Debian GNU/Linux 11 syzkaller ttyS0

Warning: Permanently added '[localhost]:32231' (ECDSA) to the list of known hosts.
2025/04/27 23:25:48 fuzzer started
2025/04/27 23:25:49 dialing manager at localhost:46629
syzkaller login: [   94.433552] cgroup: Unknown subsys name 'net'
[   94.565995] cgroup: Unknown subsys name 'cpuset'
[   94.602589] cgroup: Unknown subsys name 'rlimit'
2025/04/27 23:26:05 syscalls: 205
2025/04/27 23:26:05 code coverage: enabled
2025/04/27 23:26:05 comparison tracing: enabled
2025/04/27 23:26:05 extra coverage: enabled
2025/04/27 23:26:05 setuid sandbox: enabled
2025/04/27 23:26:05 namespace sandbox: enabled
2025/04/27 23:26:05 Android sandbox: enabled
2025/04/27 23:26:05 fault injection: enabled
2025/04/27 23:26:05 leak checking: enabled
2025/04/27 23:26:05 net packet injection: enabled
2025/04/27 23:26:05 net device setup: enabled
2025/04/27 23:26:05 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/04/27 23:26:05 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/04/27 23:26:05 USB emulation: enabled
2025/04/27 23:26:05 hci packet injection: enabled
2025/04/27 23:26:05 wifi device emulation: enabled
2025/04/27 23:26:05 802.15.4 emulation: enabled
2025/04/27 23:26:05 fetching corpus: 0, signal 0/0 (executing program)
2025/04/27 23:26:06 starting 8 fuzzer processes
23:26:06 executing program 0:
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0xc)
sendmsg$NL80211_CMD_GET_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x0, 0x800, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x800)
r0 = socket$netlink(0x10, 0x3, 0x1)
sendmsg$IPVS_CMD_DEL_DEST(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x50, 0x0, 0x2, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x22, 0x11}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x33}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}]}, 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x801)
r1 = socket$netlink(0x10, 0x3, 0x7)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff)
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000003c0)={'gre0\x00', &(0x7f0000000340)={'tunl0\x00', <r3=>0x0, 0x80, 0x7800, 0x4, 0x3, {{0x11, 0x4, 0x2, 0x5, 0x44, 0x64, 0x0, 0x40, 0x29, 0x0, @rand_addr=0x64010100, @multicast1, {[@ra={0x94, 0x4}, @cipso={0x86, 0x2a, 0x3, [{0x6, 0x9, "20a74d09b83024"}, {0x7, 0x8, "7bb322f41572"}, {0x0, 0x4, "0baf"}, {0x5, 0xf, "9ded880bf57f2a60b3a1145909"}]}]}}}}})
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000540)={'syztnl1\x00', &(0x7f00000004c0)={'syztnl2\x00', <r4=>0x0, 0x29, 0x1, 0xff, 0x4, 0x4a, @ipv4={'\x00', '\xff\xff', @empty}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2e}}, 0x7, 0x7, 0xff, 0x4b5}})
r5 = accept4$packet(0xffffffffffffffff, &(0x7f0000000580)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000005c0)=0x14, 0x80000)
r7 = accept$packet(0xffffffffffffffff, &(0x7f0000000600)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000640)=0x14)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r1, &(0x7f00000008c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000000680)={0x1c8, r2, 0x430, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}]}, @HEADER={0x4}]}, 0x1c8}, 0x1, 0x0, 0x0, 0x4000080}, 0x10)
geteuid()
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000a80)={'gre0\x00', &(0x7f00000009c0)={'erspan0\x00', <r9=>r8, 0x1, 0x1, 0x0, 0x98e6, {{0x27, 0x4, 0x1, 0x9, 0x9c, 0x64, 0x0, 0x3, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x8}, @remote, {[@timestamp_prespec={0x44, 0x34, 0xf7, 0x3, 0xb, [{@multicast1, 0x4}, {@dev={0xac, 0x14, 0x14, 0x32}, 0x7d2a}, {@remote, 0xff}, {@multicast1, 0x3}, {@empty, 0xfffffffd}, {@loopback, 0xff}]}, @timestamp_prespec={0x44, 0xc, 0x99, 0x3, 0x5, [{@dev={0xac, 0x14, 0x14, 0xa}, 0x40}]}, @timestamp={0x44, 0x1c, 0x22, 0x0, 0xf, [0x1, 0x0, 0x7, 0x5a5c, 0x3f, 0x80000001]}, @rr={0x7, 0x13, 0x15, [@dev={0xac, 0x14, 0x14, 0x8}, @broadcast, @local, @multicast1]}, @cipso={0x86, 0x15, 0x2, [{0x7, 0xf, "97a0f8bc27e635b7c12181b55d"}]}, @end]}}}}})
recvfrom$packet(r5, &(0x7f0000000900)=""/144, 0x90, 0x0, &(0x7f0000000ac0)={0x11, 0x1, r9, 0x1, 0xa7, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}}, 0x14)
ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000b00))
getsockopt$packet_buf(r7, 0x107, 0x5, &(0x7f0000000b40), &(0x7f0000000b80))
r10 = socket$inet_icmp(0x2, 0x2, 0x1)
setsockopt$inet_icmp_ICMP_FILTER(r10, 0x1, 0x1, &(0x7f0000000bc0)={0x7}, 0x4)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000c00), r0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000c40)='./binderfs2/custom0\x00', 0x802, 0x0)

23:26:07 executing program 1:
r0 = getgid()
getgroups(0x4, &(0x7f0000000000)=[<r1=>0x0, <r2=>0x0, <r3=>0xee01, <r4=>0x0])
getgroups(0x2, &(0x7f0000000040)=[r0, r4])
r5 = getegid()
r6 = socket(0x10, 0x6, 0x9a)
connect$netlink(r6, &(0x7f0000000140)=@kern={0x10, 0x0, 0x0, 0xc0021106}, 0xc)
getgroups(0x4, &(0x7f0000000180)=[r5, <r7=>r2, r1, r4])
r8 = getegid()
getresgid(&(0x7f00000001c0)=<r9=>0x0, &(0x7f0000000200), &(0x7f0000000240))
getresgid(&(0x7f0000000280), &(0x7f00000002c0)=<r10=>0x0, &(0x7f0000000300))
r11 = getgid()
getgroups(0x8, &(0x7f0000000340)=[r7, r0, <r12=>r8, r2, r9, <r13=>r10, <r14=>r11, 0xffffffffffffffff])
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, 0x0, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40400c0}, 0x4084)
getresgid(&(0x7f0000000480), &(0x7f00000004c0)=<r15=>0x0, &(0x7f0000000500))
r16 = getgid()
r17 = getegid()
getgroups(0x7, &(0x7f0000000540)=[r3, r14, r15, r16, r13, r17, <r18=>r12])
r19 = socket$nl_netfilter(0x10, 0x3, 0xc)
getsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f00000005c0)={{{@in=@multicast2, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r20=>0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={""/10, ""/2, @broadcast}}}, &(0x7f00000006c0)=0xe8)
sendmsg$netlink(r19, &(0x7f0000000b40)={&(0x7f0000000580)=@proc={0x10, 0x0, 0x25dfdbfc, 0x4000}, 0xc, &(0x7f0000000ac0)=[{&(0x7f0000000740)={0x11c, 0x21, 0x400, 0x70bd26, 0x25dfdbfe, "", [@typed={0xb, 0x5c, 0x0, 0x0, @str=')$),@}\x00'}, @generic="8bd7d789fe1e17e305805737e1bf7eb0e3c9ff5ee3d21aef4a4532002b8cc427df225f733ddb067f043267a4b4a1742c39a96b990432d5b927ef94106b6a0d906bfb7de2b824fb9e6d330e7100c5c92f5ef2f019acaf935dd532e97bb0e9e76349b58048b3a3b422a92667056d16398ef1560fa49326ce45f48a1c2e70e132a620e4861f43c6ff818f8c3c2b023659eed2077fa0d57d0f368f2fd711b49d3c596d37368e454d11fb1d0db80b2e0003d76cfc01ca3f9f4063ef6802397350b629fc61ee9e625e112c987552d75be7f7b8824ad7771c90b31041ddc7b1778feb0b1ff862ec0acf3d4f2cc024f5b7", @typed={0x8, 0x69, 0x0, 0x0, @uid=r20}, @typed={0x8, 0x5, 0x0, 0x0, @fd}]}, 0x11c}, {&(0x7f0000000880)={0x10, 0x2e, 0x0, 0x70bd2c, 0x25dfdbfe}, 0x10}, {&(0x7f00000008c0)={0x1e4, 0x2b, 0x10, 0x70bd28, 0x25dfdbfd, "", [@typed={0x8, 0x1f, 0x0, 0x0, @uid=0xee01}, @nested={0x1cb, 0x8d, 0x0, 0x1, [@generic="2a738d2e8b4b5786382a0fc7453b1863315f7033bb72cba7911f59c61cf89bafef35acb90b86c1e02c069d6c88c7e18cf9dc36aa36b7a8fea7da41044fe29346831ee58445340a30f0b31acb1d44f2b76715cb324ed61c380d6fc55a6ef9ceb2d57799ccfa0f1c4e74053ff4ae069550da5037ee668150046a46affc42d947ea80baf90fc7dab54e490d30e4a741b25942041864402f3586c772be0ddbffbfb15766bd3a123a780155f9103fa9cede873b38ee8441d5f5e53c8d6028c5f27dd3629f4e42e6279998e4d4cf560210f5f95f5c27571c5a56b558ec94", @typed={0x6, 0x2b, 0x0, 0x0, @str='@\x00'}, @generic="e92fc563018ba90f49a82da26a43d800348f8247a9f23cc27f777871bebc752fa562e7b33aeb97a4941d58b0369546ea836bd129a5d91892e523f57bea8cc99be43f17e1b8aa5bddef84d0d17c61d4ac7feacddfde0f0315f17a924138a3ea1645b3ca3abf265e61944d713e2978d6abdccbb3de63586310a51f4840014d53abf4a9038a3ff35f29a27c4e1b3eccdf209d49ea838e080f9947b3d3afd549b4c0593972b743b788bd5ee60da4a2a1f7a4632990d8a4875d235ab5c65e49962973f6704a53183fb3cd88fc4ac8c7407445082bd36d961adbf44422517da45945900804c244"]}]}, 0x1e4}], 0x3, &(0x7f0000000b00)=[@cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee00, r18}}}], 0x20, 0x20000044}, 0x48840)

23:26:07 executing program 2:
setsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000000)={0x7, "a67609"}, 0x6)
ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x401})
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x2, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x5}, 0xe)
getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4)
r0 = socket(0x1a, 0x2, 0x67)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
r1 = socket$packet(0x11, 0xe85100fe664eeb6c, 0x300)
getsockname$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r0)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x3c, r2, 0x800, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x3c}}, 0x80)
accept4(r0, &(0x7f0000000380)=@phonet, &(0x7f0000000400)=0x80, 0x800)
r3 = socket$inet6_icmp(0xa, 0x2, 0x3a)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000440)={'vlan1\x00'})
r4 = socket(0x6, 0x6, 0x0)
getpeername$packet(r4, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000004c0)=0x14)
r5 = accept4(r4, &(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, <r6=>0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @local}}}}, &(0x7f0000000580)=0x80, 0x80000)
accept4(r6, &(0x7f00000005c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000640)=0x80, 0x0)
inotify_init()
sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000007c0)={&(0x7f00000006c0)={0xd8, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x20}, @NL80211_ATTR_REG_RULES={0xb4, 0x22, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x1ff}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x5}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x9}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x4}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x5}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x1}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x4}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x1}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x7f}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x8000}]}, {0x54, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x4}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xff0}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x7200000}, @NL80211_ATTR_FREQ_RANGE_START={0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x6}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xfffffff8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x6}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xb178}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x1ff}, @NL80211_ATTR_FREQ_RANGE_START={0x8}]}]}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}]}, 0xd8}, 0x1, 0x0, 0x0, 0x4000}, 0x20008000)
getsockopt$bt_l2cap_L2CAP_CONNINFO(r5, 0x6, 0x2, &(0x7f0000000840), &(0x7f0000000880)=0x6)

23:26:07 executing program 3:
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x130f})
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom0\x00', 0x802, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080))
r1 = socket(0x27, 0x4, 0x4)
bind$bt_l2cap(r1, &(0x7f00000000c0)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0xe)
ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000100))
setsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000140)=0x2, 0x4)
r2 = inotify_init1(0x80000)
inotify_add_watch(r2, &(0x7f0000000180)='./file0\x00', 0x40000000)
r3 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x80002, 0x0)
inotify_add_watch(r3, &(0x7f0000000200)='./file0\x00', 0x10000a00)
ioctl$BINDER_GET_FROZEN_INFO(r0, 0xc00c620f, &(0x7f0000000240))
getsockopt$packet_buf(r0, 0x107, 0x1e, &(0x7f0000000280)=""/169, &(0x7f0000000340)=0xa9)
socketpair(0x2, 0x80005, 0xad09, &(0x7f0000000380)={<r4=>0xffffffffffffffff})
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000000480)={'gretap0\x00', &(0x7f00000003c0)={'erspan0\x00', 0x0, 0x7, 0x720, 0x8, 0x0, {{0x21, 0x4, 0x3, 0x1, 0x84, 0x66, 0x0, 0x6a, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010102, {[@rr={0x7, 0xf, 0x20, [@broadcast, @multicast2, @private=0xa010101]}, @timestamp={0x44, 0x10, 0x5f, 0x0, 0x2, [0x7ff, 0x3, 0xff]}, @ssrr={0x89, 0xf, 0xe4, [@broadcast, @local, @empty]}, @ra={0x94, 0x4, 0x1}, @generic={0x83, 0x3, "b5"}, @timestamp={0x44, 0x20, 0x40, 0x0, 0xc, [0xfffffe01, 0x800, 0x8001, 0xaca, 0xffff, 0xfffffff7, 0x1]}, @lsrr={0x83, 0x13, 0xa4, [@private=0xa010102, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @rand_addr=0x64010100]}, @lsrr={0x83, 0x7, 0xd4, [@loopback]}]}}}}})
connect$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0xfff, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1000, 0x1}, 0xe)
r5 = fork()
timer_create(0x4, &(0x7f0000000500)={0x0, 0x18, 0x0, @tid=r5}, &(0x7f0000000540))
ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000780)={'sit0\x00', &(0x7f0000000700)={'ip6_vti0\x00', 0x0, 0x4, 0x0, 0x81, 0x73a24921, 0x11, @mcast2, @empty, 0x20, 0x8000, 0xdaa1, 0x2}})

[  112.253223] audit: type=1400 audit(1745796367.108:7): avc:  denied  { execmem } for  pid=272 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
23:26:07 executing program 4:
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000040)={'gretap0\x00', &(0x7f0000000000)={'syztnl1\x00', <r0=>0x0, 0x20, 0x700, 0x3334, 0x2, {{0x6, 0x4, 0x0, 0x20, 0x18, 0x68, 0x0, 0x20, 0x29, 0x0, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@end]}}}}})
sendmsg$TIPC_NL_NODE_GET(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f00000000c0)={0x26c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x10, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x40}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffffffffffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfffffffffffffe00}]}, @TIPC_NLA_BEARER={0x108, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x80000000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1ea6}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x8, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x9}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'vlan0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x7, @empty, 0xd6e}}, {0x14, 0x2, @in={0x2, 0x4e20, @loopback}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x38000}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @remote}}}}]}, @TIPC_NLA_LINK={0x11c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc0ae}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf018}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x26c}, 0x1, 0x0, 0x0, 0x20004050}, 0x4004800)
unshare(0x0)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000003c0), 0x458581, 0x0)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r1, 0x8008330e, &(0x7f0000000400))
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000540)={'syztnl1\x00', &(0x7f0000000440)={'erspan0\x00', r0, 0x7, 0x7, 0xfffff000, 0x5, {{0x32, 0x4, 0x1, 0x0, 0xc8, 0x68, 0x0, 0x6, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote, {[@noop, @rr={0x7, 0x17, 0xd4, [@local, @remote, @empty, @multicast2, @broadcast]}, @timestamp_prespec={0x44, 0xc, 0xbb, 0x3, 0xc, [{@private=0xa010101, 0x8001}]}, @rr={0x7, 0x23, 0x18, [@local, @rand_addr=0x64010100, @remote, @private=0xa010100, @multicast1, @multicast1, @multicast1, @multicast1]}, @rr={0x7, 0x7, 0x60, [@private=0xa010102]}, @lsrr={0x83, 0xf, 0x72, [@multicast1, @local, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @cipso={0x86, 0x29, 0x3, [{0x6, 0xb, "3b4535d01a05eb797a"}, {0x7, 0xd, "dab8627605af712b5bbb13"}, {0x1, 0x8, "4ab511c895c9"}, {0x0, 0x3, '4'}]}, @timestamp={0x44, 0x28, 0x7b, 0x0, 0x0, [0x6, 0xd484, 0x4, 0x4, 0x401, 0xfffffff7, 0x5, 0x76b, 0x9]}, @ra={0x94, 0x4}]}}}}})
sendmsg$nl_generic(r1, &(0x7f0000000780)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000740)={&(0x7f00000005c0)={0x154, 0x3b, 0x0, 0x70bd28, 0x25dfdbff, {0x19}, [@generic="8930b2aeb3487f1b7aad0cc8b1edf2c2571a31999068c3942e4905c87bb13c6fc34f162daaeb668c4d3fc18c65f17a13e8f4b05036633b097edc6c60c7c816060b31abdf73a31e2c6517c39664f9895847172333e20fb8f8908eafce9d94c14238c62a600da73dcf7100f8bf10d8eff5a114378ae597c7c46c86a6739db6ede1e6cc464dbe37", @nested={0xa4, 0x9, 0x0, 0x1, [@typed={0xa0, 0x52, 0x0, 0x0, @binary="cebaa46fa9df65ae9a1c584986810d984351041005a2a13cc5bb9143c1e654da63fcbbfd808c97e5c5e512eed5277a9c2438998178f38928507f501b530910def663ea5e5fe170e16090d8aa572c9f9d04ceb09c27d42b2fe854757248b80e163f7b8493d6a0875ae9e8a21bd7ebb0eab39b5e8e9fba5f02cad38369b6758c7b3e173b041168f3d99e7220785b8632230a63cba9a2a3dc7c3adc8916"}]}, @nested={0x13, 0x45, 0x0, 0x1, [@generic="38e8dd356e1cb6cbddaf787a45f62b"]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4024025}, 0x4000840)
sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0xb0, 0x0, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x40, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x200}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8001}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2e}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4000080}, 0x10000)
r2 = socket(0x1d, 0x800, 0x4)
getsockopt$packet_int(r2, 0x107, 0x8, &(0x7f0000000940), &(0x7f0000000980)=0x4)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$TIPC_NL_KEY_FLUSH(r3, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x90, 0x0, 0x200, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xeb29}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x400}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1f}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x240000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x200}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7bd}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x34}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffffffff}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000)
sendmsg$SEG6_CMD_GET_TUNSRC(r1, &(0x7f0000000c00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x40, 0x0, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x9, 0xfffffff9, 0x8001]}, @SEG6_ATTR_DST={0x14, 0x1, @local}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040010}, 0x4000000)
r4 = socket(0x10, 0x7, 0x3)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c80), r2)
sendmsg$NL80211_CMD_START_P2P_DEVICE(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x14, r5, 0x200, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x8081)
setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000dc0)={0x1, &(0x7f0000000d80)=[{0x4, 0x9, 0x0, 0x40}]}, 0x10)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r3, &(0x7f0000000ec0)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)={0x24, 0x0, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000f00))
getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000f40), &(0x7f0000000f80)=0x4)

23:26:07 executing program 5:
r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x418201, 0x0)
ioctl$PTP_SYS_OFFSET_EXTENDED(r0, 0xc4c03d09, &(0x7f0000000040)={0x2})
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000540), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4104000}, 0xc, &(0x7f0000000680)={&(0x7f0000000580)={0x100, r1, 0x608, 0x70bd26, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}}, {@pci={{0x8}, {0x11}}, {0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}}]}, 0x100}, 0x1, 0x0, 0x0, 0x4000050}, 0x40)
ioctl$PTP_SYS_OFFSET(r0, 0x43403d05, &(0x7f0000000700)={0xc})
ioctl$PTP_SYS_OFFSET(r0, 0x43403d05, &(0x7f0000000a40)={0x5})
sendmsg$NL80211_CMD_SET_BEACON(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001040)={&(0x7f0000000dc0)={0x274, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3f, 0x11}}}}, [@NL80211_ATTR_IE_PROBE_RESP={0x173, 0x7f, [@fast_bss_trans={0x37, 0xd2, {0x35, 0x5, "0e2fab9d072f4f869ff2fc441581ae9f", "b09701f8684a336a8831d4a232f427beaac6e7bc83fb6a63d71eddbe27be62d6", "fe1878995509b3fde39a5d949abfe92a6bdd313a495581d47e3b8e84c24679e6", [{0x3, 0x25, "d7664c93bd2c6428e6fc9d1aaefe6db10fcdc2888a70e0cb12edf1ff51f400df70439550a2"}, {0x3, 0x5, "229b5bdc27"}, {0x2, 0x23, "91b7a1844941f07cfccafa3378d795214fa4b184f974c2c3df6dabcf4d4b21c575aebc"}, {0x4, 0x26, "0bef2e67168639dd97ff63299c82e90725fbe9529695ff8273adc4022e23a1826afe9a3479e2"}, {0x1, 0x3, "4f7fbd"}]}}, @ssid={0x0, 0x6, @default_ap_ssid}, @perr={0x84, 0x89, {0xcd, 0x9, [@ext={{}, @broadcast, 0x3ff, @device_a, 0x11}, @not_ext={{}, @device_b, 0x7f, "", 0x34}, @not_ext={{}, @device_b, 0x2, "", 0x8}, @ext={{}, @broadcast, 0x1, @broadcast, 0x1a}, @ext={{}, @device_a, 0x9, @device_b, 0x8}, @not_ext={{}, @device_a, 0x2, "", 0x1}, @not_ext={{}, @device_b, 0x4, "", 0x34}, @not_ext={{}, @broadcast, 0x5, "", 0x27}, @not_ext={{}, @device_a, 0x5, "", 0x36}]}}, @gcr_ga={0xbd, 0x6, @broadcast}]}, @NL80211_ATTR_IE={0xd7, 0x2a, [@measure_req={0x26, 0x41, {0xff, 0x3, 0xff, "1922932581d34066faa29591d7cb6cf0e0785e74cc7a91a82c42ebd0dba285767de8a1bc7f95cf6b8fb6196198f255877209c309df5dad12e7ec156e4106"}}, @measure_req={0x26, 0x65, {0x1c, 0x2, 0x1, "0f61be576f8754aa2265e4441ae7e3d885408cf88c4759740936e22460e817d0b362f034425cf09b86cbe27d1531bb52d676aa7cc1a303e8ededfa5af38fe5ffa37149a2c7cc1e39ccd94221f1259996a3a7453cd2a079e8d297f7f5fea3b834fdb9"}}, @prep={0x83, 0x1f, @not_ext={{}, 0x4, 0x4, @broadcast, 0xffffff01, "", 0x1, 0x1, @device_a, 0x3}}, @mesh_chsw={0x76, 0x6, {0x8, 0x86, 0x34, 0xc}}]}]}, 0x274}, 0x1, 0x0, 0x0, 0x1}, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001100), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x1c, r2, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48004}, 0x0)
accept4$packet(0xffffffffffffffff, &(0x7f0000001200)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001240)=0x14, 0x0)
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000001340)={'erspan0\x00', &(0x7f0000001280)={'gre0\x00', r3, 0x8, 0x20, 0x9, 0x6, {{0x23, 0x4, 0x3, 0x2, 0x8c, 0x68, 0x0, 0x5d, 0x29, 0x0, @multicast2, @broadcast, {[@rr={0x7, 0x13, 0x7a, [@remote, @empty, @broadcast, @multicast1]}, @timestamp_addr={0x44, 0x2c, 0x76, 0x1, 0x5, [{@loopback, 0x1}, {@multicast1, 0x2}, {@multicast2, 0x8}, {@local, 0x1}, {@broadcast, 0x4}]}, @ra={0x94, 0x4}, @end, @timestamp={0x44, 0x18, 0xce, 0x0, 0x0, [0x7, 0xf1a, 0x7, 0x8, 0x4]}, @ssrr={0x89, 0x1b, 0x30, [@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, @broadcast, @rand_addr=0x64010100, @multicast2]}]}}}}})
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000001380)=0x1, 0x4)
sendmsg$NL80211_CMD_GET_INTERFACE(0xffffffffffffffff, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x20, 0x0, 0x8, 0x70bd26, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x50, 0xf}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
ioctl$SNAPSHOT_SET_SWAP_AREA(0xffffffffffffffff, 0x400c330d, &(0x7f00000014c0)={0x1, 0x1})
ioctl$PTP_CLOCK_GETCAPS(r0, 0x80503d01, &(0x7f0000001500))
ioctl$PTP_SYS_OFFSET_EXTENDED(r0, 0xc4c03d09, &(0x7f0000001580)={0x16})
ioctl$PTP_ENABLE_PPS(r0, 0x40043d04, 0x1)
openat$nvram(0xffffffffffffff9c, &(0x7f0000001a40), 0x10000, 0x0)
r4 = socket$netlink(0x10, 0x3, 0xc)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r4, &(0x7f0000001c80)={&(0x7f0000001b40)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001c40)={&(0x7f0000001b80)={0x84, r1, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0xfff}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0xa63}, {0x6, 0x11, 0xfff}}]}, 0x84}, 0x1, 0x0, 0x0, 0x22004080}, 0x1)

23:26:07 executing program 6:
r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x201, 0x0)
getsockopt$inet_udp_int(r0, 0x11, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4)
r1 = socket(0x18, 0x5, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f00000000c0)=0xffff, 0x4)
r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x301400, 0x0)
ioctl$PTP_ENABLE_PPS(r2, 0x40043d04, 0x0)
r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0)
read$ptp(r3, &(0x7f0000000180)=""/235, 0xeb)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs2/binder1\x00', 0x800, 0x0)
ioctl$PTP_SYS_OFFSET_EXTENDED(r0, 0xc4c03d09, &(0x7f00000002c0)={0x6})
setsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000780)={0x24, "d2872e"}, 0x6)
r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0)
getsockopt$bt_l2cap_L2CAP_CONNINFO(r4, 0x6, 0x2, &(0x7f00000007c0), &(0x7f0000000800)=0x6)
inotify_add_watch(r0, &(0x7f0000000840)='./file0\x00', 0xd000022c)
ioctl$PTP_SYS_OFFSET(r0, 0x43403d05, &(0x7f0000000880)={0x5})
ioctl$PTP_SYS_OFFSET_PRECISE(0xffffffffffffffff, 0xc0403d08, &(0x7f0000000bc0))
setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000c00)=0x9cd3, 0x4)
getpeername$netlink(r0, &(0x7f0000000c40), &(0x7f0000000c80)=0xc)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000cc0)={'wlan1\x00'})
getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000d00), &(0x7f0000000d40)=0xc)

23:26:07 executing program 7:
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, 0x0, 0x100, 0x70bd2a, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0x66, 0x2, 0x3ff, 0x4ac}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4040}, 0x800)
r0 = socket(0x29, 0x800, 0x2)
r1 = syz_genetlink_get_family_id$team(&(0x7f0000000140), 0xffffffffffffffff)
sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x140, r1, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [{{0x8}, {0x124, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x3f}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}]}, 0x140}, 0x1, 0x0, 0x0, 0x50}, 0x4060)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x30, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0x0, 0x3, 0x18000000, 0x3}}}, ["", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x20040080)
r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000440), r0)
r3 = socket$netlink(0x10, 0x3, 0xf)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, &(0x7f0000000480)=0x14, 0x4)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r0)
sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000000680)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000540)={0xe4, r5, 0x4, 0x70bd2d, 0x25dfdbff, {{}, {@void, @void, @val={0xc, 0x99, {0x0, 0x11}}}}, [@NL80211_ATTR_VENDOR_DATA={0xc4, 0xc5, "6363d61087520619fecc442d8cbb18fbdb8d3f6a249188ffd63cfdb4bc4e873b126649087576ce767c4948a773c36549a32c8af6ba5c364a23cc2b5cdde8ae3519ed8670b165431d37b4be26306111fc190c3eed28b0a1449c1b9479a4e4aa79d4970486abf4f6984d9e46b465af4859b66fed22750132e7e1a1e99f4e8ed4c2957cef980af72fa7b3da5c0117ccdea8556cb9b3cf26e3b821733598fa766e237698a0f413986aba052bfbfa4c3ddfa1de5ad57ef27ef306c8784b63f5455672"}]}, 0xe4}, 0x1, 0x0, 0x0, 0x20000000}, 0x8811)
syz_genetlink_get_family_id$team(&(0x7f00000006c0), r0)
r6 = socket(0x10, 0x5, 0x9)
syz_genetlink_get_family_id$gtp(&(0x7f0000000700), r6)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), r6)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x30, 0x0, 0x2, 0x70bd29, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x8ba, 0x1, 0x2, 0x4}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
sendmsg$SMC_PNETID_GET(r3, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x5c, r2, 0x300, 0x70bd29, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'netpci0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4c080}, 0x48000)
socketpair(0x2b, 0x3, 0x1000, &(0x7f0000000c00)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000c80), r6)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r7, &(0x7f0000000d80)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x64, r8, 0x8, 0x70bd27, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x48080}, 0x4)

[  113.695857] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  113.698655] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  113.702654] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  113.703938] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  113.704906] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  113.708936] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  113.715380] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  113.716114] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  113.719917] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  113.722159] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  113.749951] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  113.758205] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  113.760112] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  113.777680] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  113.777869] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  113.783482] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  113.787477] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  113.792892] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  113.803470] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  113.807079] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  113.851183] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  113.882663] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  113.891141] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  113.892363] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  113.896571] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  113.905192] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  113.920637] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  113.921826] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  113.935103] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  113.937154] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  113.947113] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  113.950619] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  113.954734] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  113.960081] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  113.962645] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  113.969459] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  113.972991] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  113.974703] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  113.993213] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  114.019848] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  115.778517] Bluetooth: hci0: command tx timeout
[  115.778525] Bluetooth: hci1: command tx timeout
[  115.840385] Bluetooth: hci3: command tx timeout
[  115.905371] Bluetooth: hci2: command tx timeout
[  116.034200] Bluetooth: hci7: command tx timeout
[  116.034228] Bluetooth: hci4: command tx timeout
[  116.097625] Bluetooth: hci5: command tx timeout
[  116.160417] Bluetooth: hci6: command tx timeout
[  117.824977] Bluetooth: hci1: command tx timeout
[  117.825048] Bluetooth: hci0: command tx timeout
[  117.888660] Bluetooth: hci3: command tx timeout
[  117.952540] Bluetooth: hci2: command tx timeout
[  118.081328] Bluetooth: hci4: command tx timeout
[  118.081560] Bluetooth: hci7: command tx timeout
[  118.144416] Bluetooth: hci5: command tx timeout
[  118.209348] Bluetooth: hci6: command tx timeout
[  119.872888] Bluetooth: hci1: command tx timeout
[  119.873396] Bluetooth: hci0: command tx timeout
[  119.936345] Bluetooth: hci3: command tx timeout
[  120.000331] Bluetooth: hci2: command tx timeout
[  120.128394] Bluetooth: hci4: command tx timeout
[  120.129764] Bluetooth: hci7: command tx timeout
[  120.192658] Bluetooth: hci5: command tx timeout
[  120.256502] Bluetooth: hci6: command tx timeout
[  121.920884] Bluetooth: hci0: command tx timeout
[  121.920925] Bluetooth: hci1: command tx timeout
[  121.984627] Bluetooth: hci3: command tx timeout
[  122.048436] Bluetooth: hci2: command tx timeout
[  122.176650] Bluetooth: hci7: command tx timeout
[  122.177155] Bluetooth: hci4: command tx timeout
[  122.240665] Bluetooth: hci5: command tx timeout
[  122.306307] Bluetooth: hci6: command tx timeout
[  176.143070] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  176.146016] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  176.153960] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  176.161048] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  176.167507] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  176.343078] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  176.356195] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  176.361783] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  176.376946] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  176.382249] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  176.395768] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  176.402692] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  176.404998] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  176.411491] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  176.414815] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  176.482895] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  176.488801] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  176.494797] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  176.496932] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  176.498511] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  176.500041] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  176.505491] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  176.512642] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  176.513751] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  176.521286] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  176.680006] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  176.691562] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  176.694434] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  176.700438] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  176.703533] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  176.850194] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  176.865187] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  176.868520] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  176.869990] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  176.872656] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  176.913981] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  176.926169] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  176.937060] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  176.938761] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  176.947518] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  178.241523] Bluetooth: hci0: command tx timeout
[  178.433669] Bluetooth: hci1: command tx timeout
[  178.498315] Bluetooth: hci2: command tx timeout
[  178.624468] Bluetooth: hci4: command tx timeout
[  178.688339] Bluetooth: hci3: command tx timeout
[  178.880377] Bluetooth: hci5: command tx timeout
[  179.008385] Bluetooth: hci7: command tx timeout
[  179.072428] Bluetooth: hci6: command tx timeout
[  180.289482] Bluetooth: hci0: command tx timeout
[  180.481377] Bluetooth: hci1: command tx timeout
[  180.545356] Bluetooth: hci2: command tx timeout
[  180.674059] Bluetooth: hci4: command tx timeout
[  180.739351] Bluetooth: hci3: command tx timeout
[  180.929507] Bluetooth: hci5: command tx timeout
[  181.057582] Bluetooth: hci7: command tx timeout
[  181.121601] Bluetooth: hci6: command tx timeout
[  182.337335] Bluetooth: hci0: command tx timeout
[  182.529585] Bluetooth: hci1: command tx timeout
[  182.593337] Bluetooth: hci2: command tx timeout
[  182.721322] Bluetooth: hci4: command tx timeout
[  182.784966] Bluetooth: hci3: command tx timeout
[  182.977466] Bluetooth: hci5: command tx timeout
[  183.104372] Bluetooth: hci7: command tx timeout
[  183.169439] Bluetooth: hci6: command tx timeout
[  184.384948] Bluetooth: hci0: command tx timeout
[  184.577433] Bluetooth: hci1: command tx timeout
[  184.640771] Bluetooth: hci2: command tx timeout
[  184.769743] Bluetooth: hci4: command tx timeout
[  184.833053] Bluetooth: hci3: command tx timeout
[  185.025089] Bluetooth: hci5: command tx timeout
[  185.152584] Bluetooth: hci7: command tx timeout
[  185.216603] Bluetooth: hci6: command tx timeout
[  239.309835] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  239.314852] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  239.317867] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  239.324726] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  239.330766] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  239.378961] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  239.383552] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  239.394149] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  239.407682] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  239.410890] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  239.536586] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  239.539072] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  239.549095] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  239.559027] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  239.568765] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  239.570643] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  239.574193] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  239.580587] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  239.585662] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  239.590867] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  239.593675] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  239.598551] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  239.603955] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  239.625252] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  239.648899] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  239.670213] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  239.676823] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  239.678500] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  239.691227] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  239.695802] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  239.699409] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  239.715423] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  239.723710] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  239.737747] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  239.744026] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  240.199364] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  240.214755] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  240.250325] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  240.298937] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  240.339047] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  241.409644] Bluetooth: hci0: command tx timeout
[  241.472368] Bluetooth: hci1: command tx timeout
[  241.728409] Bluetooth: hci4: command tx timeout
[  241.856662] Bluetooth: hci3: command tx timeout
[  241.921379] Bluetooth: hci2: command tx timeout
[  241.922061] Bluetooth: hci5: command tx timeout
[  241.984390] Bluetooth: hci6: command tx timeout
[  242.497778] Bluetooth: hci7: command tx timeout
[  243.457654] Bluetooth: hci0: command tx timeout
[  243.521603] Bluetooth: hci1: command tx timeout
[  243.777500] Bluetooth: hci4: command tx timeout
[  243.905444] Bluetooth: hci3: command tx timeout
[  243.970352] Bluetooth: hci2: command tx timeout
[  243.970377] Bluetooth: hci5: command tx timeout
[  244.033296] Bluetooth: hci6: command tx timeout
[  244.545358] Bluetooth: hci7: command tx timeout
[  245.504344] Bluetooth: hci0: command tx timeout
[  245.568954] Bluetooth: hci1: command tx timeout
[  245.824448] Bluetooth: hci4: command tx timeout
[  245.952361] Bluetooth: hci3: command tx timeout
[  246.016410] Bluetooth: hci2: command tx timeout
[  246.016914] Bluetooth: hci5: command tx timeout
[  246.080367] Bluetooth: hci6: command tx timeout
[  246.592369] Bluetooth: hci7: command tx timeout
[  247.552373] Bluetooth: hci0: command tx timeout
[  247.618329] Bluetooth: hci1: command tx timeout
[  247.872365] Bluetooth: hci4: command tx timeout
[  248.000355] Bluetooth: hci3: command tx timeout
[  248.064357] Bluetooth: hci5: command tx timeout
[  248.064377] Bluetooth: hci2: command tx timeout
[  248.128565] Bluetooth: hci6: command tx timeout
[  248.640559] Bluetooth: hci7: command tx timeout
[  299.727681] syz-executor.1 (5451) used greatest stack depth: 24512 bytes left
[  301.995986] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  302.000016] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  302.007746] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  302.012875] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  302.015450] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  302.017893] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  302.031587] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  302.034850] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  302.042177] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  302.044215] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  302.105227] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  302.114889] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  302.117905] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  302.132131] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  302.138547] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  302.248515] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  302.260701] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  302.263117] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  302.267768] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  302.270107] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  302.275330] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  302.278994] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  302.283620] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  302.342730] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  302.351093] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  302.355822] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  302.366872] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  302.379199] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  302.382010] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  302.385066] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  302.394109] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  302.402794] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  302.421564] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  302.428687] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  302.432543] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  302.557437] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  302.566321] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  302.597876] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  302.644300] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  302.697882] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  304.129555] Bluetooth: hci0: command tx timeout
[  304.130959] Bluetooth: hci1: command tx timeout
[  304.192417] Bluetooth: hci2: command tx timeout
[  304.449438] Bluetooth: hci3: command tx timeout
[  304.451371] Bluetooth: hci4: command tx timeout
[  304.513690] Bluetooth: hci5: command tx timeout
[  304.513966] Bluetooth: hci6: command tx timeout
[  304.768428] Bluetooth: hci7: command tx timeout
[  306.180574] Bluetooth: hci1: command tx timeout
[  306.180702] Bluetooth: hci0: command tx timeout
[  306.240514] Bluetooth: hci2: command tx timeout
[  306.497104] Bluetooth: hci3: command tx timeout
[  306.498174] Bluetooth: hci4: command tx timeout
[  306.562300] Bluetooth: hci6: command tx timeout
[  306.562357] Bluetooth: hci5: command tx timeout
[  306.816409] Bluetooth: hci7: command tx timeout
[  308.224564] Bluetooth: hci1: command tx timeout
[  308.224817] Bluetooth: hci0: command tx timeout
[  308.288394] Bluetooth: hci2: command tx timeout
[  308.544539] Bluetooth: hci3: command tx timeout
[  308.545353] Bluetooth: hci4: command tx timeout
[  308.608675] Bluetooth: hci5: command tx timeout
[  308.609581] Bluetooth: hci6: command tx timeout
[  308.866583] Bluetooth: hci7: command tx timeout
[  310.272638] Bluetooth: hci1: command tx timeout
[  310.273520] Bluetooth: hci0: command tx timeout
[  310.337629] Bluetooth: hci2: command tx timeout
[  310.592392] Bluetooth: hci4: command tx timeout
[  310.592415] Bluetooth: hci3: command tx timeout
[  310.658654] Bluetooth: hci6: command tx timeout
[  310.658716] Bluetooth: hci5: command tx timeout
[  310.912352] Bluetooth: hci7: command tx timeout
[  364.311981] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  364.315135] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  364.325178] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  364.334247] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  364.337855] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  364.629324] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  364.632925] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  364.635485] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  364.649072] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  364.654908] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  364.658109] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  364.667485] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  364.669014] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  364.676019] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  364.692592] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  364.761346] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  364.766951] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  364.785040] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  364.814797] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  364.822734] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  364.849200] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  364.871758] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  364.874989] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  364.878599] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  364.880862] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  364.888796] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  364.890941] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  364.894076] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  364.899753] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  364.906190] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  364.910771] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  364.915379] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  364.920973] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  364.923465] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  364.928733] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  364.944657] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  364.948009] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  364.953611] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  364.961558] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  364.968523] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  366.400345] Bluetooth: hci0: command tx timeout
[  366.784477] Bluetooth: hci1: command tx timeout
[  366.784718] Bluetooth: hci2: command tx timeout
[  366.977445] Bluetooth: hci3: command tx timeout
[  367.104384] Bluetooth: hci4: command tx timeout
[  367.104454] Bluetooth: hci7: command tx timeout
[  367.105498] Bluetooth: hci6: command tx timeout
[  367.106313] Bluetooth: hci5: command tx timeout
[  368.449401] Bluetooth: hci0: command tx timeout
[  368.833492] Bluetooth: hci2: command tx timeout
[  368.833983] Bluetooth: hci1: command tx timeout
[  369.024362] Bluetooth: hci3: command tx timeout
[  369.153401] Bluetooth: hci7: command tx timeout
[  369.153843] Bluetooth: hci4: command tx timeout
[  369.154000] Bluetooth: hci5: command tx timeout
[  369.154247] Bluetooth: hci6: command tx timeout
[  370.496350] Bluetooth: hci0: command tx timeout
[  370.883703] Bluetooth: hci2: command tx timeout
[  370.884226] Bluetooth: hci1: command tx timeout
[  371.072330] Bluetooth: hci3: command tx timeout
[  371.200756] Bluetooth: hci6: command tx timeout
[  371.201015] Bluetooth: hci7: command tx timeout
[  371.201298] Bluetooth: hci5: command tx timeout
[  371.201728] Bluetooth: hci4: command tx timeout
[  372.544323] Bluetooth: hci0: command tx timeout
[  372.928389] Bluetooth: hci1: command tx timeout
[  372.929552] Bluetooth: hci2: command tx timeout
[  373.121283] Bluetooth: hci3: command tx timeout
[  373.248566] Bluetooth: hci4: command tx timeout
[  373.248843] Bluetooth: hci5: command tx timeout
[  373.249186] Bluetooth: hci7: command tx timeout
[  373.250370] Bluetooth: hci6: command tx timeout

VM DIAGNOSIS:
23:31:17  Registers:
info registers vcpu 0
RAX=0000000000000000 RBX=00000000000d000d RCX=00000000000d000c RDX=ffff8880071ae940
RSI=ffffea00001c6b80 RDI=ffff8880071ae940 RBP=ffff888028ca7b30 RSP=ffff888028ca7a80
R8 =0000000000000000 R9 =ffffffff81ae0a01 R10=ffff888008c4b780 R11=0000000000000000
R12=ffffea00001c6b80 R13=0000000000000000 R14=0000000000000000 R15=00000000000d000c
RIP=ffffffff81a6be3c RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f3e54761540 00000000 00000000
GS =0000 ffff8880e564b000 00000000 00000000
LDT=0000 fffffe5800000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fb25bac2028 CR3=0000000036198000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=0000ffff000000000000000000000000
XMM02=ffffffffffffffff0f0e0d0c0b0a0908 XMM03=756e20796d6d756420736e6f6974706f
XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=676f6c206d6f74737563000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000000000000 RBX=ffffea0001b3fb74 RCX=ffffffff818c3ed2 RDX=ffff888030750000
RSI=0000000000000004 RDI=ffffea0001b3fb74 RBP=00007f0fe5c34000 RSP=ffff88803079fb70
R8 =0000000000000000 R9 =fffff94000367f68 R10=0000000000000000 R11=0000000000000000
R12=0000000000000041 R13=0000000000000000 R14=ffffea0001b3fb40 R15=ffff88803079fd90
RIP=ffffffff81ae0618 RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0000 0000000000000000 00000000 00000000
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f0fe5bca540 00000000 00000000
GS =0000 ffff8880e574b000 00000000 00000000
LDT=0000 fffffe4c00000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f0fe5c30b90 CR3=0000000030790000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=2d0065626f7270646f6d2f6e6962732f
XMM02=00ff0000000000000000000000000000 XMM03=00000000000000000000ff00000000ff
XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000