x80, 0x70bd2a}, [@encap={0x1c, 0x4, {0xfffffffffffffffd, 0x4e24, 0x4e20, @in6=@mcast2}}, @policy_type={0xa}]}, 0x150}, 0x1, 0x0, 0x0, 0x40004}, 0x90) 18:38:45 executing program 7: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c5603, 0x0) inotify_rm_watch(r0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$INOTIFY_IOC_SETNEXTWD(r0, 0x40044900, 0x81) r2 = add_key$user(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)="da56b852846eae45f571d4d1541cb7286f4805ad54222bfa09dccab7fc56f42c943849148bec0b9d1737ad3a040f0e70739b2adcb4e15f56b8bc4078958fad561aeecb13d7983b7aad63851856eea05d758008e34296f9a18d21a342587460acb2c9e41f081fc1f8809f6e214c8a6de2150883de239f54cd575a1b827c599e641a74be7187477e000282dc70aee729f6c861d251aa6ae0afb4fc394a700667de346a6688a550fbe2fd6ac17a8a8739ef0f37f45913e94a9dd97d0c3091716f5317b8f43004", 0xc5, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000240)={r2}, &(0x7f0000000280)=""/135, 0x87, 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x10, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0xf3ede8df4518c7cb}, 0xdcbbb0e381e754cf) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000440), 0x10300, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r3, 0x54a0) sysfs$2(0x2, 0x3, &(0x7f0000000480)=""/135) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0xb00, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0xc1}, 0x4000000) r4 = socket$inet(0x2, 0x800, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000000a80)={'syztnl2\x00', &(0x7f00000009c0)={'ip_vti0\x00', 0x0, 0x80, 0x90, 0xe87f, 0x402, {{0x1f, 0x4, 0x1, 0x39, 0x7c, 0x68, 0x0, 0x3, 0x4, 0x0, @private=0xa010100, @broadcast, {[@timestamp_prespec={0x44, 0x24, 0xf0, 0x3, 0xe, [{@remote, 0x3}, {@multicast2, 0x3}, {@multicast1, 0x2}, {@empty, 0xfffffffb}]}, @end, @lsrr={0x83, 0xb, 0xc3, [@empty, @multicast2]}, @ssrr={0x89, 0x17, 0x14, [@empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @rand_addr=0x64010100]}, @timestamp={0x44, 0x4, 0x2c, 0x0, 0x7}, @noop, @generic={0x7, 0xa, "29230576789ba6e2"}, @generic={0x44, 0x12, "972c27530c6df4e1fe81acfe01fce655"}]}}}}}) sysfs$2(0x2, 0x5, &(0x7f0000000ac0)=""/165) add_key$user(&(0x7f0000000b80), &(0x7f0000000bc0)={'syz', 0x2}, &(0x7f0000000c00)="c5e0ac485d0f2034e4902588851dc975334912f8794f6d3acdc0ecdefa8e3ed7c9fdc6a156020e387cd99cfa87feb42a46e4a1a39de8442361385404aafc013be71f4f418f5046d4b5bfe21689ff8002c0c3efcfbdf311d4ff0e56c4e42e299ac99a7f0c4ce0b647a7aeec7048c2543babdec02dc4fff917ecaa8cc0d0a2b41fab4bca1e1e8a0aaacb0193728a4d0456cc0e84ef6910bbe331c4c4584db0dd40ef928a02e2f0687e7bf5f2e36846", 0xae, 0xfffffffffffffffd) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000007240)={'ip_vti0\x00', &(0x7f0000007180)={'tunl0\x00', 0x0, 0x10, 0x700, 0x7, 0x2, {{0x27, 0x4, 0x1, 0x16, 0x9c, 0x66, 0x3f, 0x3, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x19}, @private=0xa010101, {[@lsrr={0x83, 0xb, 0xda, [@broadcast, @private=0xa010101]}, @generic={0x82, 0xb, "772eb28b84fac7a6ff"}, @ssrr={0x89, 0x13, 0x4f, [@rand_addr=0x64010101, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote]}, @timestamp_prespec={0x44, 0x1c, 0x6e, 0x3, 0x5, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x1f}, {@multicast1, 0x3}, {@loopback, 0x80000001}]}, @ra={0x94, 0x4}, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0x27, 0xd4, [@rand_addr=0x64010101, @broadcast, @multicast1, @broadcast, @dev={0xac, 0x14, 0x14, 0x3d}, @empty, @rand_addr=0x64010100, @multicast1, @multicast1]}, @lsrr={0x83, 0x13, 0xef, [@dev={0xac, 0x14, 0x14, 0x10}, @private=0xa010101, @local, @private=0xa010100]}]}}}}}) [ 91.565562] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 91.570369] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 91.572854] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 91.579385] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 91.586448] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 91.588976] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 91.638948] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 91.641846] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 91.644234] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 91.650199] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 91.652218] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 91.654003] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 91.656054] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 91.661028] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 91.664404] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 91.668351] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 91.669657] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 91.682134] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 91.686286] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 91.689977] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 91.691575] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 91.703966] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 91.710180] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 91.712157] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 91.717720] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 91.723542] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 91.735956] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 91.750653] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 91.754065] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 91.768161] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 91.776078] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 91.784130] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 91.788150] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 91.802203] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 91.805602] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 91.808487] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 91.814508] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 91.816466] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 91.821317] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 91.828217] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 91.843111] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 91.869132] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 91.871605] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 91.874327] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 91.876186] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 91.890147] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 91.911392] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 91.924134] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 93.652939] Bluetooth: hci0: command tx timeout [ 93.777871] Bluetooth: hci1: command tx timeout [ 93.778869] Bluetooth: hci3: command tx timeout [ 93.779031] Bluetooth: hci2: command tx timeout [ 93.842845] Bluetooth: hci4: command tx timeout [ 93.905814] Bluetooth: hci6: command tx timeout [ 93.969825] Bluetooth: hci7: command tx timeout [ 93.969918] Bluetooth: hci5: command tx timeout [ 95.698801] Bluetooth: hci0: command tx timeout [ 95.827735] Bluetooth: hci2: command tx timeout [ 95.828373] Bluetooth: hci3: command tx timeout [ 95.829025] Bluetooth: hci1: command tx timeout [ 95.889791] Bluetooth: hci4: command tx timeout [ 95.953845] Bluetooth: hci6: command tx timeout [ 96.017776] Bluetooth: hci7: command tx timeout [ 96.017815] Bluetooth: hci5: command tx timeout [ 97.746852] Bluetooth: hci0: command tx timeout [ 97.873885] Bluetooth: hci3: command tx timeout [ 97.874951] Bluetooth: hci1: command tx timeout [ 97.875149] Bluetooth: hci2: command tx timeout [ 97.937929] Bluetooth: hci4: command tx timeout [ 98.001820] Bluetooth: hci6: command tx timeout [ 98.066255] Bluetooth: hci5: command tx timeout [ 98.067385] Bluetooth: hci7: command tx timeout [ 99.795785] Bluetooth: hci0: command tx timeout [ 99.921838] Bluetooth: hci2: command tx timeout [ 99.924752] Bluetooth: hci1: command tx timeout [ 99.925513] Bluetooth: hci3: command tx timeout [ 99.985826] Bluetooth: hci4: command tx timeout [ 100.049802] Bluetooth: hci6: command tx timeout [ 100.113997] Bluetooth: hci5: command tx timeout [ 100.114766] Bluetooth: hci7: command tx timeout [ 151.374196] syz-executor.7 (279) used greatest stack depth: 23296 bytes left [ 153.892575] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 153.896211] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 153.898750] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 153.904486] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 153.907914] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 153.910440] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 153.952395] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 153.960172] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 153.966057] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 153.970802] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 153.980242] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 153.984759] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 153.989263] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 154.006872] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 154.011615] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 154.035134] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 154.041777] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 154.052097] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 154.101190] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 154.103763] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 154.110971] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 154.111818] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 154.120886] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 154.122140] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 154.130446] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 154.132563] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 154.132824] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 154.137601] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 154.140055] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 154.141932] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 154.152209] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 154.157493] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 154.161015] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 154.162501] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 154.170540] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 154.171377] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 154.178930] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 154.179598] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 154.180395] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 154.197192] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 154.199402] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 154.205181] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 154.210317] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 154.212222] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 154.216502] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 154.241936] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 154.245964] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 154.247002] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 155.985800] Bluetooth: hci0: command tx timeout [ 156.049753] Bluetooth: hci1: command tx timeout [ 156.177768] Bluetooth: hci2: command tx timeout [ 156.241926] Bluetooth: hci5: command tx timeout [ 156.242168] Bluetooth: hci3: command tx timeout [ 156.242857] Bluetooth: hci4: command tx timeout [ 156.243693] Bluetooth: hci6: command tx timeout [ 156.371734] Bluetooth: hci7: command tx timeout [ 158.033772] Bluetooth: hci0: command tx timeout [ 158.098796] Bluetooth: hci1: command tx timeout [ 158.226005] Bluetooth: hci2: command tx timeout [ 158.290779] Bluetooth: hci5: command tx timeout [ 158.291279] Bluetooth: hci4: command tx timeout [ 158.291825] Bluetooth: hci6: command tx timeout [ 158.292263] Bluetooth: hci3: command tx timeout [ 158.417867] Bluetooth: hci7: command tx timeout [ 160.081859] Bluetooth: hci0: command tx timeout [ 160.145979] Bluetooth: hci1: command tx timeout [ 160.273831] Bluetooth: hci2: command tx timeout [ 160.337919] Bluetooth: hci3: command tx timeout [ 160.338116] Bluetooth: hci6: command tx timeout [ 160.338915] Bluetooth: hci4: command tx timeout [ 160.339582] Bluetooth: hci5: command tx timeout [ 160.466011] Bluetooth: hci7: command tx timeout [ 162.129845] Bluetooth: hci0: command tx timeout [ 162.194806] Bluetooth: hci1: command tx timeout [ 162.321880] Bluetooth: hci2: command tx timeout [ 162.386789] Bluetooth: hci4: command tx timeout [ 162.387484] Bluetooth: hci5: command tx timeout [ 162.388217] Bluetooth: hci6: command tx timeout [ 162.388943] Bluetooth: hci3: command tx timeout [ 162.514575] Bluetooth: hci7: command tx timeout [ 216.224020] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 216.230414] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 216.237482] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 216.242913] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 216.246267] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 216.248230] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 216.505883] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 216.511610] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 216.516471] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 216.520774] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 216.525144] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 216.532023] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 216.548808] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 216.565302] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 216.567693] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 216.572456] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 216.575235] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 216.577215] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 216.611713] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 216.624111] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 216.630033] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 216.642444] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 216.657404] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 216.662070] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 216.669879] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 216.671458] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 216.679127] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 216.681348] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 216.690041] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 216.695308] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 216.699510] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 216.702032] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 216.703788] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 216.705835] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 216.710752] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 216.713120] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 216.713758] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 216.724858] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 216.732207] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 216.744085] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 216.760228] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 216.764204] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 216.765873] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 216.776273] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 216.786076] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 216.795338] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 216.809863] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 216.811347] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 218.321886] Bluetooth: hci0: command tx timeout [ 218.578954] Bluetooth: hci1: command tx timeout [ 218.642706] Bluetooth: hci2: command tx timeout [ 218.833799] Bluetooth: hci3: command tx timeout [ 218.834911] Bluetooth: hci7: command tx timeout [ 218.898756] Bluetooth: hci4: command tx timeout [ 218.899589] Bluetooth: hci5: command tx timeout [ 218.961805] Bluetooth: hci6: command tx timeout [ 220.369818] Bluetooth: hci0: command tx timeout [ 220.626349] Bluetooth: hci1: command tx timeout [ 220.689747] Bluetooth: hci2: command tx timeout [ 220.882118] Bluetooth: hci3: command tx timeout [ 220.882623] Bluetooth: hci7: command tx timeout [ 220.945779] Bluetooth: hci5: command tx timeout [ 220.946243] Bluetooth: hci4: command tx timeout [ 221.010231] Bluetooth: hci6: command tx timeout [ 222.418727] Bluetooth: hci0: command tx timeout [ 222.673925] Bluetooth: hci1: command tx timeout [ 222.738703] Bluetooth: hci2: command tx timeout [ 222.929861] Bluetooth: hci7: command tx timeout [ 222.930416] Bluetooth: hci3: command tx timeout [ 222.993857] Bluetooth: hci4: command tx timeout [ 222.994444] Bluetooth: hci5: command tx timeout [ 223.057789] Bluetooth: hci6: command tx timeout [ 224.467701] Bluetooth: hci0: command tx timeout [ 224.721861] Bluetooth: hci1: command tx timeout [ 224.785711] Bluetooth: hci2: command tx timeout [ 224.977913] Bluetooth: hci3: command tx timeout [ 224.978413] Bluetooth: hci7: command tx timeout [ 225.041778] Bluetooth: hci5: command tx timeout [ 225.042276] Bluetooth: hci4: command tx timeout [ 225.105775] Bluetooth: hci6: command tx timeout [ 278.110494] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 278.112068] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 278.118343] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 278.126236] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 278.132063] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 278.133955] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 278.236945] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 278.240527] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 278.243271] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 278.244514] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 278.246973] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 278.248807] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 278.251583] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 278.253393] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 278.254748] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 278.264869] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 278.273934] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 278.277105] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 278.311438] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 278.328106] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 278.333116] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 278.351886] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 278.359373] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 278.371188] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 278.372954] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 278.375993] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 278.408079] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 278.415737] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 278.421408] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 278.422686] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 278.462238] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 278.467490] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 278.500383] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 278.501984] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 278.505942] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 278.511015] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 278.512441] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 278.513610] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 278.514863] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 278.516339] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 278.518098] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 278.519260] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 278.520238] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 278.545955] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 278.552906] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 278.604569] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 278.607794] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 278.611775] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 280.210997] Bluetooth: hci0: command tx timeout [ 280.273746] Bluetooth: hci2: command tx timeout [ 280.338202] Bluetooth: hci1: command tx timeout [ 280.465886] Bluetooth: hci4: command tx timeout [ 280.466759] Bluetooth: hci3: command tx timeout [ 280.595493] Bluetooth: hci5: command tx timeout [ 280.595505] Bluetooth: hci7: command tx timeout [ 280.658681] Bluetooth: hci6: command tx timeout [ 282.257735] Bluetooth: hci0: command tx timeout [ 282.321759] Bluetooth: hci2: command tx timeout [ 282.385694] Bluetooth: hci1: command tx timeout [ 282.513806] Bluetooth: hci3: command tx timeout [ 282.516754] Bluetooth: hci4: command tx timeout [ 282.641838] Bluetooth: hci5: command tx timeout [ 282.642844] Bluetooth: hci7: command tx timeout [ 282.705745] Bluetooth: hci6: command tx timeout [ 284.306723] Bluetooth: hci0: command tx timeout [ 284.370918] Bluetooth: hci2: command tx timeout [ 284.433699] Bluetooth: hci1: command tx timeout [ 284.561876] Bluetooth: hci4: command tx timeout [ 284.562360] Bluetooth: hci3: command tx timeout [ 284.689703] Bluetooth: hci7: command tx timeout [ 284.689719] Bluetooth: hci5: command tx timeout [ 284.753959] Bluetooth: hci6: command tx timeout [ 286.355667] Bluetooth: hci0: command tx timeout [ 286.417723] Bluetooth: hci2: command tx timeout [ 286.481676] Bluetooth: hci1: command tx timeout [ 286.609775] Bluetooth: hci3: command tx timeout [ 286.609841] Bluetooth: hci4: command tx timeout [ 286.737719] Bluetooth: hci5: command tx timeout [ 286.738837] Bluetooth: hci7: command tx timeout [ 286.802503] Bluetooth: hci6: command tx timeout [ 334.646887] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 334.647591] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 334.812892] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 334.813555] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 335.091703] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 335.092382] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 335.384359] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 335.385130] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 335.735106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 335.735939] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 335.913408] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 335.914128] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.038699] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.039303] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.151675] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.152305] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.277160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.277933] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.406078] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 336.439713] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.440386] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 18:42:51 executing program 4: ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000000)={0x0, 0x9559, 0x80, 0x3, 0xb, "659299cfe826356c"}) ioctl$TIOCGRS485(0xffffffffffffffff, 0x542e, &(0x7f0000000040)) r0 = syz_open_pts(0xffffffffffffffff, 0x10000) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000080)) clock_settime(0x5, &(0x7f00000000c0)={0x77359400}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000100)) ioctl$TIOCGPTLCK(r0, 0x80045439, &(0x7f0000000140)) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000180)={0x4, 0x9b, 0x101, 0x20, 0x12, "c18eddcb2377d957"}) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f00000001c0)={0x81, 0x2, 0x7f, 0x0, 0xf8, "f556d53d1f88f705d388c47b41c1e209b29f0e", 0xff, 0x5}) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x18) inotify_rm_watch(0xffffffffffffffff, r2) ioctl$KDFONTOP_COPY(r1, 0x4b72, &(0x7f0000000640)={0x3, 0x0, 0x5, 0x2, 0x1b9, &(0x7f0000000240)}) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000680)={0xe26, 0x2, 0xb33, 0x3, 0x3, 0x4}) ioctl$KDFONTOP_COPY(r0, 0x4b72, &(0x7f0000000ac0)={0x3, 0x1, 0x14, 0x2, 0x1fc, &(0x7f00000006c0)}) inotify_init() r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSERIAL(r3, 0x541e, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)=""/77}) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000000c00)) prctl$PR_SET_FPEXC(0xc, 0x20000) 18:42:51 executing program 4: ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000000)={0x0, 0x9559, 0x80, 0x3, 0xb, "659299cfe826356c"}) ioctl$TIOCGRS485(0xffffffffffffffff, 0x542e, &(0x7f0000000040)) r0 = syz_open_pts(0xffffffffffffffff, 0x10000) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000080)) clock_settime(0x5, &(0x7f00000000c0)={0x77359400}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000100)) ioctl$TIOCGPTLCK(r0, 0x80045439, &(0x7f0000000140)) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000180)={0x4, 0x9b, 0x101, 0x20, 0x12, "c18eddcb2377d957"}) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f00000001c0)={0x81, 0x2, 0x7f, 0x0, 0xf8, "f556d53d1f88f705d388c47b41c1e209b29f0e", 0xff, 0x5}) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x18) inotify_rm_watch(0xffffffffffffffff, r2) ioctl$KDFONTOP_COPY(r1, 0x4b72, &(0x7f0000000640)={0x3, 0x0, 0x5, 0x2, 0x1b9, &(0x7f0000000240)}) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000680)={0xe26, 0x2, 0xb33, 0x3, 0x3, 0x4}) ioctl$KDFONTOP_COPY(r0, 0x4b72, &(0x7f0000000ac0)={0x3, 0x1, 0x14, 0x2, 0x1fc, &(0x7f00000006c0)}) inotify_init() r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSERIAL(r3, 0x541e, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)=""/77}) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000000c00)) prctl$PR_SET_FPEXC(0xc, 0x20000) 18:42:51 executing program 6: recvmmsg(0xffffffffffffffff, &(0x7f0000001780)=[{{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000000000)=""/4096, 0x1000}, {&(0x7f0000001000)=""/197, 0xc5}, {&(0x7f0000001100)=""/44, 0x2c}, {&(0x7f0000001140)=""/235, 0xeb}, {&(0x7f0000001240)=""/62, 0x3e}, {&(0x7f0000001280)=""/226, 0xe2}], 0x6, &(0x7f0000001400)=""/215, 0xd7}, 0xc}, {{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000001500)=""/12, 0xc}, {&(0x7f0000001540)=""/247, 0xf7}], 0x2, &(0x7f0000001680)=""/237, 0xed}, 0x3}], 0x2, 0x10000, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001800), 0x10000, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000001880)={'batadv_slave_0\x00', 0x0}) r2 = getuid() sendmsg$nl_xfrm(r0, &(0x7f0000001cc0)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0xa55c858654fa89ee}, 0xc, &(0x7f0000001c80)={&(0x7f00000018c0)=@newsa={0x38c, 0x10, 0x20, 0x70bd25, 0x25dfdbfb, {{@in6=@loopback, @in6=@empty, 0x4e20, 0x2, 0x4e22, 0x7, 0xa, 0xa0, 0x20, 0x2b}, {@in6=@private0, 0x4d4, 0x6c}, @in=@multicast1, {0xd5, 0x8, 0x401, 0x0, 0x81, 0x2e63, 0x7, 0x7}, {0x7fff, 0x5, 0x74a3, 0x100000001}, {0x6, 0xaf6, 0x7f}, 0x70bd29, 0x3504, 0xa, 0x3, 0x6, 0x62}, [@lastused={0xc, 0xf, 0x8001}, @sa={0xe4, 0x6, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@broadcast, 0x4e24, 0x4, 0x4e23, 0x8, 0xa, 0x40, 0xc0, 0x33, r1, 0xee01}, {@in=@broadcast, 0x4d2, 0xff}, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, {0x8, 0xffff, 0x1, 0xfffffffffffffffb, 0x100000001, 0x2, 0x0, 0xfffffffffffffff7}, {0x800, 0x45, 0x0, 0x4f5}, {0x7f, 0x1ff, 0x80000001}, 0x70bd27, 0x3507, 0x0, 0x5, 0x3}}, @replay_esn_val={0x2c, 0x17, {0x4, 0x70bd27, 0x70bd26, 0x70bd2c, 0x70bd28, 0xdd, [0x0, 0x80, 0x7, 0x7fff]}}, @sa={0xe4, 0x6, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4e21, 0x0, 0x4e22, 0x2, 0xa, 0xa0, 0xa0, 0x73, 0x0, r2}, {@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d2}, @in=@empty, {0x926, 0x1000000000, 0x0, 0x6, 0x6, 0x400, 0x7fff, 0x7fff}, {0x80200000000, 0x4, 0x3, 0x7}, {0xfffffff9, 0x8, 0x1}, 0x70bd2a, 0x34ff, 0xe, 0x3, 0x20, 0x8}}, @migrate={0x9c, 0x11, [{@in=@remote, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x22}, 0x3c, 0x1, 0x0, 0x3507, 0x2, 0x2}, {@in6=@rand_addr=' \x01\x00', @in6=@private1, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@local, 0x0, 0x3, 0x0, 0x3503, 0x5, 0xa}]}]}, 0x38c}}, 0x0) r3 = getuid() sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000001dc0)={&(0x7f0000001d00)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001d80)={&(0x7f0000001d40)={0x24, 0x0, 0x2, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20044014) io_uring_setup(0xd45, &(0x7f0000001e00)={0x0, 0x55b8, 0x20, 0x1, 0x345, 0x0, r0}) r4 = getuid() getsockname(r0, &(0x7f0000001e80)=@pppoe={0x18, 0x0, {0x0, @dev}}, &(0x7f0000001f00)=0x80) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001f40), 0x460800, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000002100)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000020c0)={&(0x7f0000001fc0)=@newae={0xec, 0x1e, 0x2, 0x70bd2a, 0x25dfdbfc, {{@in6=@private1, 0x4d2, 0x2, 0x6c}, @in=@remote, 0x1, 0x3502}, [@XFRMA_IF_ID={0x8}, @offload={0xc, 0x1c, {r1, 0x3}}, @coaddr={0x14, 0xe, @in6=@private1={0xfc, 0x1, '\x00', 0x1}}, @sec_ctx={0x78, 0x8, {0x74, 0x8, 0x0, 0xb5, 0x6c, "29f2fc7b9edaa483a53e3c62ad4f8442bc5d1ae8444c39aebb8fc8da1eb3db5d8947911d96ca2a1ccb0d2e786629af80393e980e3acaf2e01dce6f9d4372e29949521492d307deffd32c449a41b9c076287da6cf0cd80bc3dc8da027a812ecf76722069de6e6a5cb8973c64b"}}, @policy_type={0xa, 0x10, {0x1}}]}, 0xec}, 0x1, 0x0, 0x0, 0x20000081}, 0x4000045) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000002140), 0x201, 0x0) sendmsg$BATADV_CMD_SET_HARDIF(r6, &(0x7f0000002240)={&(0x7f0000002180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000002200)={&(0x7f00000021c0)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x7ff}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x24}}, 0x400c5) r7 = socket(0xb, 0x2, 0xfffffffe) setsockopt$inet_udp_int(r7, 0x11, 0x66, &(0x7f0000002280)=0x5, 0x4) ioctl$KDGETMODE(r5, 0x4b3b, &(0x7f00000022c0)) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_IP_IPSEC_POLICY(r8, 0x0, 0x10, &(0x7f00000024c0)={{{@in6, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@loopback}}, &(0x7f00000025c0)=0xe8) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000002880)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000002840)={&(0x7f00000026c0)=@acquire={0x150, 0x17, 0x300, 0x70bd2b, 0x25dfdbfb, {{@in6=@empty, 0x4d4, 0x32}, @in=@local, {@in6=@private2, @in6=@private0, 0x4e22, 0x3, 0x4e22, 0x0, 0x2, 0x80, 0xa0, 0xc, 0x0, r3}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast1, 0x4e20, 0x8, 0x4e24, 0x7c, 0x2, 0x0, 0x0, 0x87, r9, r4}, {0x451c, 0x8, 0x9, 0x38c, 0x4, 0x7, 0x42, 0x1ff}, {0x64, 0x100000001, 0x9, 0x4}, 0x7fffffff, 0x6e6bb0, 0x1, 0x0, 0x0, 0x2}, 0x7, 0x7ff, 0x80, 0x70bd2a}, [@encap={0x1c, 0x4, {0xfffffffffffffffd, 0x4e24, 0x4e20, @in6=@mcast2}}, @policy_type={0xa}]}, 0x150}, 0x1, 0x0, 0x0, 0x40004}, 0x90) [ 336.586669] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.587282] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 18:42:51 executing program 4: ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000000)={0x0, 0x9559, 0x80, 0x3, 0xb, "659299cfe826356c"}) ioctl$TIOCGRS485(0xffffffffffffffff, 0x542e, &(0x7f0000000040)) r0 = syz_open_pts(0xffffffffffffffff, 0x10000) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000080)) clock_settime(0x5, &(0x7f00000000c0)={0x77359400}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000100)) ioctl$TIOCGPTLCK(r0, 0x80045439, &(0x7f0000000140)) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000180)={0x4, 0x9b, 0x101, 0x20, 0x12, "c18eddcb2377d957"}) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f00000001c0)={0x81, 0x2, 0x7f, 0x0, 0xf8, "f556d53d1f88f705d388c47b41c1e209b29f0e", 0xff, 0x5}) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x18) inotify_rm_watch(0xffffffffffffffff, r2) ioctl$KDFONTOP_COPY(r1, 0x4b72, &(0x7f0000000640)={0x3, 0x0, 0x5, 0x2, 0x1b9, &(0x7f0000000240)}) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000680)={0xe26, 0x2, 0xb33, 0x3, 0x3, 0x4}) ioctl$KDFONTOP_COPY(r0, 0x4b72, &(0x7f0000000ac0)={0x3, 0x1, 0x14, 0x2, 0x1fc, &(0x7f00000006c0)}) inotify_init() r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSERIAL(r3, 0x541e, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)=""/77}) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000000c00)) prctl$PR_SET_FPEXC(0xc, 0x20000) [ 336.710263] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.711059] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 18:42:51 executing program 4: ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000000)={0x0, 0x9559, 0x80, 0x3, 0xb, "659299cfe826356c"}) ioctl$TIOCGRS485(0xffffffffffffffff, 0x542e, &(0x7f0000000040)) r0 = syz_open_pts(0xffffffffffffffff, 0x10000) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000080)) clock_settime(0x5, &(0x7f00000000c0)={0x77359400}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000100)) ioctl$TIOCGPTLCK(r0, 0x80045439, &(0x7f0000000140)) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000180)={0x4, 0x9b, 0x101, 0x20, 0x12, "c18eddcb2377d957"}) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f00000001c0)={0x81, 0x2, 0x7f, 0x0, 0xf8, "f556d53d1f88f705d388c47b41c1e209b29f0e", 0xff, 0x5}) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x18) inotify_rm_watch(0xffffffffffffffff, r2) ioctl$KDFONTOP_COPY(r1, 0x4b72, &(0x7f0000000640)={0x3, 0x0, 0x5, 0x2, 0x1b9, &(0x7f0000000240)}) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000680)={0xe26, 0x2, 0xb33, 0x3, 0x3, 0x4}) ioctl$KDFONTOP_COPY(r0, 0x4b72, &(0x7f0000000ac0)={0x3, 0x1, 0x14, 0x2, 0x1fc, &(0x7f00000006c0)}) inotify_init() r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSERIAL(r3, 0x541e, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)=""/77}) prctl$PR_SET_FPEXC(0xc, 0x20000) 18:42:51 executing program 6: recvmmsg(0xffffffffffffffff, &(0x7f0000001780)=[{{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000000000)=""/4096, 0x1000}, {&(0x7f0000001000)=""/197, 0xc5}, {&(0x7f0000001100)=""/44, 0x2c}, {&(0x7f0000001140)=""/235, 0xeb}, {&(0x7f0000001240)=""/62, 0x3e}, {&(0x7f0000001280)=""/226, 0xe2}], 0x6, &(0x7f0000001400)=""/215, 0xd7}, 0xc}, {{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000001500)=""/12, 0xc}, {&(0x7f0000001540)=""/247, 0xf7}], 0x2, &(0x7f0000001680)=""/237, 0xed}, 0x3}], 0x2, 0x10000, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001800), 0x10000, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000001880)={'batadv_slave_0\x00', 0x0}) r2 = getuid() sendmsg$nl_xfrm(r0, &(0x7f0000001cc0)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0xa55c858654fa89ee}, 0xc, &(0x7f0000001c80)={&(0x7f00000018c0)=@newsa={0x38c, 0x10, 0x20, 0x70bd25, 0x25dfdbfb, {{@in6=@loopback, @in6=@empty, 0x4e20, 0x2, 0x4e22, 0x7, 0xa, 0xa0, 0x20, 0x2b}, {@in6=@private0, 0x4d4, 0x6c}, @in=@multicast1, {0xd5, 0x8, 0x401, 0x0, 0x81, 0x2e63, 0x7, 0x7}, {0x7fff, 0x5, 0x74a3, 0x100000001}, {0x6, 0xaf6, 0x7f}, 0x70bd29, 0x3504, 0xa, 0x3, 0x6, 0x62}, [@lastused={0xc, 0xf, 0x8001}, @sa={0xe4, 0x6, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@broadcast, 0x4e24, 0x4, 0x4e23, 0x8, 0xa, 0x40, 0xc0, 0x33, r1, 0xee01}, {@in=@broadcast, 0x4d2, 0xff}, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, {0x8, 0xffff, 0x1, 0xfffffffffffffffb, 0x100000001, 0x2, 0x0, 0xfffffffffffffff7}, {0x800, 0x45, 0x0, 0x4f5}, {0x7f, 0x1ff, 0x80000001}, 0x70bd27, 0x3507, 0x0, 0x5, 0x3}}, @replay_esn_val={0x2c, 0x17, {0x4, 0x70bd27, 0x70bd26, 0x70bd2c, 0x70bd28, 0xdd, [0x0, 0x80, 0x7, 0x7fff]}}, @sa={0xe4, 0x6, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4e21, 0x0, 0x4e22, 0x2, 0xa, 0xa0, 0xa0, 0x73, 0x0, r2}, {@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d2}, @in=@empty, {0x926, 0x1000000000, 0x0, 0x6, 0x6, 0x400, 0x7fff, 0x7fff}, {0x80200000000, 0x4, 0x3, 0x7}, {0xfffffff9, 0x8, 0x1}, 0x70bd2a, 0x34ff, 0xe, 0x3, 0x20, 0x8}}, @migrate={0x9c, 0x11, [{@in=@remote, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x22}, 0x3c, 0x1, 0x0, 0x3507, 0x2, 0x2}, {@in6=@rand_addr=' \x01\x00', @in6=@private1, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@local, 0x0, 0x3, 0x0, 0x3503, 0x5, 0xa}]}]}, 0x38c}}, 0x0) r3 = getuid() sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000001dc0)={&(0x7f0000001d00)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001d80)={&(0x7f0000001d40)={0x24, 0x0, 0x2, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20044014) io_uring_setup(0xd45, &(0x7f0000001e00)={0x0, 0x55b8, 0x20, 0x1, 0x345, 0x0, r0}) r4 = getuid() getsockname(r0, &(0x7f0000001e80)=@pppoe={0x18, 0x0, {0x0, @dev}}, &(0x7f0000001f00)=0x80) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001f40), 0x460800, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000002100)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000020c0)={&(0x7f0000001fc0)=@newae={0xec, 0x1e, 0x2, 0x70bd2a, 0x25dfdbfc, {{@in6=@private1, 0x4d2, 0x2, 0x6c}, @in=@remote, 0x1, 0x3502}, [@XFRMA_IF_ID={0x8}, @offload={0xc, 0x1c, {r1, 0x3}}, @coaddr={0x14, 0xe, @in6=@private1={0xfc, 0x1, '\x00', 0x1}}, @sec_ctx={0x78, 0x8, {0x74, 0x8, 0x0, 0xb5, 0x6c, "29f2fc7b9edaa483a53e3c62ad4f8442bc5d1ae8444c39aebb8fc8da1eb3db5d8947911d96ca2a1ccb0d2e786629af80393e980e3acaf2e01dce6f9d4372e29949521492d307deffd32c449a41b9c076287da6cf0cd80bc3dc8da027a812ecf76722069de6e6a5cb8973c64b"}}, @policy_type={0xa, 0x10, {0x1}}]}, 0xec}, 0x1, 0x0, 0x0, 0x20000081}, 0x4000045) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000002140), 0x201, 0x0) sendmsg$BATADV_CMD_SET_HARDIF(r6, &(0x7f0000002240)={&(0x7f0000002180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000002200)={&(0x7f00000021c0)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x7ff}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x24}}, 0x400c5) r7 = socket(0xb, 0x2, 0xfffffffe) setsockopt$inet_udp_int(r7, 0x11, 0x66, &(0x7f0000002280)=0x5, 0x4) ioctl$KDGETMODE(r5, 0x4b3b, &(0x7f00000022c0)) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_IP_IPSEC_POLICY(r8, 0x0, 0x10, &(0x7f00000024c0)={{{@in6, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@loopback}}, &(0x7f00000025c0)=0xe8) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000002880)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000002840)={&(0x7f00000026c0)=@acquire={0x150, 0x17, 0x300, 0x70bd2b, 0x25dfdbfb, {{@in6=@empty, 0x4d4, 0x32}, @in=@local, {@in6=@private2, @in6=@private0, 0x4e22, 0x3, 0x4e22, 0x0, 0x2, 0x80, 0xa0, 0xc, 0x0, r3}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast1, 0x4e20, 0x8, 0x4e24, 0x7c, 0x2, 0x0, 0x0, 0x87, r9, r4}, {0x451c, 0x8, 0x9, 0x38c, 0x4, 0x7, 0x42, 0x1ff}, {0x64, 0x100000001, 0x9, 0x4}, 0x7fffffff, 0x6e6bb0, 0x1, 0x0, 0x0, 0x2}, 0x7, 0x7ff, 0x80, 0x70bd2a}, [@encap={0x1c, 0x4, {0xfffffffffffffffd, 0x4e24, 0x4e20, @in6=@mcast2}}, @policy_type={0xa}]}, 0x150}, 0x1, 0x0, 0x0, 0x40004}, 0x90) [ 336.877075] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.877773] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 18:42:51 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f0000000000)={{0x2, 0x2, 0x1, 0x3, 0x80000000}, 0x6, 0x4, 'id0\x00', 'timer1\x00', 0x0, 0xfffffffffffffff7, 0x2, 0x5, 0x9}) setsockopt$inet_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) ioctl$TIOCGPTLCK(0xffffffffffffffff, 0x80045439, &(0x7f0000000140)) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000180)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x204000, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000280)={'syztnl0\x00', &(0x7f0000000200)={'syztnl0\x00', 0x0, 0x700, 0x7800, 0x6, 0xffff8674, {{0x10, 0x4, 0x3, 0x9, 0x40, 0x65, 0x0, 0x74, 0x29, 0x0, @multicast2, @loopback, {[@timestamp={0x44, 0x18, 0x82, 0x0, 0x5, [0x7fff, 0x0, 0x6, 0x80, 0x0]}, @timestamp={0x44, 0x14, 0xf2, 0x0, 0x6, [0x9, 0x8, 0x1, 0x8000]}]}}}}}) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000002c0)={0x3, 0x2, 0xb2, 0x3, 0x1}) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x41, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000340)={{0xffffffffffffffff, 0x3, 0x9, 0x2, 0x80000001}}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000380), 0x4000, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000003c0)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000400)={0x3, 0x2, 0x3, 0x1, 0x9}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000440)={{0x2, 0x1, 0x8, 0x3, 0xffff}}) ioctl$TIOCNXCL(r2, 0x540d) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000480)={{0x0, 0x3, 0x2, 0x7ca0e2d1ce49b278, 0xf518}, 0x5, 0x5, 'id1\x00', 'timer1\x00', 0x0, 0xf6a4, 0x5, 0xffffffffffffff2e, 0x5}) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000580), 0x2000) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r3, 0x54a3) 18:42:51 executing program 4: ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000000)={0x0, 0x9559, 0x80, 0x3, 0xb, "659299cfe826356c"}) ioctl$TIOCGRS485(0xffffffffffffffff, 0x542e, &(0x7f0000000040)) r0 = syz_open_pts(0xffffffffffffffff, 0x10000) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000080)) clock_settime(0x5, &(0x7f00000000c0)={0x77359400}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000100)) ioctl$TIOCGPTLCK(r0, 0x80045439, &(0x7f0000000140)) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000180)={0x4, 0x9b, 0x101, 0x20, 0x12, "c18eddcb2377d957"}) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f00000001c0)={0x81, 0x2, 0x7f, 0x0, 0xf8, "f556d53d1f88f705d388c47b41c1e209b29f0e", 0xff, 0x5}) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x18) inotify_rm_watch(0xffffffffffffffff, r2) ioctl$KDFONTOP_COPY(r1, 0x4b72, &(0x7f0000000640)={0x3, 0x0, 0x5, 0x2, 0x1b9, &(0x7f0000000240)}) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000680)={0xe26, 0x2, 0xb33, 0x3, 0x3, 0x4}) ioctl$KDFONTOP_COPY(r0, 0x4b72, &(0x7f0000000ac0)={0x3, 0x1, 0x14, 0x2, 0x1fc, &(0x7f00000006c0)}) inotify_init() syz_open_dev$tty20(0xc, 0x4, 0x0) prctl$PR_SET_FPEXC(0xc, 0x20000) [ 337.026727] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 337.027407] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 337.202054] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 337.202795] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 337.374749] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 337.375422] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 337.687708] [ 337.687945] ====================================================== [ 337.688451] WARNING: possible circular locking dependency detected [ 337.688969] 6.13.0-next-20250124 #1 Not tainted [ 337.689357] ------------------------------------------------------ [ 337.689865] kworker/u8:2/13567 is trying to acquire lock: [ 337.693302] ffffffff8621d8e8 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x1612/0x1c80 [ 337.694176] [ 337.694176] but task is already holding lock: [ 337.694668] ffff8880361e8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf2/0x6b0 [ 337.695499] [ 337.695499] which lock already depends on the new lock. [ 337.695499] [ 337.696157] [ 337.696157] the existing dependency chain (in reverse order) is: [ 337.696767] [ 337.696767] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 337.697323] __mutex_lock+0x13d/0xb50 [ 337.697722] wiphy_register+0x1b2e/0x25d0 [ 337.698141] ieee80211_register_hw+0x23a4/0x3d60 [ 337.698601] mac80211_hwsim_new_radio+0x2759/0x4d60 [ 337.699089] init_mac80211_hwsim+0x389/0x870 [ 337.699536] do_one_initcall+0xf9/0x640 [ 337.699956] kernel_init_freeable+0x53d/0x7a0 [ 337.700407] kernel_init+0x1e/0x2d0 [ 337.700768] ret_from_fork+0x48/0x80 [ 337.701136] ret_from_fork_asm+0x1a/0x30 [ 337.701561] [ 337.701561] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 337.702080] __lock_acquire+0x29fd/0x4580 [ 337.702494] lock_acquire+0x19b/0x520 [ 337.702879] __mutex_lock+0x13d/0xb50 [ 337.703269] unregister_netdevice_many_notify+0x1612/0x1c80 [ 337.703797] unregister_netdevice_queue+0x224/0x2e0 [ 337.704277] _cfg80211_unregister_wdev+0x57b/0x700 [ 337.704757] ieee80211_remove_interfaces+0x2f2/0x6b0 [ 337.705227] ieee80211_unregister_hw+0x55/0x3a0 [ 337.705682] hwsim_exit_net+0x3a0/0x730 [ 337.706082] ops_exit_list+0xb3/0x180 [ 337.706476] cleanup_net+0x546/0xad0 [ 337.706858] process_one_work+0x8ee/0x1a10 [ 337.707311] worker_thread+0x674/0xe70 [ 337.707718] kthread+0x3ab/0x720 [ 337.708096] ret_from_fork+0x48/0x80 [ 337.708462] ret_from_fork_asm+0x1a/0x30 [ 337.708882] [ 337.708882] other info that might help us debug this: [ 337.708882] [ 337.709519] Possible unsafe locking scenario: [ 337.709519] [ 337.710008] CPU0 CPU1 [ 337.710385] ---- ---- [ 337.710765] lock(&rdev->wiphy.mtx); [ 337.711107] lock(rtnl_mutex); [ 337.711595] lock(&rdev->wiphy.mtx); [ 337.712126] lock(rtnl_mutex); [ 337.712432] [ 337.712432] *** DEADLOCK *** [ 337.712432] [ 337.712922] 4 locks held by kworker/u8:2/13567: [ 337.713315] #0: ffff888008fdb948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12b6/0x1a10 [ 337.714189] #1: ffff88800d81fd30 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x861/0x1a10 [ 337.715038] #2: ffffffff86211910 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xca/0xad0 [ 337.715810] #3: ffff8880361e8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf2/0x6b0 [ 337.716683] [ 337.716683] stack backtrace: [ 337.717060] CPU: 0 UID: 0 PID: 13567 Comm: kworker/u8:2 Not tainted 6.13.0-next-20250124 #1 [ 337.717098] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 337.717120] Workqueue: netns cleanup_net [ 337.717161] Call Trace: [ 337.717172] [ 337.717183] dump_stack_lvl+0xca/0x120 [ 337.717242] print_circular_bug+0x47b/0x750 [ 337.717288] check_noncircular+0x2e9/0x3c0 [ 337.717330] ? __pfx_check_noncircular+0x10/0x10 [ 337.717373] ? hlock_class+0x4e/0x130 [ 337.717403] ? srso_return_thunk+0x5/0x5f [ 337.717458] ? mark_lock+0xac/0xed0 [ 337.717502] ? lockdep_lock+0xba/0x1b0 [ 337.717559] ? __pfx_lockdep_lock+0x10/0x10 [ 337.717622] __lock_acquire+0x29fd/0x4580 [ 337.717676] ? __pfx___lock_acquire+0x10/0x10 [ 337.717719] ? lock_release+0x20f/0x6f0 [ 337.717763] ? __pfx_lock_release+0x10/0x10 [ 337.717806] ? srso_return_thunk+0x5/0x5f [ 337.717865] lock_acquire+0x19b/0x520 [ 337.717908] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 337.717957] ? __pfx_lock_acquire+0x10/0x10 [ 337.718002] ? __pfx_lock_release+0x10/0x10 [ 337.718045] ? __pfx_try_to_wake_up+0x10/0x10 [ 337.718088] ? srso_return_thunk+0x5/0x5f [ 337.718143] ? lock_is_held_type+0x9e/0x120 [ 337.718199] ? srso_return_thunk+0x5/0x5f [ 337.718258] __mutex_lock+0x13d/0xb50 [ 337.718310] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 337.718355] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 337.718401] ? srso_return_thunk+0x5/0x5f [ 337.718456] ? synchronize_rcu_expedited+0x38a/0x420 [ 337.718500] ? __pfx___mutex_lock+0x10/0x10 [ 337.718555] ? srso_return_thunk+0x5/0x5f [ 337.718611] ? srso_return_thunk+0x5/0x5f [ 337.718666] ? kasan_quarantine_put+0x84/0x1e0 [ 337.718727] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 337.718762] ? srso_return_thunk+0x5/0x5f [ 337.718822] unregister_netdevice_many_notify+0x1612/0x1c80 [ 337.718867] ? __virt_addr_valid+0x2e8/0x5d0 [ 337.718920] ? __pfx_lock_release+0x10/0x10 [ 337.718965] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 337.719011] ? find_held_lock+0x2c/0x110 [ 337.719069] ? srso_return_thunk+0x5/0x5f [ 337.719126] ? kernfs_remove_by_name_ns+0xc7/0x130 [ 337.719187] ? srso_return_thunk+0x5/0x5f [ 337.719242] ? lock_release+0x20f/0x6f0 [ 337.719286] ? __pfx_lock_release+0x10/0x10 [ 337.719329] ? srso_return_thunk+0x5/0x5f [ 337.719389] ? lockdep_hardirqs_on_prepare+0x262/0x3f0 [ 337.719437] ? srso_return_thunk+0x5/0x5f [ 337.719497] unregister_netdevice_queue+0x224/0x2e0 [ 337.719540] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 337.719584] ? up_write+0x195/0x520 [ 337.719639] _cfg80211_unregister_wdev+0x57b/0x700 [ 337.719691] ? srso_return_thunk+0x5/0x5f [ 337.719750] ieee80211_remove_interfaces+0x2f2/0x6b0 [ 337.719788] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 337.719827] ? srso_return_thunk+0x5/0x5f [ 337.719882] ? srso_return_thunk+0x5/0x5f [ 337.719945] ? synchronize_rcu+0x1ff/0x260 [ 337.719988] ieee80211_unregister_hw+0x55/0x3a0 [ 337.720033] hwsim_exit_net+0x3a0/0x730 [ 337.720075] ? __pfx_hwsim_exit_net+0x10/0x10 [ 337.720116] ? srso_return_thunk+0x5/0x5f [ 337.720171] ? netdev_run_todo+0x788/0x1040 [ 337.720220] ? __pfx_hwsim_exit_net+0x10/0x10 [ 337.720263] ops_exit_list+0xb3/0x180 [ 337.720305] cleanup_net+0x546/0xad0 [ 337.720350] ? __pfx_cleanup_net+0x10/0x10 [ 337.720404] process_one_work+0x8ee/0x1a10 [ 337.720469] ? __pfx_lock_acquire+0x10/0x10 [ 337.720514] ? __pfx_process_one_work+0x10/0x10 [ 337.720572] ? srso_return_thunk+0x5/0x5f [ 337.720627] ? move_linked_works+0x172/0x270 [ 337.720672] ? srso_return_thunk+0x5/0x5f [ 337.720727] ? assign_work+0x196/0x240 [ 337.720785] worker_thread+0x674/0xe70 [ 337.720843] ? lockdep_hardirqs_on_prepare+0x262/0x3f0 [ 337.720894] ? srso_return_thunk+0x5/0x5f [ 337.720949] ? __pfx_worker_thread+0x10/0x10 [ 337.721009] kthread+0x3ab/0x720 [ 337.721061] ? __pfx_kthread+0x10/0x10 [ 337.721113] ? srso_return_thunk+0x5/0x5f [ 337.721168] ? finish_task_switch.isra.0+0x206/0x840 [ 337.721219] ? __pfx_kthread+0x10/0x10 [ 337.721273] ret_from_fork+0x48/0x80 [ 337.721304] ? __pfx_kthread+0x10/0x10 [ 337.721357] ret_from_fork_asm+0x1a/0x30 [ 337.721423] [ 339.801958] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 339.803123] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 339.804308] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 339.813723] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 339.815565] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 339.818064] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 339.868933] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 339.875970] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 339.878415] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 339.879518] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 339.880812] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 339.883360] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 339.884490] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 339.887216] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 339.888400] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 339.889776] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 339.890781] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 339.911012] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 339.963868] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 339.968840] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 339.976748] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 339.981990] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 339.987312] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 339.991829] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 341.842839] Bluetooth: hci0: command tx timeout [ 341.905937] Bluetooth: hci2: command tx timeout [ 341.970837] Bluetooth: hci4: command tx timeout [ 342.098670] Bluetooth: hci6: command tx timeout [ 343.890236] Bluetooth: hci0: command tx timeout [ 343.954102] Bluetooth: hci2: command tx timeout [ 344.018419] Bluetooth: hci4: command tx timeout [ 344.145949] Bluetooth: hci6: command tx timeout [ 345.937787] Bluetooth: hci0: command tx timeout [ 346.001652] Bluetooth: hci2: command tx timeout [ 346.065651] Bluetooth: hci4: command tx timeout [ 346.193743] Bluetooth: hci6: command tx timeout VM DIAGNOSIS: 18:42:52 Registers: info registers vcpu 0 RAX=000000000000002f RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff8283f165 RDI=ffffffff886970a0 RBP=ffffffff88697060 RSP=ffff88800d81ed20 R8 =0000000000000000 R9 =ffffed1001b30046 R10=000000000000002f R11=2f72656b726f776b R12=000000000000002f R13=0000000000000010 R14=ffffffff88697060 R15=ffffffff8283f150 RIP=ffffffff8283f1bd RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fd67638f428 CR3=0000000015be2000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=6b7a79732f3031323432383234307269 XMM02=2f303132343238323430726964747365 XMM03=6c69765142702e72656c6c616b7a7973 XMM04=000000000086459d0000000000862f35 XMM05=00000000008601650000000000862b68 XMM06=00000000008a270a00000000008a2df4 XMM07=00000000004643c100000000008a13d7 XMM08=000000c0000864b0000000c000086480 XMM09=000000c000086510000000c0000864e0 XMM10=000000c000086540000000c00005b530 XMM11=000000c0000865a0000000c000086570 XMM12=000000c000086600000000c0000865d0 XMM13=000000c000086660000000c000086630 XMM14=000000c0000866c0000000c000086690 XMM15=000000c0000a1080000000c0000866f0 info registers vcpu 1 RAX=0000000000000000 RBX=dffffc0000000000 RCX=ffffffff8180c7f6 RDX=ffff88802330d340 RSI=ffffffff8180c804 RDI=ffffc90000691082 RBP=ffff8880151efd20 RSP=ffff8880151efc58 R8 =0000000000000000 R9 =ffffed1002a79a06 R10=0000000040000000 R11=0000000000000000 R12=0000000040000000 R13=ffff8880151efd58 R14=ffffc90000691080 R15=0000000000000101 RIP=ffffffff8180c808 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f938c2518c0 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fffdba09be8 CR3=000000003405e000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=ffffffffffffffffffff000000000000 XMM02=000000000000000000004d554e514553 XMM03=000000000000000000003635313a3763 XMM04=0000000300000000000055f3adb1c830 XMM05=000055f3adb5bad0000055f3adb1a310 XMM06=000055f3adb479a00000000000000000 XMM07=0000000400000002000055f3adb74840 XMM08=2f003a737265766972642b0075256e00 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000