Warning: Permanently added '[localhost]:4742' (ECDSA) to the list of known hosts. 2025/11/14 20:04:17 fuzzer started 2025/11/14 20:04:17 dialing manager at localhost:37161 syzkaller login: [ 53.229500] cgroup: Unknown subsys name 'net' [ 53.269014] cgroup: Unknown subsys name 'cpuset' [ 53.286472] cgroup: Unknown subsys name 'rlimit' 2025/11/14 20:04:28 syscalls: 204 2025/11/14 20:04:28 code coverage: enabled 2025/11/14 20:04:28 comparison tracing: enabled 2025/11/14 20:04:28 extra coverage: enabled 2025/11/14 20:04:28 setuid sandbox: enabled 2025/11/14 20:04:28 namespace sandbox: enabled 2025/11/14 20:04:28 Android sandbox: enabled 2025/11/14 20:04:28 fault injection: enabled 2025/11/14 20:04:28 leak checking: enabled 2025/11/14 20:04:28 net packet injection: enabled 2025/11/14 20:04:28 net device setup: enabled 2025/11/14 20:04:28 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/11/14 20:04:28 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/11/14 20:04:28 USB emulation: enabled 2025/11/14 20:04:28 hci packet injection: enabled 2025/11/14 20:04:28 wifi device emulation: enabled 2025/11/14 20:04:28 802.15.4 emulation: enabled 2025/11/14 20:04:28 fetching corpus: 0, signal 0/0 (executing program) 2025/11/14 20:04:28 starting 8 fuzzer processes 20:04:28 executing program 0: r0 = epoll_create1(0x80000) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0x4, 0x250080) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000040)=""/63) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x1) read$char_usb(r2, &(0x7f0000000080)=""/111, 0x6f) r3 = accept$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14) accept4$packet(r3, 0x0, &(0x7f0000000180), 0x80000) getsockopt$inet6_tcp_buf(r1, 0x6, 0xd, &(0x7f00000001c0)=""/227, &(0x7f00000002c0)=0xe3) r5 = syz_open_dev$evdev(&(0x7f0000000300), 0xc10, 0x205440) ioctl$EVIOCGABS0(r5, 0x80184540, &(0x7f0000000340)=""/130) openat$cgroup_freezer_state(r1, &(0x7f0000000400), 0x2, 0x0) openat$cgroup_freezer_state(r1, &(0x7f0000000440), 0x2, 0x0) r6 = syz_open_dev$evdev(&(0x7f0000000480), 0x8, 0x400000) ioctl$EVIOCGKEYCODE(r6, 0x80084504, &(0x7f00000004c0)=""/121) openat$cgroup_freezer_state(r1, &(0x7f0000000540), 0x2, 0x0) ioctl$EVIOCGABS0(r5, 0x80184540, &(0x7f0000000580)=""/65) sched_rr_get_interval(0x0, &(0x7f0000000600)) accept$packet(r3, &(0x7f0000000700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000740)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000009c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000980)={&(0x7f0000000780)={0x1cc, 0x0, 0x200, 0x70bd27, 0x25dfdbfc, {}, [{{0x8, 0x1, r4}, {0xbc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r4}}}]}}, {{0x8, 0x1, r4}, {0xec, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xdf1}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80000000}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r4}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}]}}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x840}, 0x4040000) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000c40)={&(0x7f0000000ac0)={0x17c, 0x0, 0x0, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@fils_params=[@NL80211_ATTR_FILS_ERP_REALM={0x35, 0xfa, "fff5bea1b9c8d78584116f81b4c4691d55b784b93173a7879f4364387ec7ec262e2aefffd093cf2febe802b83eecad3b8d"}, @NL80211_ATTR_FILS_ERP_RRK={0xc3, 0xfc, "fbfaa091984453d4a0ba7732e71e362b59e72b179969ec138f77d3608f7b26291f2fcf27b1fd6cd5b1ca5f1ec8cd3dfba059ec552d78b037e7e525afbd8e2432df960798c3185512f56aba68f46c3d233de435ac880822fdee24b589163c1913eecf7533da97028e30b3b1840bc0b22c65b35f133e999cc28f7151dcbf3f620cc43100389662c00eb23bacb969d9e968153045cd822ec13bbfe396406117efe6813774349390487f873ec6c685c4c971411e7cb9fff1b4eec0af4bcdbad3fd"}], @NL80211_ATTR_IE={0x61, 0x2a, [@prep={0x83, 0x1f, @not_ext={{}, 0x8, 0xde, @device_a, 0x0, "", 0x5, 0x6, @broadcast, 0x4115}}, @ext_channel_switch={0x3c, 0x4, {0x0, 0x9, 0xb7, 0x2}}, @chsw_timing={0x68, 0x4, {0x1, 0x6}}, @ht={0x2d, 0x1a, {0x300, 0x2, 0x6, 0x0, {0x3, 0x1, 0x0, 0x1, 0x0, 0x1}, 0x800, 0x3, 0x2}}, @link_id={0x65, 0x12, {@from_mac=@device_b, @device_a, @broadcast}}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000) 20:04:28 executing program 1: sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x100, 0x70bd26, 0x25dfdbff, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4011}, 0x4000) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) getpeername$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000001c0)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000240)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000002c0)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000340)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10204000}, 0xc, &(0x7f0000000800)={&(0x7f00000003c0)={0x410, 0x0, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [{{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}]}}, {{0x8}, {0x13c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5805}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r0}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}]}}, {{0x8, 0x1, r2}, {0x1e8, 0x2, 0x0, 0x1, [{0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x80}}, {0x8, 0x6, r3}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x6, 0x7f, 0x30, 0x7}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8, 0x1, r4}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}]}}]}, 0x410}, 0x1, 0x0, 0x0, 0x4048000}, 0x1) wait4(0x0, &(0x7f0000000880), 0x20000000, &(0x7f00000008c0)) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10c, 0x0, 0x10, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:insmod_exec_t:s0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x29, 0x7, 'system_u:object_r:ifconfig_exec_t:s0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x29, 0x7, 'system_u:object_r:vmware_device_t:s0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x20, 0x7, 'system_u:object_r:cert_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x20}}, @NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x10c}}, 0x801) wait4(0xffffffffffffffff, &(0x7f0000000b80), 0x80000000, &(0x7f0000000bc0)) r5 = accept4$packet(0xffffffffffffffff, &(0x7f0000000c80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000cc0)=0x14, 0x800) getpeername$packet(r5, &(0x7f0000000d00), &(0x7f0000000d40)=0x14) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000d80)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) getsockname$packet(r6, &(0x7f0000000dc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000e00)=0x14) openat$cgroup_devices(r6, &(0x7f0000000e40)='devices.deny\x00', 0x2, 0x0) socketpair(0x99b94a6780207dc0, 0x6, 0x0, &(0x7f0000000ec0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000e80), r8) sendmsg$NL80211_CMD_RELOAD_REGDB(r7, &(0x7f0000000fc0)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x14, 0x0, 0x100, 0x70bd2d, 0x25dfdbff, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40084) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000001200)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001080)={0x118, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_DEVKEY={0x30, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x1f}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_SEC_DEVKEY={0xa0, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0x30, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x40}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}]}, @NL802154_DEVKEY_ATTR_ID={0x58, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x28, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0x3}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0x555f}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}]}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0xfffffffffffffffa}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x7}]}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x118}, 0x1, 0x0, 0x0, 0x40814}, 0x4004011) 20:04:28 executing program 3: ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, &(0x7f0000000000)) ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0xc018480b, &(0x7f0000000040)={0x3, 0x3, 0x7fff, 0x0, 0x2, 0xbd7}) ioctl$HIDIOCGREPORTINFO(0xffffffffffffffff, 0xc00c4809, &(0x7f0000000080)={0x2, 0xffffffff, 0x5}) ioctl$HIDIOCSUSAGE(0xffffffffffffffff, 0x4018480c, &(0x7f00000000c0)={0x1, 0x3, 0xfffffe00, 0x8000, 0x7fffffff, 0x3}) ioctl$HIDIOCGPHYS(0xffffffffffffffff, 0x80404812, &(0x7f0000000100)) sendmsg$NL802154_CMD_SET_PAN_ID(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) getpeername$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000300)=0x14) accept$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0}, &(0x7f0000000380)=0x14) r3 = accept$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0}, &(0x7f0000000400)=0x14) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800800}, 0xc, &(0x7f0000000640)={&(0x7f0000000440)={0x1f8, 0x0, 0xc01, 0x70bd25, 0x25dfdbfb, {}, [{{0x8, 0x1, r0}, {0x7c, 0x2, 0x0, 0x1, [{0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x2, 0x3, 0x4, 0x6}]}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x6, 0x81, 0x39, 0x9d9}]}}}]}}, {{0x8, 0x1, r1}, {0x80, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}]}}, {{0x8, 0x1, r4}, {0xd0, 0x2, 0x0, 0x1, [{0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7ff}}, {0x8}}}]}}]}, 0x1f8}, 0x1, 0x0, 0x0, 0x8000}, 0x4008010) ioctl$HIDIOCINITREPORT(0xffffffffffffffff, 0x4805, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000700), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f00000006c0), 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x68, r5, 0x20, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x68}, 0x1, 0x0, 0x0, 0x40}, 0x1) r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000880), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000980)={&(0x7f00000008c0)={0xac, r6, 0x300, 0x70bd27, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}, @NLBL_UNLABEL_A_SECCTX={0x25, 0x7, 'system_u:object_r:inetd_log_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @local}, @NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:audisp_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0xf}}]}, 0xac}, 0x1, 0x0, 0x0, 0x20000841}, 0x8040) r7 = syz_open_dev$hiddev(&(0x7f0000000a00), 0x8, 0x80200) ioctl$HIDIOCSFLAG(r7, 0x4004480f, &(0x7f0000000a40)=0x3) r8 = accept$packet(r3, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000ac0)=0x14) ioctl$sock_ifreq(r8, 0x8925, &(0x7f0000000b40)={'hsr0\x00', @ifru_data=&(0x7f0000000b00)="4555854e177fdf976509f22a32e393fef196aafcffc74e60b97b2e17ff3ea77c"}) 20:04:28 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x8, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000002}, 0x800) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x70, 0x0, 0x0, 0x70bd26, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @empty}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x27}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @empty}, @NLBL_UNLABEL_A_SECCTX={0x2b, 0x7, 'system_u:object_r:ssh_keygen_exec_t:s0\x00'}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000080}, 0x24000005) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000280), r0) sendmsg$NLBL_CIPSOV4_C_LISTALL(r1, &(0x7f0000000480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x15c, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x7c, 0x8, 0x0, 0x1, [{0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x54a8d793}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x39d8297e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13d22990}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xbe}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x652cdea3}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x37}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x455ceb76}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc9}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2935600f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x521185eb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4d}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x44, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x2c, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x20a2765e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x30ee93eb}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3afcbbf1}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xff}]}]}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MLSLVLLST={0x38, 0x8, 0x0, 0x1, [{0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6d}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c6e756}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x219a221f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2425e440}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3}]}]}]}, 0x15c}, 0x1, 0x0, 0x0, 0x80}, 0x1) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r0, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x10, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @loopback}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x1001) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r0, 0xfffffffffffffffc, 0x8000) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x4c, 0x0, 0x10, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @private=0xa010101}, @NLBL_UNLABEL_A_SECCTX={0x20, 0x7, 'system_u:object_r:ptmx_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @private=0xa010100}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @rand_addr=0x64010101}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x8010) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000700), r1) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000780), r1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000007c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r1, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x34, r3, 0x200, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x40800) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x2c, 0x0, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x840}, 0x40040) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000a00)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r5, &(0x7f0000000b40)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a40)={0x88, r3, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_DEVICE={0x38, 0x23, 0x0, 0x1, [@NL802154_DEV_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEV_ATTR_SECLEVEL_EXEMPT={0x5}, @NL802154_DEV_ATTR_SECLEVEL_EXEMPT={0x5}, @NL802154_DEV_ATTR_PAN_ID={0x6, 0x2, 0xfffe}, @NL802154_DEV_ATTR_SHORT_ADDR={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ATTR_SECLEVEL_EXEMPT={0x5, 0x5, 0x1}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x88}, 0x1, 0x0, 0x0, 0x4084}, 0x4004814) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000bc0), r5) sendmsg$NL802154_CMD_SET_TX_POWER(r1, &(0x7f0000000cc0)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x6c, r7, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_TX_POWER={0x8, 0xb, 0xfffff800}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x3ff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x6000}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x10001}]}, 0x6c}, 0x1, 0x0, 0x0, 0xe14f233d8c698583}, 0x44000081) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000d00)={'wpan1\x00'}) 20:04:28 executing program 4: syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000440)={&(0x7f00000000c0)={0x35c, 0x0, 0x800, 0x70bd28, 0x25dfdbfb, {}, [{{0x8, 0x1, r0}, {0x78, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8}, {0x1cc, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3b83}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1ff}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x10000000}}}]}}, {{0x8}, {0xec, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8000}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffff8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}]}}]}, 0x35c}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) mlock2(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000540)={0x270, r1, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_SEC_DEVKEY={0x10c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0002}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xaf}, @NL802154_DEVKEY_ATTR_ID={0x24, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0xe0fc}, @NL802154_KEY_ID_ATTR_INDEX={0x5}]}, @NL802154_DEVKEY_ATTR_ID={0x64, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x38, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x400}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x18, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}]}]}, @NL802154_DEVKEY_ATTR_ID={0x54, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x40, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa3}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x6}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVKEY={0x40, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x5}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xffffffe0}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x3}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}, @NL802154_ATTR_SEC_DEVKEY={0xdc, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0x48, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xfffffeff}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x800}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x8}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x7db}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}]}, @NL802154_DEVKEY_ATTR_ID={0x68, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x7}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x6}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xfff}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x38, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xfff}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x1ff}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}, @NL802154_ATTR_SEC_DEVKEY={0x14, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0x10, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x7}]}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x270}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004800) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x30, r1, 0x100, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x4810) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, r1, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x60000}, 0x1) shmat(0xffffffffffffffff, &(0x7f0000ffc000/0x4000)=nil, 0x6000) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000b40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x50, 0x0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_SECCTX={0x29, 0x7, 'system_u:object_r:hald_mac_exec_t:s0\x00'}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @local}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c880}, 0x20000060) sendmsg$NL802154_CMD_NEW_SEC_DEV(r2, &(0x7f0000000cc0)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000bc0)={0xb0, 0x0, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_DEVICE={0x38, 0x23, 0x0, 0x1, [@NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0x4}, @NL802154_DEV_ATTR_KEY_MODE={0x8}, @NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0x9}, @NL802154_DEV_ATTR_PAN_ID={0x6}, @NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0x2}, @NL802154_DEV_ATTR_EXTENDED_ADDR={0xc, 0x4, {0xaaaaaaaaaaaa0202}}]}, @NL802154_ATTR_SEC_DEVICE={0x5c, 0x23, 0x0, 0x1, [@NL802154_DEV_ATTR_KEY_MODE={0x8, 0x6, 0x2}, @NL802154_DEV_ATTR_SECLEVEL_EXEMPT={0x5, 0x5, 0x1}, @NL802154_DEV_ATTR_PAN_ID={0x6, 0x2, 0x2}, @NL802154_DEV_ATTR_SHORT_ADDR={0x6, 0x3, 0xffff}, @NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0x100}, @NL802154_DEV_ATTR_SHORT_ADDR={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0x6}, @NL802154_DEV_ATTR_EXTENDED_ADDR={0xc, 0x4, {0xaaaaaaaaaaaa0202}}, @NL802154_DEV_ATTR_EXTENDED_ADDR={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ATTR_PAN_ID={0x6, 0x2, 0x3}]}, @NL802154_ATTR_IFINDEX={0x8}]}, 0xb0}, 0x1, 0x0, 0x0, 0x400c004}, 0x20000085) ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, &(0x7f0000000d00)=""/58) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000d80), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000dc0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f0000000f80)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000f40)={&(0x7f0000000e00)={0x104, r3, 0x800, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_SEC_KEY={0x54, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x1f}, @NL802154_KEY_ATTR_ID={0x24, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x4}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x4}]}, @NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "f9fdafb11a0c8a7df3704aa46f132f2c2aa337c376589f922c0cf7e589b73ef6"}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_SEC_KEY={0x1c, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x2}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x4}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x6}]}, @NL802154_ATTR_SEC_KEY={0x30, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "195fa2fb79f3cda2148ccc9008d35df92a1746efe8d87f034f263a6de28e22b7"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xff}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0x20, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "3fcd55aa45bc78098efc3feae4570df0"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x7f}]}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x104}, 0x1, 0x0, 0x0, 0x48000}, 0x44001) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000001000)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r2, &(0x7f00000010c0)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001080)={&(0x7f0000001040)={0x34, r1, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x34}}, 0x40810) prctl$PR_SET_MM(0x23, 0x0, &(0x7f0000ffc000/0x2000)=nil) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000001200)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x48, r3, 0x400, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x4) [ 63.357816] audit: type=1400 audit(1763150668.906:7): avc: denied { execmem } for pid=272 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 20:04:28 executing program 7: ioctl$HIDIOCGPHYS(0xffffffffffffffff, 0x80404812, &(0x7f0000000000)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, r1, 0x4, 0x70bd27, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}, {0xc, 0x8f, 0x4}, {0xc, 0x90, 0x1000}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x4) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuacct.usage_all\x00', 0x0, 0x0) ioctl$HIDIOCSUSAGE(r2, 0x4018480c, &(0x7f0000000200)={0x1, 0x2, 0x100, 0x0, 0x2aa4ce0c, 0x80}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) r4 = accept$packet(0xffffffffffffffff, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000340)=0x14) sendmsg$ETHTOOL_MSG_PAUSE_GET(r2, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)={0x1b8, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x1b8}, 0x1, 0x0, 0x0, 0x8814}, 0x4000) ioctl$HIDIOCSFLAG(r2, 0x4004480f, &(0x7f00000005c0)=0x2) accept4$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000640)=0x14, 0x800) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000680), 0x800) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000700), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000740)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x10002000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x34, r6, 0x10, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x34}}, 0x40) ioctl$HIDIOCGUSAGES(r2, 0xd01c4813, &(0x7f0000000840)={{0x1, 0xffffffff, 0x8a, 0x3792, 0x5, 0xfff}, 0x2a1, [0xf01d, 0xfff, 0x5, 0x7, 0x7f, 0x8, 0x7, 0x7ff, 0x1ff, 0xfffffffc, 0x1, 0x40, 0x0, 0x8, 0xfe000000, 0x4, 0x93c, 0x0, 0x5, 0x0, 0xbf2, 0x9e, 0xffffff30, 0x4, 0x2, 0x5, 0xc8, 0x0, 0x3, 0x5, 0x3f, 0x1, 0x1, 0x2, 0x1f, 0x551f47f1, 0x4e7, 0x5, 0x0, 0x5, 0x40, 0x6b, 0x5, 0xb9, 0x20, 0x0, 0x80000001, 0x4, 0x12, 0x3, 0xfbfd, 0xffff, 0x7fffffff, 0x7, 0x1, 0x400, 0x7, 0x1ff, 0x61, 0x4, 0xbed3, 0xbe47, 0x6, 0x2e4, 0x40, 0x10000, 0xfc, 0x3, 0x1, 0x0, 0x0, 0xd5a, 0xf35, 0x5, 0x1f, 0x9, 0xdd9d, 0x8, 0x0, 0x5, 0x3, 0x0, 0x7f, 0x3f, 0x7, 0x3, 0x7fff, 0xfff, 0x2, 0xce, 0xfffffff7, 0x3ff, 0x6, 0x9, 0x7, 0x5, 0x81, 0x81, 0x6, 0x10000, 0x7, 0x1a13, 0x8, 0xff, 0x1, 0x80000001, 0x6, 0x7e1, 0x8001, 0xfe6c, 0x0, 0x7, 0x9, 0x80, 0x8, 0x1, 0x4, 0x5, 0x9, 0x8, 0x8, 0x8, 0x1000, 0x7, 0x8, 0x1, 0xb5, 0x2, 0x6, 0x3, 0x294a, 0xbe, 0x1000, 0x101, 0x100, 0x0, 0x800, 0x2, 0x8, 0x2, 0x4, 0x0, 0xffffffff, 0x4, 0x6, 0x8001, 0xffffffff, 0x9, 0xca3, 0xfff, 0x10000, 0x4, 0x10000, 0xffff, 0x80000000, 0x80, 0x7, 0x4a, 0xffffff7f, 0x20, 0x0, 0x7671, 0x10001, 0x7f, 0x5, 0x80000001, 0x5, 0x6, 0x7, 0x5, 0x6, 0xfffffffa, 0x7, 0x400, 0x7, 0x8, 0x4, 0x6, 0x5, 0x7fffffff, 0x148, 0x8, 0x3, 0x7fffffff, 0x5, 0x8, 0x4, 0x9, 0xf34, 0x1, 0xffffff93, 0xff, 0x8, 0x7, 0x7, 0x5, 0x4, 0x7, 0xaf8, 0x3, 0x5, 0x5, 0x2, 0x5, 0xab00, 0x7, 0x1, 0x0, 0x4, 0x20, 0x8001, 0x9, 0x2, 0x1f, 0x0, 0x7, 0x9, 0x23, 0x8, 0x6, 0x3f, 0x97, 0x1, 0x1, 0x1, 0x3, 0x83e, 0x200, 0x800, 0x20, 0x0, 0x6, 0xfffffffa, 0x717, 0x4, 0x18, 0x1ff, 0x5, 0x9, 0x80000000, 0x5, 0x51, 0x1000, 0xefa, 0x1, 0x2, 0x4, 0xffff, 0x0, 0xfff, 0x6, 0x7fff, 0x1, 0x80, 0x7ff, 0x8522, 0x78, 0x5, 0x3, 0x7f, 0x9, 0x101, 0xf800, 0x4, 0x7ff, 0x8000000, 0x7, 0x948f98fc, 0x1, 0xfffff3bb, 0x4, 0x3, 0x1, 0xfffffffe, 0x55e, 0x6, 0x30, 0x6, 0x4, 0x4, 0x5, 0x6d78, 0x4, 0x89, 0x3ff, 0x81, 0x200, 0x8000, 0x800, 0x8000, 0x1f, 0x0, 0x7f, 0xc1c, 0x7, 0x5187, 0x9, 0x7, 0x8000, 0x2, 0xe7, 0xffffff00, 0x7, 0xcfb1, 0x7fff, 0x61a, 0x4, 0x0, 0x4, 0xffff, 0x9, 0x3, 0x5, 0x19, 0x9, 0x3, 0x10000, 0x80000001, 0x10000, 0x0, 0x2, 0xd288, 0x0, 0x7fd, 0x1000, 0x4, 0x9, 0x3, 0xfde, 0x7, 0x9, 0x0, 0x3, 0x2, 0x7e, 0x6, 0xab57, 0x80000000, 0x401, 0x9, 0x1, 0x6, 0x7, 0x2, 0x200, 0x3, 0x6, 0x51, 0x40, 0x9, 0x6, 0x63e, 0xfffffff7, 0x2, 0x3ff, 0x5282, 0x3, 0xe27, 0x1000, 0x0, 0x6f, 0xffffffff, 0x1000, 0x7, 0x2, 0x6, 0xda3, 0x6, 0x80000001, 0x40, 0x7, 0x4, 0x5, 0x3, 0x1, 0x8000, 0x9, 0x8, 0x8, 0x8, 0x4, 0x7, 0x1, 0x9, 0xb52, 0x20, 0x87f, 0x6, 0x9d, 0x9, 0x4, 0x5, 0x28, 0x8, 0x81, 0x1, 0x1f, 0x5, 0x7fff, 0x2, 0x6, 0x1, 0xffff0000, 0xfffffffa, 0x7ff, 0x800, 0x40000000, 0x645, 0x8001, 0x1, 0x8, 0x8194, 0x400, 0x6, 0x9, 0x2, 0x6, 0x7, 0x80000000, 0xffffffff, 0x0, 0x8, 0x5, 0x401, 0x6, 0x66c, 0xcce, 0x101, 0x4, 0x7, 0xffffffff, 0x81, 0x9, 0xffffff80, 0x8, 0x3000000, 0x800, 0xfff, 0x6b65, 0x1ff, 0x4, 0x3, 0x0, 0x3, 0x2, 0xffffff01, 0x1, 0x401, 0x4, 0x6, 0x764687c0, 0x101, 0x101, 0x8, 0x2, 0x8, 0xe5, 0x4, 0x7, 0x9, 0x2, 0x18, 0xffffffc0, 0x6, 0x4, 0x20, 0x80000001, 0x1, 0x5, 0x4, 0x80000001, 0x5466, 0x7, 0x2, 0x5, 0x0, 0xffffffff, 0x3, 0x4, 0xffffffff, 0x8000, 0x9, 0x5, 0xfffffff8, 0x6, 0x14d, 0xffffffff, 0xfffffff8, 0x6, 0x7ff, 0x0, 0x7, 0x4, 0x1000, 0x1f, 0x73147a5d, 0x632, 0x3f, 0x200, 0x400, 0x5, 0x8, 0x6, 0x7, 0xfffffffd, 0x0, 0x8, 0x1, 0x1ff, 0x0, 0x200, 0xffffffe0, 0x7, 0x6028, 0x8, 0x5, 0x5, 0x8, 0x80, 0x2, 0x20, 0x5, 0x9, 0x3, 0xd4f, 0x2, 0x80, 0x8, 0x2, 0x9, 0x9, 0x4, 0x78d6, 0x1, 0xbe, 0x20c1, 0x5, 0x1, 0x7, 0x101, 0xfffff4d5, 0x401, 0x9, 0x36e6cdaa, 0x0, 0x1, 0x4, 0x7ff, 0x9, 0x5, 0x0, 0x0, 0x0, 0x400, 0x5, 0x0, 0x8, 0x2, 0x8, 0x8, 0xfffffff9, 0x9, 0xff, 0x4, 0x1, 0x0, 0xfffffffd, 0xe9, 0x80000000, 0x80, 0xe8, 0x7ff, 0x100, 0x9e77, 0x6, 0x6, 0x3, 0x89c, 0x676, 0x80, 0x1f5, 0x20, 0x9, 0x5, 0x1, 0x5, 0x2, 0x4, 0x401, 0x2, 0x100, 0x0, 0x4, 0x0, 0x58d9, 0x3, 0x8000, 0x3, 0x7, 0xfff, 0x100, 0x8, 0xfff, 0x9, 0x8001, 0x1, 0x80, 0x400, 0x1, 0x6, 0x8, 0x8, 0x7, 0x6, 0x6, 0xffff, 0x101, 0x8, 0x3d, 0xffffffff, 0xffff, 0x800, 0xffffff00, 0x4, 0xfff, 0x80, 0x2, 0x40, 0xffffffff, 0x8, 0xff, 0xfff, 0x8, 0x5, 0x1b4, 0xcd, 0x7, 0xfd3000, 0x40, 0x2, 0x1, 0x0, 0x3d, 0x8, 0x1f, 0x8, 0x3, 0x9, 0x7, 0x4, 0x80000000, 0x100, 0x401, 0x88c, 0x4, 0x10000, 0x0, 0x722, 0x192d0c2c, 0x2, 0x80000001, 0x41, 0x6, 0xfffffff7, 0x9, 0x3f, 0xffffffff, 0x1, 0xc8c, 0x4, 0x3ff, 0xfffffeff, 0x1, 0x4318, 0x9, 0x29f, 0x0, 0x10000, 0xfa7, 0xffff8000, 0x1, 0x0, 0x7, 0x10, 0x3, 0x0, 0x2, 0x7, 0x4, 0x10, 0x100, 0x428f, 0x7fffffff, 0x8, 0x2, 0x9, 0x0, 0x1, 0xfffffffd, 0xffff, 0xd88, 0x401, 0x100, 0xfffffd82, 0x3, 0x5, 0xffff5b0c, 0x3ff, 0x4f9c, 0xa6ec, 0x2, 0x4, 0x6, 0x1, 0x9, 0x6, 0x7, 0x3ce, 0x8, 0xec902b9, 0x9, 0x0, 0x400, 0x200, 0x200, 0x5, 0x5, 0x2bc, 0x1f, 0x200, 0x6, 0x8000, 0xdb4, 0x887, 0x8, 0xcddf, 0x7fffffff, 0x6577ccf5, 0x8, 0x3, 0x3, 0x1, 0x2, 0x1, 0x0, 0x720, 0x1, 0x8000, 0xffff, 0x6, 0xf2a, 0x7ff, 0x4, 0x2d2, 0x3, 0x57b, 0xf0b8, 0xbdbb, 0x88, 0x200, 0x4, 0x10001, 0x7, 0x6, 0xfffffffe, 0x6b9, 0xfab, 0x9b, 0x5, 0xfffffff8, 0x1000, 0xfffffeff, 0x8, 0x3, 0xffffffff, 0xd895, 0x80000000, 0x0, 0x3, 0x8, 0x7f, 0x4, 0x400, 0x200, 0x101, 0x7, 0x1ff, 0x3ff, 0x5, 0x3ff, 0xfffffffe, 0x2, 0x18, 0x5443, 0x40, 0x10000, 0x200, 0x1000, 0x27, 0x7ff, 0x3ff, 0x7f, 0x30b, 0x21e, 0x80000001, 0x6, 0x0, 0x8, 0x900000, 0x37e9, 0x1, 0x100, 0x80000001, 0x2, 0x9, 0x5, 0x800, 0x2, 0x400, 0x5, 0x3, 0x80000001, 0x1, 0x1000, 0xfff, 0xfff, 0x6, 0x6, 0xe3a, 0x40, 0x2, 0x7, 0x5, 0xffffffff, 0x1, 0x5, 0x1, 0x1, 0x3, 0x8, 0x9, 0xfc000000, 0x80000001, 0xffff8000, 0x1000, 0x54593ef5, 0x4, 0x1, 0x2, 0x8001, 0x5, 0xfffffd7a, 0x6, 0x20dd3d2c, 0x4, 0x4, 0x8000, 0xffffffff, 0x5, 0x0, 0x8000, 0x5, 0x1f, 0x80, 0x3, 0x3ff, 0x81, 0x0, 0x8001, 0x3, 0x9, 0x1969, 0x5a, 0xd58, 0x4, 0x7, 0x3, 0x6, 0x7dea, 0x5, 0x881, 0x411, 0xffff, 0x8, 0x9, 0xf8d2, 0x4, 0x749, 0x9, 0x8001, 0xaf24, 0x45c, 0x8, 0x8, 0x2, 0xff, 0x800, 0x3, 0x2, 0x9, 0x75ed, 0x8, 0x418, 0x6, 0x5, 0x7, 0xffff, 0x4, 0xa76, 0x40000000, 0x174, 0x0, 0x1, 0x3, 0x8, 0x2, 0x5, 0xffffffbf, 0xffff, 0x0, 0x80000000, 0x3f, 0x7fff, 0xe923, 0x10000, 0x8, 0x6a3731f5, 0x6, 0x7bb, 0x8, 0x65f, 0x7f, 0xffff, 0x6, 0x101, 0x3f, 0x7fffffff, 0x8, 0x5, 0x1, 0x4, 0x69, 0x1, 0x7, 0x1, 0x8, 0x1, 0x0, 0x1, 0x2, 0x1000, 0xfffeffff, 0xfff, 0x7, 0x0, 0x2, 0x7, 0x9, 0x1ff, 0x4, 0x9, 0x829, 0x7ff, 0x20, 0x3, 0x3, 0x8, 0x7fa4, 0x401, 0x9, 0x9, 0xfad, 0x5, 0x0, 0xfffffff9, 0x9, 0x101, 0x4, 0x2, 0xffff, 0x4, 0x0, 0x7d1000, 0x3ff, 0x315, 0xc877, 0x1, 0x80, 0x9, 0x4, 0x4, 0x8, 0x5, 0x3, 0x0, 0x0, 0x8, 0x1, 0x1, 0x101, 0x8001, 0x9, 0x80000000, 0x1f, 0x1, 0x0, 0xfaa, 0x7, 0x8, 0x8, 0x0, 0x3, 0xffffffff, 0x0, 0x20, 0x5, 0x7ff, 0x80000001, 0xff, 0x1, 0x9, 0x3f, 0x9, 0x3f]}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r8, &(0x7f0000001940)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001900)={&(0x7f00000018c0)={0x28, r6, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000008}, 0x24008045) syz_genetlink_get_family_id$nl80211(&(0x7f0000001980), r2) ioctl$EVIOCGLED(0xffffffffffffffff, 0x80404519, &(0x7f0000001a00)=""/80) 20:04:28 executing program 5: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_POWER_SAVE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, r0, 0x800, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x6, 0x4e}}}}, [@NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0xd0}, 0x80) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x10, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xfffc}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004004}, 0x4) socketpair(0x29, 0x2, 0x4, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(r1, &(0x7f0000000700)={&(0x7f00000002c0), 0xc, &(0x7f00000006c0)={&(0x7f0000000340)={0x360, r0, 0x200, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x5abdacdb, 0x53}}}}, [@NL80211_ATTR_IE={0x209, 0x2a, [@measure_req={0x26, 0x30, {0x5, 0x9, 0x31, "5392c0c40146d7b29d7a55a0ba27be9e19ff460f48a3a4f8ecd16405952c5799b034d233d40beba136b95e478e"}}, @tim={0x5, 0xc5, {0x81, 0x34, 0x1, "f24c4d35ca90153ca2aa541c7c42cb48cf51e71d100224d28f5a2209ad37b8f9b501f269c62547913cbd7d1390956b1a234f1a7a2da98602c5cb296543f2bbd10731fe5023b25bd544aa5e55ccf7203f8488d1506323bc01e85c0c7dd9d8550a394fe9fbf99545c70a95ec0f8e5d2b14fe347a7c4e9e3d867d84495eaba79fdc4097362859a17a7a2cea12bafc49fc6126cae04cf0ac1e22c5eb224678d3d10877a74ec80e2e88326c6995071f590103cc7e4a7c4fadbf98049e6c583cb821790067"}}, @link_id={0x65, 0x12, {@random="02164ef356a5", @device_a, @device_b}}, @rann={0x7e, 0x15, {{0x0, 0x5}, 0xc9, 0x4, @broadcast, 0x70, 0x2, 0x100}}, @random={0x4, 0x58, "573b3d341b898e92d71756b81a7c80bd8407c97df970af0a57ba7ef7423792d14ff70703c668e61e417d8bd8fb88c668aa9c824c3c574b56e81c043be71a2e6afb48b23f4045936849ba726f56262bb7b6b7fa4ca1d87001"}, @gcr_ga={0xbd, 0x6, @device_b}, @preq={0x82, 0x7d, @not_ext={{0x1, 0x1, 0x1}, 0x0, 0x9, 0x20, @device_a, 0xce6, "", 0x8, 0x100, 0x9, [{{0x0, 0x0, 0x1}, @device_b, 0x93}, {{0x1, 0x0, 0x1}, @broadcast, 0xa8}, {{0x1}, @device_b, 0x1}, {{}, @device_a, 0x7f}, {{}, @broadcast}, {{0x0, 0x0, 0x1}, @device_b, 0x5}, {{0x1}, @device_a, 0xf03}, {{0x0, 0x0, 0x1}, @device_b, 0x4}, {{}, @device_b, 0x2cb}]}}]}, @NL80211_ATTR_IE={0x68, 0x2a, [@peer_mgmt={0x75, 0x16, {0x1, 0xffff, @void, @val=0x33, @val="a5c813f8743469ae204fe0623a947140"}}, @mic={0x8c, 0x10, {0x9bc, "9ee863779e4f", @short="e3036f51f187938b"}}, @mesh_id={0x72, 0x6}, @challenge={0x10, 0x1, 0x9d}, @ssid={0x0, 0x6, @default_ibss_ssid}, @sec_chan_ofs={0x3e, 0x1, 0x1}, @gcr_ga={0xbd, 0x6, @broadcast}, @mesh_chsw={0x76, 0x6, {0x81, 0x4, 0xb, 0x7ff}}, @link_id={0x65, 0x12, {@from_mac=@device_b, @device_a, @broadcast}}]}, @NL80211_ATTR_IE={0xc4, 0x2a, [@measure_req={0x26, 0x89, {0x4, 0x1f, 0x7, "b1f1cf087d408a66f3e5fba16bd943c44ff3665bba8171a2858f23260d199595bfca296ea94461f3defcebb671417add8740d05324ea2d679817d886122cab09fdb776307eaf0710d5f5bf120f13ed958516707102c9afc6926923af31d95b86776152240efc914245548f5d01603344a662d8675dbc065939594b7e786b4155cdb379e31926"}}, @cf={0x4, 0x6, {0xc0, 0x2, 0x4, 0x9}}, @cf={0x4, 0x6, {0xff, 0x7, 0x9, 0xe3}}, @channel_switch={0x25, 0x3, {0x1, 0x1, 0x8c}}, @dsss={0x3, 0x1, 0xb9}, @erp={0x2a, 0x1}, @erp={0x2a, 0x1, {0x0, 0x1}}, @link_id={0x65, 0x12}, @erp={0x2a, 0x1, {0x1, 0x1, 0x1}}]}]}, 0x360}, 0x1, 0x0, 0x0, 0x4000081}, 0x4080) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x4c, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x73}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x20000}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20040000}, 0x880) r4 = syz_open_dev$vcsn(&(0x7f0000000880), 0x0, 0xa0200) getsockname$packet(r1, &(0x7f0000000940)={0x11, 0x0, 0x0}, &(0x7f0000000980)=0x14) accept4$packet(r2, &(0x7f00000009c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000a00)=0x14, 0x80000) getpeername$packet(r2, &(0x7f0000000a40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000a80)=0x14) getpeername$packet(r2, &(0x7f0000000ac0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000b00)=0x14) accept$packet(r2, &(0x7f0000000b40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000b80)=0x14) accept4$packet(r1, &(0x7f0000000bc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000c00)=0x14, 0x1800) getsockname$packet(r1, &(0x7f0000000d40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000d80)=0x14) accept$packet(0xffffffffffffffff, &(0x7f0000000dc0)={0x11, 0x0, 0x0}, &(0x7f0000000e00)=0x14) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000001640)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001600)={&(0x7f0000000e40)={0x794, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [{{0x8}, {0x1b8, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xfffffffe}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r7}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x170, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r9}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x26}}, {0x8, 0x6, r10}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}]}}, {{0x8}, {0x230, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x61b}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8}, {0x48, 0x2, 0x0, 0x1, [{0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r12}}}]}}]}, 0x794}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r13 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000016c0), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r13, &(0x7f00000017c0)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001780)={&(0x7f0000001700)={0x5c, r14, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_SECCTX={0x1f, 0x7, 'system_u:object_r:mnt_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}]}, 0x5c}, 0x1, 0x0, 0x0, 0xe4b5dd37fd078878}, 0x40800) 20:04:28 executing program 6: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x7d65, 0x20001) ioctl$HIDIOCGPHYS(r0, 0x80404812, &(0x7f0000000040)) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x40, 0x454800) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, &(0x7f00000000c0)={0x1, 0x1, 0x1f, 0x7bc4, 0xa1b0, 0x74095d8b}) ioctl$HIDIOCGUSAGES(r1, 0xd01c4813, &(0x7f0000000100)={{0x1, 0x2, 0x712d6c37, 0x6, 0x6, 0x600000}, 0x234, [0x9, 0x100, 0x8, 0x1, 0x4, 0x8000, 0x5, 0x1, 0x5, 0xffffb347, 0x9, 0xffffffff, 0x0, 0xfffffffd, 0x7ff, 0x8, 0x4, 0x5, 0x800, 0x5, 0xe1, 0x4, 0x6, 0x101, 0x800, 0x10001, 0x8f9, 0xfffffffb, 0x2, 0xcc7, 0x3c, 0x800, 0x0, 0x7, 0x0, 0xfff, 0x0, 0x0, 0x3, 0x5, 0x8, 0x8, 0x1, 0x6, 0x7, 0x3f, 0x9, 0x40, 0x1, 0x7f, 0x0, 0xffff, 0x0, 0x1f, 0x6ccb, 0x81, 0x200, 0x100, 0x7d, 0x41c, 0x99, 0x5, 0x7f, 0x6, 0x3116524f, 0x8, 0x4, 0xfffffffd, 0x7d34, 0x7, 0x6, 0x80000000, 0xff, 0x8, 0x1, 0xf36, 0xde, 0x8, 0x3, 0x100, 0x8, 0x5, 0x4, 0x8, 0x8, 0x1ff, 0x1, 0xffffffff, 0x6, 0x3ff, 0xff, 0x1, 0x180, 0x401, 0x0, 0x2, 0x800, 0x3ff, 0x200, 0xfffffe0e, 0xad34, 0x8b, 0x9, 0x0, 0x24e, 0xfffffe00, 0x81, 0x3f2, 0x5, 0x5fa, 0x7f, 0x5, 0x0, 0x8, 0x80000001, 0x7ff, 0x6, 0x1, 0x4, 0x7, 0x40, 0x6, 0x1, 0xfff, 0x3, 0x7ff, 0x18e0, 0xf296, 0x3ff, 0xfffffffa, 0x1, 0x1, 0x4, 0xac, 0x2, 0xe9e, 0xbe1, 0x1000, 0x3f, 0x6, 0x4c, 0x7ff, 0x80000000, 0x7569, 0x80000000, 0x80000000, 0x9, 0x2, 0x100, 0x80000001, 0x0, 0x0, 0x0, 0x9, 0x1f, 0x0, 0x3, 0x5, 0x0, 0x7fffffff, 0x6, 0x0, 0x5, 0x7, 0x80000001, 0x8, 0x0, 0x7, 0x0, 0x3, 0x100, 0x2, 0x7, 0x4, 0x1, 0x369, 0x3, 0x4, 0x6f0, 0x84c3, 0x7, 0x2, 0x0, 0x2, 0x8, 0x135bae04, 0x5, 0x8a2, 0x10000, 0x7ff, 0x7, 0x9, 0x2, 0x8001, 0x6, 0x3f, 0x8001, 0x2, 0x10001, 0x8, 0x1, 0x0, 0xbb9, 0x4f0, 0x3, 0x2c, 0x1, 0x10000000, 0x2, 0xffffffff, 0x6, 0x2, 0x3e122ab1, 0xffffffff, 0x4, 0x40, 0x9, 0x1ff, 0xff, 0xf9d3, 0x9, 0x2, 0x6, 0x1, 0x7, 0x4, 0xda25, 0x200, 0x8, 0x4, 0x3a, 0x8000, 0x1f, 0x3ff, 0x4, 0x3, 0x4, 0x7, 0xe103, 0x4, 0x6, 0x8, 0x7, 0xff, 0x10000, 0x7f, 0x0, 0x6, 0x3ff, 0x4, 0x0, 0x2, 0x5, 0x7f, 0x2, 0x8001, 0x8, 0x2, 0x0, 0x6, 0x8, 0x7bc0ad98, 0x7fff, 0x3, 0x10000, 0xfff, 0xcf8, 0x9, 0x3, 0x0, 0x200, 0x0, 0x2, 0x7, 0xf4, 0x1, 0x800, 0x0, 0x6, 0xa5, 0x5, 0x4, 0x6, 0x6, 0x100, 0x8, 0x1, 0x1000, 0xeed, 0x0, 0x1f5, 0x0, 0x1, 0x0, 0xe83c, 0x3, 0x9, 0x5, 0x0, 0x0, 0x6, 0x3, 0x1, 0x1, 0x7a, 0xfffffff9, 0x6da, 0x904d, 0x40, 0x3, 0x80000000, 0xffff, 0x8a, 0x1, 0x4, 0x3, 0x0, 0x1f, 0x6, 0x20be, 0x87, 0x2, 0x7, 0x5b6d, 0xb34c, 0xfffffbff, 0x0, 0x10000000, 0x2, 0xffffffff, 0x1, 0x7, 0x80000000, 0x5, 0xffffffff, 0x82c0, 0x1, 0x0, 0xab9, 0xffff, 0xfff, 0x17, 0x317, 0x5, 0x8000, 0x80000000, 0x4, 0x10001, 0x54d9, 0xfff, 0x2, 0x7130, 0x7, 0x10000, 0x5, 0x47e, 0x2, 0x1f, 0x8902, 0x80000001, 0x4, 0xfd51, 0x4, 0x8000, 0x3, 0x401, 0x1, 0xfffffffc, 0xf0, 0x1, 0x4, 0x0, 0x0, 0xa67a, 0x21, 0x1f010f64, 0x3f, 0x6, 0xfffeffff, 0x1, 0x0, 0xdd81, 0x1ff, 0x0, 0x5, 0x2, 0x7, 0x2, 0x5, 0x43be74c8, 0x6a, 0x3, 0x6, 0x1b1, 0x0, 0x4, 0x0, 0x6, 0x78, 0x7, 0x3, 0x5, 0x1, 0x7, 0xad9e, 0x0, 0x3, 0xee3a, 0xced, 0x7, 0xfffff001, 0x9, 0x4, 0x3, 0xb302, 0x0, 0x4, 0x1000000, 0x9, 0x7fffffff, 0x10000, 0x1, 0x4, 0x8, 0x3, 0x3f, 0x1f, 0x80000001, 0x1, 0x10001, 0x9, 0x400, 0x7, 0x6, 0x48, 0x4, 0x200, 0x4, 0x6, 0x0, 0x5, 0x401, 0x8, 0xffffff00, 0xffff8000, 0x1, 0x10001, 0x40, 0x1000, 0x80000001, 0x7, 0x5700, 0x6, 0x100, 0x1, 0x7fff, 0x3, 0x1, 0x9, 0xffff0000, 0xd8, 0x400, 0xaf2e, 0x100, 0x6, 0x3, 0x5, 0x9, 0x9, 0x4330, 0xd20, 0x0, 0x6, 0x2, 0x400, 0x4, 0x80000001, 0x0, 0x80, 0x8, 0xffff1a3a, 0x4ae, 0xbf, 0x2, 0xdca6e4e, 0x20, 0x7fff, 0x3ff, 0x7, 0x9, 0x2, 0x80000000, 0x7fffffff, 0x37, 0x9, 0x2, 0xffff152f, 0x5, 0x8, 0x3, 0xffffffff, 0x9, 0x3, 0x6, 0x9, 0xf29c, 0x0, 0x1f, 0x1, 0x1f, 0x8000, 0x7f9, 0xff, 0x3ff, 0x9, 0x2eeef84d, 0x3f, 0x5, 0x9, 0x5, 0x5c7e255c, 0x10000, 0x80, 0xff1, 0x7f, 0x4, 0x0, 0x1, 0x10001, 0x3, 0x60, 0x7fff, 0x6, 0x1, 0xeb, 0x0, 0x1, 0x3, 0xc95, 0x5, 0x7, 0x10001, 0xa, 0x8, 0xfffffff8, 0x0, 0x0, 0x2, 0xfffff801, 0x1, 0x7ff, 0xfffffffd, 0x1, 0xfffffffb, 0x5, 0x2, 0xfffffffa, 0x80000001, 0x2, 0x5, 0x2, 0x400, 0xffff, 0xfffffff8, 0xebc3, 0x8, 0x0, 0x7, 0x8001, 0x4, 0x8, 0x80000001, 0x0, 0x4, 0x9, 0x3f, 0xd8d, 0x73f, 0x1, 0x8406, 0x1f, 0x2, 0xad, 0x681, 0x9, 0x10001, 0x7ed2, 0x0, 0x4, 0x5fe81beb, 0x0, 0x9, 0xfff, 0x7, 0x80, 0x0, 0x2, 0x81, 0x7, 0x0, 0x6, 0xfc, 0x9, 0x400, 0xbe, 0x80, 0x4, 0x5, 0x8, 0x1, 0x0, 0x17, 0x6, 0x4, 0xf5, 0x8, 0x3, 0x8, 0x5c, 0x528, 0x8000, 0x101, 0x8, 0xffffffff, 0x1, 0x1, 0xffff, 0x38, 0x200, 0x100, 0x3, 0x9, 0x8, 0x1, 0x7, 0x6, 0x8000, 0x2, 0x3f, 0x1559990a, 0x0, 0x40, 0x20, 0x56, 0x1, 0x80000000, 0x4, 0x7, 0x1, 0xbe91, 0x6, 0xad, 0x3, 0x5, 0xffffff80, 0x8001, 0x0, 0x1, 0x1, 0x8000, 0x9, 0xfff, 0x8000, 0x7, 0x80000001, 0xc8, 0x9f51, 0x4, 0xfffffffb, 0xffffff7f, 0x7f, 0x109b, 0xffff, 0x9a, 0x0, 0x5, 0x9, 0x81, 0x137e7ac, 0x0, 0xf9b8, 0x8, 0x5, 0x6, 0x3f, 0x8, 0x8001, 0x88, 0x6, 0x92, 0x5, 0x6, 0x80000000, 0x0, 0x7f, 0xe7, 0x1ff, 0x7, 0x2, 0x1, 0x8000000, 0x9, 0x1ff, 0x7, 0x5, 0x6, 0x5, 0x1000, 0x8, 0x5, 0x8, 0x7fff, 0x3, 0xa4, 0x1, 0x9, 0x7, 0xd9, 0xfffffff7, 0xff, 0x6, 0x8, 0x62, 0x2, 0x52, 0x9, 0x5e, 0x5, 0xfff, 0x66f3, 0x6, 0x0, 0x40, 0x9c6a, 0x396bbce5, 0x7fff, 0x1, 0xffff, 0x5, 0xfff, 0x10000, 0x1, 0x40, 0x1, 0xea, 0x1, 0x1, 0x408, 0x1, 0x81, 0x2, 0x4, 0xffffffff, 0x6, 0x9, 0x7, 0x7, 0x8, 0xfffffff7, 0x20, 0x5, 0xcd7d, 0x7fff, 0x9, 0x0, 0x9, 0x3, 0xffffffe0, 0x40, 0x1, 0x7, 0x2, 0x9789, 0xfff, 0x7, 0x80000001, 0x6, 0x1, 0x8, 0x0, 0x0, 0x450046d4, 0x1d, 0x0, 0x9, 0x7fff, 0x3, 0x3, 0xe99, 0x8001, 0x9, 0x3, 0xffffffff, 0x8, 0x2, 0x6, 0x30, 0x80000000, 0x8, 0x4, 0x3, 0xfffffff7, 0x5, 0x3, 0x82, 0x9, 0x2, 0x2, 0x26, 0x80, 0xc2, 0x5, 0xd06, 0x1, 0x5, 0x25, 0x0, 0x7, 0x6, 0x4, 0x2, 0x80000001, 0x7f, 0x2, 0x100, 0x100, 0x20, 0x7, 0x8a, 0x2, 0x6, 0x8, 0x4, 0x6, 0x7fff, 0x2fc, 0x724d, 0x1000, 0x4, 0x100, 0xd25d63e4, 0x0, 0x3, 0x0, 0x0, 0xb1d6, 0x1, 0x2, 0x9, 0x3, 0x3, 0x9, 0x0, 0x3, 0x5, 0x3, 0x10000, 0x5, 0x4, 0xc1f, 0x5, 0x9, 0x40a, 0x7f, 0x4, 0x100, 0x1, 0x2, 0x4ed88733, 0x2, 0x5, 0x10001, 0x0, 0x7, 0x101, 0x3ff, 0x1, 0x1, 0xffffff80, 0x3bf07892, 0x1, 0x3, 0x1, 0x8, 0x0, 0xfffffffa, 0x2000000, 0x4, 0x7, 0x3, 0x6, 0x2, 0x3, 0x6f0, 0x8000, 0x9, 0x80000001, 0x4, 0x40, 0x5, 0x40, 0x8, 0x6, 0x93, 0x46ba, 0x1000, 0x1, 0x80, 0x80, 0x3, 0x5, 0x8, 0x80000000, 0x4, 0x401, 0xffffffff, 0xe7c, 0xfff, 0x9, 0xffffffff, 0x9d7, 0x8000, 0x2, 0x5, 0x8, 0x80, 0x9, 0x8, 0x62ae, 0x1c, 0x8b, 0x101, 0x400, 0x27, 0x9, 0x80, 0x3, 0x8c, 0x101, 0x5, 0x6, 0xfff, 0x40, 0xff, 0xd36e, 0x2, 0xc42a, 0xffff, 0x9000, 0xffffffff, 0x9d6, 0x10001, 0xffff, 0x5, 0xfffffffc, 0x2, 0x8000, 0x15, 0xfffffffd, 0x6, 0x401, 0x40, 0x1f, 0x6762, 0x692, 0x13, 0x5, 0xa2d5, 0xff, 0x6553, 0x0, 0x6, 0x169, 0x61, 0x0, 0x12, 0x6, 0x9, 0x4, 0x4, 0x5fb6a461, 0x560, 0x5, 0x1, 0xd389, 0x2, 0x401, 0x8, 0xffff9aee, 0x8001, 0x8, 0x3, 0x88, 0xffff, 0xf2, 0x2, 0x1, 0x81, 0xfffffff9, 0x20, 0x9, 0x81, 0xff, 0x8a53, 0x100, 0x10001, 0x3, 0x2, 0x7, 0x2, 0x81, 0x80, 0x3, 0x7f, 0xfd6, 0x53, 0x8, 0xffffffff, 0x4, 0x9, 0x80, 0x3, 0x7c43, 0x4b1]}) ioctl$HIDIOCSUSAGE(r0, 0x4018480c, &(0x7f0000001140)={0x2, 0x1, 0xc05, 0x3, 0x100, 0x1}) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001180), r0) ioctl$HIDIOCGREPORTINFO(0xffffffffffffffff, 0xc00c4809, &(0x7f00000011c0)={0x2, 0x100}) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000001200)) r3 = openat$cgroup(r0, &(0x7f0000001240)='syz1\x00', 0x200002, 0x0) openat$cgroup_procs(r3, &(0x7f0000001280)='tasks\x00', 0x2, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x24, r2, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x7368fac98d950a9d}, 0x20000000) r4 = syz_open_dev$vcsn(&(0x7f00000013c0), 0xfff, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f0000001400)={0x3c302313, 0x40, 0x9, 0x1, 0x7}, 0x14) r5 = syz_open_dev$hiddev(&(0x7f0000001440), 0x1, 0x161202) ioctl$HIDIOCGPHYS(r5, 0x80404812, &(0x7f0000001480)) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000014c0)={0x100, 0x6, 0x3, 0xc1be, 0x2}, 0x14) r6 = syz_open_dev$vcsn(&(0x7f0000001500), 0x4, 0x0) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3) sendmsg$DEVLINK_CMD_PORT_SPLIT(r6, &(0x7f0000001740)={&(0x7f0000001540), 0xc, &(0x7f0000001700)={&(0x7f0000001580)={0x154, 0x0, 0x20, 0x70bd28, 0x25dfdbfc, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0x9, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0x9, 0x2}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0x9, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0x9, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x9, 0x7}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0x9, 0x5}}]}, 0x154}, 0x1, 0x0, 0x0, 0x8001}, 0x40000405) [ 64.517494] ================================================================== [ 64.518820] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x66d/0x6d0 [ 64.519985] Read of size 2 at addr ffff88800ea478f8 by task kworker/u11:1/289 [ 64.524834] [ 64.527545] CPU: 1 UID: 0 PID: 289 Comm: kworker/u11:1 Not tainted 6.18.0-rc5-next-20251114 #1 PREEMPT(voluntary) [ 64.527580] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 64.527596] Workqueue: hci0 hci_cmd_work [ 64.527631] Call Trace: [ 64.527640] [ 64.527650] dump_stack_lvl+0xca/0x120 [ 64.527682] print_report+0xcb/0x610 [ 64.527714] ? __virt_addr_valid+0x100/0x5d0 [ 64.527743] ? hci_cmd_work+0x66d/0x6d0 [ 64.527774] ? hci_cmd_work+0x66d/0x6d0 [ 64.527806] kasan_report+0xca/0x100 [ 64.527837] ? hci_cmd_work+0x66d/0x6d0 [ 64.527872] hci_cmd_work+0x66d/0x6d0 [ 64.527906] process_one_work+0x8e1/0x19c0 [ 64.527948] ? __pfx_process_one_work+0x10/0x10 [ 64.527983] ? rcuwait_wake_up+0x27/0x290 [ 64.528017] ? move_linked_works+0x172/0x270 [ 64.528044] ? assign_work+0x196/0x240 [ 64.528079] worker_thread+0x67e/0xe90 [ 64.528114] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 64.528144] ? __pfx_worker_thread+0x10/0x10 [ 64.528180] kthread+0x3c8/0x740 [ 64.528212] ? __pfx_kthread+0x10/0x10 [ 64.528243] ? ret_from_fork+0x79/0x7a0 [ 64.528268] ? lock_release+0xc8/0x290 [ 64.528306] ? __pfx_kthread+0x10/0x10 [ 64.528338] ret_from_fork+0x67a/0x7a0 [ 64.528362] ? __pfx_ret_from_fork+0x10/0x10 [ 64.528389] ? __switch_to+0x759/0x1060 [ 64.528422] ? __pfx_kthread+0x10/0x10 [ 64.528455] ret_from_fork_asm+0x1a/0x30 [ 64.528496] [ 64.528504] [ 64.551295] Allocated by task 288: [ 64.551897] kasan_save_stack+0x24/0x50 [ 64.552584] kasan_save_track+0x14/0x30 [ 64.553278] __kasan_slab_alloc+0x59/0x70 [ 64.553989] kmem_cache_alloc_node_noprof+0x228/0x6b0 [ 64.554891] __alloc_skb+0x2ab/0x370 [ 64.555553] hci_cmd_sync_alloc+0x34/0x300 [ 64.556285] __hci_cmd_sync_sk+0xf7/0x5c0 [ 64.557012] __hci_cmd_sync_status_sk+0x4d/0x1a0 [ 64.557843] hci_dev_open_sync+0x10ef/0x1f60 [ 64.558607] hci_power_on+0xdb/0x5d0 [ 64.559264] process_one_work+0x8e1/0x19c0 [ 64.559997] worker_thread+0x67e/0xe90 [ 64.560679] kthread+0x3c8/0x740 [ 64.561271] ret_from_fork+0x67a/0x7a0 [ 64.561940] ret_from_fork_asm+0x1a/0x30 [ 64.562648] [ 64.562945] Freed by task 290: [ 64.563499] kasan_save_stack+0x24/0x50 [ 64.564180] kasan_save_track+0x14/0x30 [ 64.564872] kasan_save_free_info+0x3a/0x60 [ 64.565618] __kasan_slab_free+0x43/0x70 [ 64.566327] kmem_cache_free+0x26f/0x500 [ 64.567041] kfree_skbmem+0x18a/0x1f0 [ 64.567700] sk_skb_reason_drop+0x10e/0x1b0 [ 64.568436] vhci_read+0x3d5/0x5d0 [ 64.569062] vfs_read+0x1eb/0xc70 [ 64.569662] ksys_read+0x121/0x240 [ 64.570278] do_syscall_64+0xbf/0x430 [ 64.570959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 64.571833] [ 64.572129] The buggy address belongs to the object at ffff88800ea478c0 [ 64.572129] which belongs to the cache skbuff_head_cache of size 232 [ 64.574266] The buggy address is located 56 bytes inside of [ 64.574266] freed 232-byte region [ffff88800ea478c0, ffff88800ea479a8) [ 64.576277] [ 64.576577] The buggy address belongs to the physical page: [ 64.577519] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xea47 [ 64.578869] memcg:ffff888009c26d81 [ 64.579479] anon flags: 0x100000000000000(node=0|zone=1) [ 64.580388] page_type: f5(slab) [ 64.580966] raw: 0100000000000000 ffff8880096c78c0 ffffea00002e1340 dead000000000003 [ 64.582260] raw: 0000000000000000 00000000800c000c 00000000f5000000 ffff888009c26d81 [ 64.583582] page dumped because: kasan: bad access detected [ 64.584536] [ 64.584837] Memory state around the buggy address: [ 64.585662] ffff88800ea47780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.586888] ffff88800ea47800: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 64.588108] >ffff88800ea47880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 64.589328] ^ [ 64.590528] ffff88800ea47900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.591728] ffff88800ea47980: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 64.592739] ================================================================== [ 64.593860] Disabling lock debugging due to kernel taint [ 64.595495] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 64.598273] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 64.602562] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 64.606779] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 64.614801] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 64.648478] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 64.649475] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 64.652152] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 64.655352] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 64.657463] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 64.658787] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 64.661438] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 64.663963] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 64.666300] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 64.667892] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 64.710742] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 64.716261] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 64.718142] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 64.722167] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 64.723605] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 64.728379] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 64.729856] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 64.731744] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 64.733617] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 64.735024] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 64.737413] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 64.738901] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 64.740356] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 64.742037] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 64.743549] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 64.748607] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 64.751105] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 64.752737] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 64.756057] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 64.757131] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 64.760409] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 64.761949] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 64.763853] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 64.781920] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 64.785566] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 66.680276] Bluetooth: hci0: command tx timeout [ 66.744229] Bluetooth: hci2: command tx timeout [ 66.744390] Bluetooth: hci1: command tx timeout [ 66.807414] Bluetooth: hci5: command tx timeout [ 66.807466] Bluetooth: hci3: command tx timeout [ 66.808972] Bluetooth: hci6: command tx timeout [ 66.809074] Bluetooth: hci7: command tx timeout [ 66.872338] Bluetooth: hci4: command tx timeout [ 68.729198] Bluetooth: hci0: command tx timeout [ 68.791224] Bluetooth: hci1: command tx timeout [ 68.792229] Bluetooth: hci2: command tx timeout [ 68.857203] Bluetooth: hci7: command tx timeout [ 68.857670] Bluetooth: hci6: command tx timeout [ 68.858060] Bluetooth: hci5: command tx timeout [ 68.858475] Bluetooth: hci3: command tx timeout [ 68.921197] Bluetooth: hci4: command tx timeout [ 70.775234] Bluetooth: hci0: command tx timeout [ 70.839306] Bluetooth: hci2: command tx timeout [ 70.839406] Bluetooth: hci1: command tx timeout [ 70.903412] Bluetooth: hci7: command tx timeout [ 70.903434] Bluetooth: hci3: command tx timeout [ 70.903458] Bluetooth: hci5: command tx timeout [ 70.903469] Bluetooth: hci6: command tx timeout [ 70.969354] Bluetooth: hci4: command tx timeout [ 72.824239] Bluetooth: hci0: command tx timeout [ 72.887328] Bluetooth: hci1: command tx timeout [ 72.888249] Bluetooth: hci2: command tx timeout [ 72.951252] Bluetooth: hci7: command tx timeout [ 72.953018] Bluetooth: hci6: command tx timeout [ 72.953862] Bluetooth: hci5: command tx timeout [ 72.953975] Bluetooth: hci3: command tx timeout [ 73.015275] Bluetooth: hci4: command tx timeout VM DIAGNOSIS: 20:04:30 Registers: info registers vcpu 0 RAX=dffffc0000000000 RBX=ffffffff85e78528 RCX=ffffffff8175bd25 RDX=1ffffffff0bcf0a5 RSI=ffffffff8175bccb RDI=0000000000000001 RBP=0000000000000001 RSP=ffff888016c57658 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=ffffffff85e78528 R15=0000000000000cc0 RIP=ffffffff817533e8 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007fdc05f0f8c0 00000000 00000000 GS =0000 ffff8880e538f000 00000000 00000000 LDT=0000 fffffe6a00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f6db99ee070 CR3=000000000aba3000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f6db9ab17c000007f6db9ab17c8 XMM02=00007f6db9ab17e000007f6db9ab17c0 XMM03=00007f6db9ab17c800007f6db9ab17c0 XMM04=ffffffffffffffffffffffffffffff00 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=000000000000005b RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff8293dd05 RDI=ffffffff889747c0 RBP=ffffffff88974780 RSP=ffff888015927618 R8 =0000000000000000 R9 =ffffed1001532046 R10=000000000000005b R11=fffffffffffc95e0 R12=000000000000005b R13=0000000000000010 R14=ffffffff88974780 R15=ffffffff8293dcf0 RIP=ffffffff8293dd5d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e548f000 00000000 00000000 LDT=0000 fffffe6300000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00005555558436e8 CR3=000000000e269000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ce0cefa382b4138c1a7444112c80720a XMM01=9a145e939937aaa2da5f088982fe22e5 XMM02=682990f42b81579d42f35d4003ddb02b XMM03=811747b7a1fe0749af1da4f4e3853c15 XMM04=0000000000000000000000002fee5620 XMM05=00000000000000000000002b0000002b XMM06=0000000000000000000000000000002b XMM07=0000002b0000002b2fee56200000002a XMM08=8800000038000000ee000000d2000000 XMM09=00000000000000000000000000000000 XMM10=4599bb0d5d9eb325e3fffe317c5e2174 XMM11=92f73f66007f4f929b80b66cb2f268b4 XMM12=0d0c0f0e09080b0a0504070601000302 XMM13=0c0f0e0d080b0a090407060500030201 XMM14=00000000000000000000000000000b00 XMM15=00000000000000000000000000000040