last executing test programs: 9.416392151s ago: executing program 1 (id=2): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$incfs(0xffffffffffffffff, 0x0, 0x8800, 0x11) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x4) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000440)={"db4c1421593cb4d3f8fe6094dc821bbbe06520701fc6de7b0349f34b0f8c556a9e9aff1355aab8d6da26d74608530f150f127f9e3f0a2f1fff0be9774c95d6c007c91903f78616596487bf50017c56b15385ab264cba5b168c62d971e67e6f3e73d60b5a8adbaaf2af8610c6a91c0a116f619adce4aa91d5a68faf8ee98693d32d8d8244381b5720ef596600e39491d216c22d0725904bab7d90fa8afb8fa04b707410aa300ef098609b4fa6dd77b1b7c321b1fc6356564ce3f90826be3a9a5be186ffc48eb13824e9dae77ed212a0f802074ff4f1725c4ad88cf5bbd36e3406bc59d96e82047631d8be9462ee7e54e5b2897c3fff38eabf67e1e160c2b5e18be06457844d89c9a606b7d25fbde713f4759da0bee1fabe3f71dcca63540f113a2b5edc4b327d1f9610377b97265d4aa875b4bc3c44bf8110d5df1beb1fe54794a0aa52dfc80df1caf7d812b4f1cdba1a6836b45ea2180d08439d411ce8e0755868cc839eaeac73e5d28f9f1990584038cf5fa6bee0c4095a27cc8c7b59519bf2a9bf1fedf54cc2dc6aea6c42c32de40c291e5f422f5c7792a08926af160fb379576dd81bac746232fb246817fc3248097914b75e83cc5eb518ce8fb643b34ca69c3b61f0d94e7db62dd480198d41e0862f1ec4429ab637569884a5ba446a0b09edfd986a2b3e15ee35bbd18610dad6271681ed240b0ffab9199b541013c0aadc36484da57511896c14776a41602aa1426edfbb828897d9c218b7936a0572840ebbc796e888a439b24e640324b511deb6ed0b2ce2f7567447826944b4f34101e492e8d20a2deda950e96e78f86d6d4c976f0c99041c94944309e6ce08d84a7c96677d570d9a57ec0506a4321d9e049b55be883ca3648c27772fc5dbaea5e6c2ded2ce72fb68989ae381fe1394cf6966ab04285d5ff8256bc2e85462b8d89aeeebd5432157c945b5dc1960d9282c6cc007fe029325d6078aef94d4954f956c71bcdf846f41392ebe0d3b289438d24ec4bc073617459a6b232445dd636a9f21140e14b162fd5ef1d626b0ff84884fd63d22cc1b05befb77ea937f3045cc15b125479b262c1e32fca75a5468423288c5776efee744b1fccb5e6d661d9d287cfa8582c96ea34a33c1bbc29c0035657da66a87150bbb885be5ee123e431fd793ea179a0fc77aaee66d874c0616cb32324826b36d0e27d14217ad1131cace3bae4ef82dfbc790e78de53a9bfbdb468bf0eb3ff134073b380858965de2d108862daf3fc6b49ad46f20832238aeaa5d010cf08e37938f0bb7bbeaa970c39ce9327a16fe07565708266ce9ef639bfa08538693b456228aa1c370d64ef9795b7cc208a2c528d381a042d149ed5c7f34ed26a7d5a4401b86434f054389e5dac7a4ee896e406d7b27240d925d478e0eb2202797832d3e2c74f4925ad58377b0d6ae9b97034f94"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 9.124093502s ago: executing program 2 (id=3): syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x8000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147c40, 0x0) keyctl$clear(0x5, 0xffffffffffffffff) r0 = getpid() syz_pidfd_open(r0, 0x0) syz_usb_connect(0x6, 0x75, &(0x7f0000000780)=ANY=[@ANYBLOB="1201010240d85bc7b1131100345c010203010902630002040800070904880400c192fa280724060000d2cf0524001c620d240f0100000000020005f29011cc03080353ee97050a2401f90a00020102092403060703020208"], &(0x7f0000000280)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x9, 0x2, 0xf4, 0x20, 0x93}, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(r1, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40186f40, &(0x7f0000000440)=0x1f) syz_clone(0x120e1100, 0x0, 0x0, 0x0, 0x0, 0x0) 7.796868136s ago: executing program 1 (id=6): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000001100000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000114000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) 7.284178478s ago: executing program 3 (id=4): syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x8000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147c40, 0x0) keyctl$clear(0x5, 0xffffffffffffffff) r0 = getpid() syz_pidfd_open(r0, 0x0) syz_usb_connect(0x6, 0x75, &(0x7f0000000780)=ANY=[@ANYBLOB="1201010240d85bc7b1131100345c010203010902630002040800070904880400c192fa280724060000d2cf0524001c620d240f0100000000020005f29011cc03080353ee97050a2401f90a00020102092403060703020208"], &(0x7f0000000280)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x9, 0x2, 0xf4, 0x20, 0x93}, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff000060005400000000008000640"], 0x6c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="28000000030601020000000200fdffffffffff0205000100070000000900020073797a32"], 0x28}, 0x1, 0x0, 0x0, 0x4c814}, 0x40814) 6.668287336s ago: executing program 0 (id=1): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x10, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000100)={{0x10000, 0x100000, 0x8, 0x1}, {0x0, 0x2000, 0xf, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5}, {0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x72, 0x0, 0x80, 0x80, 0x4}, {0x10000, 0xffff1000, 0xf, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x3}, {0x0, 0xffff1000, 0xc, 0x2, 0x3, 0x10, 0x6, 0x0, 0x1, 0x0, 0x4}, {0x8080000, 0x10000, 0x0, 0x0, 0x0, 0xfd}, {0x0, 0x0, 0xa, 0x0, 0x80, 0xf9, 0x0, 0x7, 0x3a, 0x2}, {0x0, 0x3000, 0x0, 0x2, 0x0, 0x54, 0x7, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x2, 0x400}, {}, 0xddf8ffdb, 0x0, 0x11111001, 0x100, 0x8, 0x8000, 0x3000, [0x0, 0x0, 0x2]}) ioctl$KVM_TRANSLATE(r5, 0xc018ae85, &(0x7f0000001280)={0x0, 0xdddd0000, 0x2, 0x5, 0x50}) 6.656769144s ago: executing program 1 (id=7): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000001100000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000114000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) socket$netlink(0x10, 0x3, 0xf) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000280)={[{0x7fffffff, 0xc, 0x2, 0x5, 0x3f, 0x80, 0x8, 0x7, 0x2, 0x3, 0x81, 0x6c, 0x2}, {0x3, 0x1000, 0x7c, 0x4, 0x1, 0x1b, 0x7, 0x6, 0x82, 0x3, 0x8, 0xc, 0x5}, {0x0, 0x9, 0xb6, 0x80, 0x8, 0x9, 0x2, 0x5, 0x6, 0x7, 0x2, 0x8, 0x3ff}], 0x5d2}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_INITMSG(r5, 0x84, 0x2, 0x0, &(0x7f0000000080)) 6.256124133s ago: executing program 4 (id=5): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000001100000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000114000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) sendmsg$NFT_MSG_GETOBJ(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x34, 0x13, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x34}}, 0x4000040) socket$netlink(0x10, 0x3, 0xf) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0x32600) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_INITMSG(r7, 0x84, 0x2, 0x0, &(0x7f0000000080)) r8 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r8, 0x10e, 0x4, &(0x7f0000000080)=0x100, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xd0, 0x0, 0x0, 0x0, 0x18}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x6, 0xa, 0x9, 0xfff0, 0x41}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x4}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x1, 0xb, 0xa, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x9, 0x20}, {}, {}, {0x18, 0x6, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5.410521999s ago: executing program 1 (id=8): socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80000, 0x0) io_uring_setup(0x156f, &(0x7f00000003c0)={0x0, 0xb628, 0x2000, 0x1, 0x208}) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x10b) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x9, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3fe, 0x5, 0x3, 0x9, 0x8, 0x45ff, 0x7ffffffc}, 0x0, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xffffffffffffff6e, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r4, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r2], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) 5.378238116s ago: executing program 2 (id=9): socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80000, 0x0) io_uring_setup(0x156f, &(0x7f00000003c0)={0x0, 0xb628, 0x2000, 0x1, 0x208}) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x10b) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x9, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3fe, 0x5, 0x3, 0x9, 0x8, 0x45ff, 0x7ffffffc}, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000500)=[@in={0x2, 0x4e20, @remote}, @in={0x2, 0x4e21, @empty}, @in6={0xa, 0x5e22, 0x1, @local}, @in6={0xa, 0x4e23, 0x10, @mcast2, 0x3aad}], 0x58) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xffffffffffffff6e, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r4, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r2], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) 5.255610894s ago: executing program 4 (id=10): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x3100, 0x0, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.136540717s ago: executing program 3 (id=11): syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0), 0x12) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, r3}, 0x18) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x8) getresgid(&(0x7f0000000040), &(0x7f0000000180), &(0x7f00000016c0)) mknod(&(0x7f0000000540)='./file1\x00', 0x0, 0x0) stat(&(0x7f0000000100)='./file1\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r5) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB="b7000000010003c3bfa30000000000000703000020feffff720af0fff8ffffff71a4f0ff0000000065040200000000ff2d400500000000003400000001ed00007b030000000000001d440000000000007a0a00fe00ffffffdb03000000000000b5000000000000009500000000000000023bc065b78111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e51815548000000000000000275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7f300c095199fe3ff3128e599b0eaebbdbd732c9cc00eec36574a8f6456e2ccae25ea21714eca8cf5d803e04d83b46e21557c0afc646cb7790b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2400000000000000800643a98d9ec21ead2ed51b104d4d91af25b845b9f75dd08d123deda8ebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987af1714e72ba7616536fd9aa58f2477184b6a89adaf17b0baf587aef370a2d426a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d64364c82770c8204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee7d26b34381fcb59b854e9d5a17f4720082f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67051d355d84ce97bb0c6b4a595e487efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599ddd71063be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d96c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d38df9ba60248d9a0d61282dfb15eb6841bb64a1b3045024a982f3c48153baae2c4e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c3560811ea6c3560a43364d402ccdd9069bd50b994fd6a34ee18022a579dfc0229cc0dc9881610270928eaeb883418f562ae00003ea96d10f172c0374d6eed826407000000000000004a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea52acb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d851680f6f2f9a6a8906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f4ca2195234648e0a1ca50db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145eb6dc5f6a9037d2283c42efc54fa84323a3304f41ff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f928ba7554ba583fef3ec7932f5954f31a878e2fae6691df8b4b7ecd27ce82f7df3e7d1daac43738612e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d6d0355f3be6135425f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e96735600000554f327a353511ccedde99493c31ac05a7b57f03ca91a01ba2c60ca99e8ebc15ecb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d40460780000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120968308c31db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd0000000069ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a003fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9e0600f86909bc90addb7b9aee813df534aac4b32fd691b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a000000000000000000000000000006acc19808d7cf29bc974b0ea92499a419aa095e203c1bafbb9b9a7c2bca3f0a18ee4952f2d325a56390578f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa84feda91f3edb32231ec75300000000000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b88b5e7885e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae630b8234fb46351f5d7d68f93d44086b3f03b20d546fa66a72e38207c9d20035ab63de71a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db1829f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2744c46570e8f46da1ab990ca053cbfe801000000000000000000000000000000d55d7182af2ea5f8d0ad495e3eb9421963a5a683c3dcb2d300aa3b2cfe946d2348c35f5d67d68ac07c8f84b3679e77c2e629ecec7c12c35d6b6971b8ae13cc00956d2227db60c0a461ed2b3ecfb16d19037c8c88c91dda1f904fbbc864e95ad43d6dd6d5eadbcea25682ba4b91e14c3fbfdfd1d680aa1af102d97681656bf56ff0674237ce097d39008cc3257778de878bcd37467386f993be6d20c93a7791e7f2a155ce379b4cda2500108052aeb9bd03ff6d4c5dbda9ff485d6576a492d436d52edcd420e7deaa4343a0add3941ae7c5f58af43866ca64750f43e583ca1ceb3a805e46beef9dca77a4edcbb42aa0caf0bbd6cec72d85540293cb4849b0610800000000000000000000000000000000f9814d5f6c8673c143ff2f901e71b8818665b56f7a03afe3d900007656859db4cb06aaaf9f02cfab5b9e61cc00e8e19429921b8df4c4c53bddea4cc48737842952ff08aeac15685df194ca89da8cf6d29a2be9779181fd5d105af5786094d9130f5826b18b9667b971a994f3fd069629a1052f441e96884f90c91f4a974242aabfc8adbadc9ca27955b5c90f0bd9a46ed044272383d3768871a9c8cfd7948aea445c55684351002ed4a4af45341de8e5e1f33624bd2ec1591dd00bbe05000000f89a928662e9b9449db34394fc5e946fadaee576e28ac0feab4e3585ed43d206218f524083840a78b7236bb7f5e42b5376642f8ad4028d4ead407240e7467d1b37afe20690d7672c7e926fded95cf805516ad836eb730619a05af36fb28329d6feb33219cc9164461a8ba3afd5949b9a6046c53663df30a049414089c1ae8f3476236b05dde8dda4843a62c591f8d2b1a62d0db8dc826219bd87398b33e140792297d023ef52de2e75b9dbbfb8712ccc15c69cfb4c6c1bc2ae74621e536b9d3f09a15dada1561a8192d65cc59d7ed5a6bd61000000000000000000000000000000000000000000000000000000000000000000000000f637782e317d492b2392fd0ea81397a80227f271bad21d688af35a2bd02c15d20f3d62a50e20260642c25f304c8034a5f4d8e45e701dbd84294d1096e715662b8223e10e98c4c38451fc5c702084e3fa9b184e0d0fba44acf3bb8a846cf680dfbf312cddfdb2043288fa6b67fa762c8b75d4478756ef240f2b314e4d77a3afb4fcec92248327004d1dac7ac87a6f8cb04d82acc307d60e4713bd9a8f29091d3048c669a5f5439e0a906ce098d177b9579882586511cfe6a23e57c44d1654899f077b5636e4181f3de6b814bedcac5290ad8018bbe4424edc6d9b0e61b404bb7a2d4883bbc200de8332029cbc04a0bc52fa83bac200c486555ac097239cbab397527d1a861f13ecbe58245a06e3aeddf0768889a16b53d63c8af48030f16350259147edc7854bf6f8d0a9bb3391eded5c61a80fc008777fce152934970530672aa97794d4de4b596c9f3dd095286d4012d440213ae73ebe95e3c92cb3787d426963f2295df0e7be334af7822036d20cade5d0808fc19759959bb9e2789c37d7249510671873b650408ad814f0c8e287e5687b88a8c51c6ef3cb61a8cab9c6"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) read$FUSE(r4, &(0x7f000000c400)={0x2020}, 0x2020) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) ioctl$IOCTL_START_ACCEL_DEV(0xffffffffffffffff, 0x40096102, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x34, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}]}, 0x34}}, 0x0) openat$vcsu(0xffffff9c, &(0x7f0000000180), 0x8c880, 0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) 3.430454558s ago: executing program 2 (id=12): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = syz_kvm_add_vcpu$x86(0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000004e000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r4], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18) r6 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) getpeername$netrom(r6, 0x0, 0x0) 2.640054534s ago: executing program 1 (id=13): ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000001340)) r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x103, 0x0) read$dsp(r0, &(0x7f00000002c0)=""/4096, 0x1000) write$dsp(0xffffffffffffffff, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb628678", 0x1e) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x89}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) memfd_create(&(0x7f0000000400)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\xd1x4]PZ\x9e\xd5Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\x97\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev\x15h$\x01\xdd\xe5\xce\xf8*\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xa2\xab\xf6\x84\xe0\xcf1\x9a', 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000580)=@newsa={0x128, 0x1a, 0x7, 0x8, 0x0, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2}, {0x0, 0x200000, 0x7}, {0x40000, 0x0, 0x7f}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in=@dev={0xac, 0x14, 0x14, 0x24}}, @lifetime_val={0x24, 0x9, {0xfffffffffffffffd, 0x7, 0x81, 0x9}}]}, 0x128}}, 0x4000040) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x9}) ioctl$UI_SET_FFBIT(r3, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r3, 0x5501) r4 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0) ioctl$EVIOCSFF(r4, 0x40304580, &(0x7f0000000500)={0x50, 0x9, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]}) sendmsg$NL802154_CMD_NEW_SEC_DEV(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x20, 0x0, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) 2.639458881s ago: executing program 3 (id=14): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x80) fchdir(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x5, @none, 0x0, 0x2}, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) futex(&(0x7f0000000000), 0x8c, 0x1, 0x0, 0x0, 0x0) accept4$bt_l2cap(r2, 0x0, 0x0, 0x0) 2.584124809s ago: executing program 4 (id=15): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x80) fchdir(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x5, @none, 0x0, 0x2}, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) futex(&(0x7f0000000000), 0x8c, 0x1, 0x0, 0x0, 0x0) accept4$bt_l2cap(r2, 0x0, 0x0, 0x0) 2.435540449s ago: executing program 3 (id=16): syz_open_dev$dmmidi(&(0x7f0000000340), 0xfffffffffffffffc, 0x8901) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000000c0), 0x4) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) munlockall() sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x11e, 0x1e, 0xffffffffffffffff, &(0x7f0000000340)=0xfffffffffffffeb8) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) unshare(0x20000400) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x4c, &(0x7f0000000300), 0x4) 2.420368524s ago: executing program 4 (id=17): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000001100000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000114000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) 1.540120615s ago: executing program 2 (id=18): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x34, 0x13, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x34}}, 0x4000040) socket$netlink(0x10, 0x3, 0xf) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000280)={[{0x7fffffff, 0xc, 0x2, 0x5, 0x3f, 0x80, 0x8, 0x7, 0x2, 0x3, 0x81, 0x6c, 0x2}, {0x3, 0x1000, 0x7c, 0x4, 0x1, 0x1b, 0x7, 0x6, 0x82, 0x3, 0x8, 0xc, 0x5}, {0x0, 0x9, 0xb6, 0x80, 0x8, 0x9, 0x2, 0x5, 0x6, 0x7, 0x2, 0x8, 0x3ff}], 0x5d2}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_INITMSG(r5, 0x84, 0x2, 0x0, &(0x7f0000000080)) 1.20079457s ago: executing program 1 (id=19): syz_open_dev$dmmidi(&(0x7f0000000340), 0xfffffffffffffffc, 0x8901) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000000c0), 0x4) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) munlockall() sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x11e, 0x1e, 0xffffffffffffffff, &(0x7f0000000340)=0xfffffffffffffeb8) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x4c, &(0x7f0000000300), 0x4) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000040000000000000000000bfef9004af9a20ea"], 0x78) recvmmsg(r4, &(0x7f0000000500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=""/8, 0xc}}], 0x4b, 0x0, 0x0) 300.801152ms ago: executing program 4 (id=20): syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x8000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147c40, 0x0) keyctl$clear(0x5, 0xffffffffffffffff) r0 = getpid() syz_pidfd_open(r0, 0x0) syz_usb_connect(0x6, 0x75, &(0x7f0000000780)=ANY=[@ANYBLOB="1201010240d85bc7b1131100345c010203010902630002040800070904880400c192fa280724060000d2cf0524001c620d240f0100000000020005f29011cc03080353ee97050a2401f90a00020102092403060703020208"], &(0x7f0000000280)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x9, 0x2, 0xf4, 0x20, 0x93}, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(r1, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40186f40, &(0x7f0000000440)=0x1f) syz_clone(0x120e1100, 0x0, 0x0, 0x0, 0x0, 0x0) 166.696041ms ago: executing program 2 (id=21): syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x8000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147c40, 0x0) keyctl$clear(0x5, 0xffffffffffffffff) r0 = getpid() syz_pidfd_open(r0, 0x0) syz_usb_connect(0x6, 0x75, &(0x7f0000000780)=ANY=[@ANYBLOB="1201010240d85bc7b1131100345c010203010902630002040800070904880400c192fa280724060000d2cf0524001c620d240f0100000000020005f29011cc03080353ee97050a2401f90a00020102092403060703020208"], &(0x7f0000000280)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x9, 0x2, 0xf4, 0x20, 0x93}, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff000060005400000000008000640"], 0x6c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="28000000030601020000000200fdffffffffff0205000100070000000900020073797a32"], 0x28}, 0x1, 0x0, 0x0, 0x4c814}, 0x40814) 86.786907ms ago: executing program 0 (id=22): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000001100000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000114000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) sendmsg$NFT_MSG_GETOBJ(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x34, 0x13, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x34}}, 0x4000040) socket$netlink(0x10, 0x3, 0xf) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_INITMSG(r6, 0x84, 0x2, 0x0, &(0x7f0000000080)) r7 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f0000000080)=0x100, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xd0, 0x0, 0x0, 0x0, 0x18}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x6, 0xa, 0x9, 0xfff0, 0x41}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x4}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x1, 0xb, 0xa, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x9, 0x20}, {}, {}, {0x18, 0x6, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 0s ago: executing program 3 (id=23): socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80000, 0x0) io_uring_setup(0x156f, &(0x7f00000003c0)={0x0, 0xb628, 0x2000, 0x1, 0x208}) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x10b) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x9, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3fe, 0x5, 0x3, 0x9, 0x8, 0x45ff, 0x7ffffffc}, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000500)=[@in={0x2, 0x4e20, @remote}, @in={0x2, 0x4e21, @empty}, @in6={0xa, 0x5e22, 0x1, @local}, @in6={0xa, 0x4e23, 0x10, @mcast2, 0x3aad}], 0x58) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xffffffffffffff6e, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r4, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r2], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.78' (ED25519) to the list of known hosts. [ 81.817829][ T5819] cgroup: Unknown subsys name 'net' [ 82.008473][ T5819] cgroup: Unknown subsys name 'cpuset' [ 82.018779][ T5819] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.752616][ T5819] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 87.962780][ T5838] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 87.971229][ T5838] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.976354][ T5842] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.979883][ T5838] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 87.986292][ T5842] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 87.993364][ T5838] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.014680][ T5842] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.014711][ T5838] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.031001][ T5842] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.031082][ T5838] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.046965][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.058530][ T5838] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.066665][ T5838] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.088075][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 88.101040][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.108398][ T5152] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 88.115643][ T5838] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 88.123576][ T5152] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 88.132043][ T5152] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 88.139839][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 88.147292][ T5838] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 88.156780][ T5152] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 88.163916][ T5152] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 88.172479][ T5836] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 88.180273][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 88.748772][ T5847] chnl_net:caif_netlink_parms(): no params data found [ 88.978364][ T5834] chnl_net:caif_netlink_parms(): no params data found [ 89.002641][ T5830] chnl_net:caif_netlink_parms(): no params data found [ 89.058787][ T5831] chnl_net:caif_netlink_parms(): no params data found [ 89.078709][ T5839] chnl_net:caif_netlink_parms(): no params data found [ 89.176299][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.183609][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.192249][ T5847] bridge_slave_0: entered allmulticast mode [ 89.199764][ T5847] bridge_slave_0: entered promiscuous mode [ 89.243836][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.251073][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.258372][ T5847] bridge_slave_1: entered allmulticast mode [ 89.266088][ T5847] bridge_slave_1: entered promiscuous mode [ 89.402557][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.416145][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.449852][ T5834] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.457308][ T5834] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.464712][ T5834] bridge_slave_0: entered allmulticast mode [ 89.471999][ T5834] bridge_slave_0: entered promiscuous mode [ 89.508606][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.516492][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.523850][ T5830] bridge_slave_0: entered allmulticast mode [ 89.532094][ T5830] bridge_slave_0: entered promiscuous mode [ 89.552577][ T5834] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.560619][ T5834] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.568123][ T5834] bridge_slave_1: entered allmulticast mode [ 89.575876][ T5834] bridge_slave_1: entered promiscuous mode [ 89.596396][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.603656][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.611163][ T5830] bridge_slave_1: entered allmulticast mode [ 89.618733][ T5830] bridge_slave_1: entered promiscuous mode [ 89.688403][ T5847] team0: Port device team_slave_0 added [ 89.721184][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.731196][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.738844][ T5831] bridge_slave_0: entered allmulticast mode [ 89.747188][ T5831] bridge_slave_0: entered promiscuous mode [ 89.754590][ T5839] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.761766][ T5839] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.770440][ T5839] bridge_slave_0: entered allmulticast mode [ 89.777922][ T5839] bridge_slave_0: entered promiscuous mode [ 89.786301][ T5839] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.793448][ T5839] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.800783][ T5839] bridge_slave_1: entered allmulticast mode [ 89.808387][ T5839] bridge_slave_1: entered promiscuous mode [ 89.832158][ T5834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.843937][ T5847] team0: Port device team_slave_1 added [ 89.866914][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.874611][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.881817][ T5831] bridge_slave_1: entered allmulticast mode [ 89.889857][ T5831] bridge_slave_1: entered promiscuous mode [ 89.935087][ T5834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.974074][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.003177][ T5839] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.017217][ T5839] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.041316][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.048446][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.074888][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.089680][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.155839][ T5844] Bluetooth: hci1: command tx timeout [ 90.159725][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.161692][ T5844] Bluetooth: hci0: command tx timeout [ 90.169060][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.200680][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.234742][ T5844] Bluetooth: hci2: command tx timeout [ 90.240329][ T5152] Bluetooth: hci4: command tx timeout [ 90.241652][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.246023][ T51] Bluetooth: hci3: command tx timeout [ 90.263085][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.287586][ T5834] team0: Port device team_slave_0 added [ 90.295470][ T5839] team0: Port device team_slave_0 added [ 90.305110][ T5830] team0: Port device team_slave_0 added [ 90.327386][ T5834] team0: Port device team_slave_1 added [ 90.350092][ T5839] team0: Port device team_slave_1 added [ 90.361378][ T5830] team0: Port device team_slave_1 added [ 90.395598][ T5831] team0: Port device team_slave_0 added [ 90.459148][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.466202][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.493173][ T5834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.507157][ T5831] team0: Port device team_slave_1 added [ 90.527310][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.534328][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.560344][ T5839] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.578993][ T5847] hsr_slave_0: entered promiscuous mode [ 90.586075][ T5847] hsr_slave_1: entered promiscuous mode [ 90.606641][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.613720][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.640263][ T5834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.680246][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.687616][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.714044][ T5839] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.732542][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.740339][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.766380][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.784953][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.791933][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.817945][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.829727][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.836820][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.863081][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.913124][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.920540][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.946784][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.977013][ T5839] hsr_slave_0: entered promiscuous mode [ 90.983392][ T5839] hsr_slave_1: entered promiscuous mode [ 90.989965][ T5839] debugfs: 'hsr0' already exists in 'hsr' [ 90.995893][ T5839] Cannot create hsr debugfs directory [ 91.107689][ T5834] hsr_slave_0: entered promiscuous mode [ 91.115866][ T5834] hsr_slave_1: entered promiscuous mode [ 91.122282][ T5834] debugfs: 'hsr0' already exists in 'hsr' [ 91.128524][ T5834] Cannot create hsr debugfs directory [ 91.259134][ T5831] hsr_slave_0: entered promiscuous mode [ 91.265740][ T5831] hsr_slave_1: entered promiscuous mode [ 91.271801][ T5831] debugfs: 'hsr0' already exists in 'hsr' [ 91.278489][ T5831] Cannot create hsr debugfs directory [ 91.327263][ T5830] hsr_slave_0: entered promiscuous mode [ 91.333656][ T5830] hsr_slave_1: entered promiscuous mode [ 91.343238][ T5830] debugfs: 'hsr0' already exists in 'hsr' [ 91.349660][ T5830] Cannot create hsr debugfs directory [ 91.858466][ T5834] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 91.871348][ T5834] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 91.881743][ T5834] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 91.903458][ T5834] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 91.979233][ T5839] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 91.995556][ T5839] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 92.011194][ T5839] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 92.022649][ T5839] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 92.088074][ T43] cfg80211: failed to load regulatory.db [ 92.127336][ T5847] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 92.155985][ T5847] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 92.190075][ T5847] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 92.201799][ T5847] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 92.235048][ T51] Bluetooth: hci0: command tx timeout [ 92.240711][ T5844] Bluetooth: hci1: command tx timeout [ 92.303727][ T5830] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 92.314660][ T5844] Bluetooth: hci4: command tx timeout [ 92.315042][ T5152] Bluetooth: hci2: command tx timeout [ 92.326672][ T51] Bluetooth: hci3: command tx timeout [ 92.362665][ T5830] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 92.384097][ T5830] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 92.404001][ T5834] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.425431][ T5830] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 92.495739][ T5834] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.532027][ T5831] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 92.568619][ T5831] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 92.581255][ T1091] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.588550][ T1091] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.603481][ T5839] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.617123][ T5831] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 92.632124][ T1091] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.639330][ T1091] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.656606][ T5831] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 92.687535][ T5839] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.738480][ T1091] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.745711][ T1091] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.807747][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.815009][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.830119][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.896185][ T5847] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.958339][ T1091] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.965576][ T1091] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.009546][ T1091] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.016774][ T1091] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.109434][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.147473][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.263993][ T5831] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.308688][ T5830] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.322183][ T3511] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.329486][ T3511] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.367983][ T3511] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.375176][ T3511] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.400537][ T1145] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.407769][ T1145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.518172][ T1145] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.525384][ T1145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.552214][ T5834] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.652284][ T5830] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 93.734179][ T5839] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.822872][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.909566][ T5834] veth0_vlan: entered promiscuous mode [ 93.949360][ T5834] veth1_vlan: entered promiscuous mode [ 94.079803][ T5847] veth0_vlan: entered promiscuous mode [ 94.126835][ T5847] veth1_vlan: entered promiscuous mode [ 94.204103][ T5834] veth0_macvtap: entered promiscuous mode [ 94.255122][ T5834] veth1_macvtap: entered promiscuous mode [ 94.288241][ T5847] veth0_macvtap: entered promiscuous mode [ 94.312241][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.320702][ T51] Bluetooth: hci1: command tx timeout [ 94.324595][ T5152] Bluetooth: hci0: command tx timeout [ 94.347280][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.360395][ T5847] veth1_macvtap: entered promiscuous mode [ 94.388345][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.399529][ T5152] Bluetooth: hci4: command tx timeout [ 94.406197][ T51] Bluetooth: hci3: command tx timeout [ 94.409971][ T5844] Bluetooth: hci2: command tx timeout [ 94.433737][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.458462][ T3511] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.468408][ T3511] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.483097][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.501817][ T1091] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.527603][ T1145] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.548918][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.599094][ T3500] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.610991][ T3500] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.650406][ T3500] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.659579][ T3500] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.690335][ T5831] veth0_vlan: entered promiscuous mode [ 94.708566][ T5830] veth0_vlan: entered promiscuous mode [ 94.740156][ T5839] veth0_vlan: entered promiscuous mode [ 94.760669][ T78] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.783821][ T78] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.801940][ T5831] veth1_vlan: entered promiscuous mode [ 94.832326][ T5839] veth1_vlan: entered promiscuous mode [ 94.853232][ T5830] veth1_vlan: entered promiscuous mode [ 94.891685][ T78] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.912268][ T78] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.959305][ T5830] veth0_macvtap: entered promiscuous mode [ 94.983472][ T5839] veth0_macvtap: entered promiscuous mode [ 94.993489][ T78] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.997915][ T5830] veth1_macvtap: entered promiscuous mode [ 95.010087][ T78] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.031353][ T5839] veth1_macvtap: entered promiscuous mode [ 95.041963][ T5834] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 95.082159][ T5831] veth0_macvtap: entered promiscuous mode [ 95.111857][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.148503][ T5831] veth1_macvtap: entered promiscuous mode [ 95.170024][ T5949] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 95.188734][ T3511] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.208611][ T3511] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.212947][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.260509][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.301238][ T3500] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.311599][ T5949] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 95.323174][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.378549][ T3500] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.409416][ T3500] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.426339][ T3500] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.469020][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.501377][ T1145] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.527747][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.550002][ T1145] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.808489][ T1145] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.865628][ T1091] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.943947][ T5954] ubi31: attaching mtd0 [ 95.962119][ T5954] ubi31: scanning is finished [ 95.967028][ T5954] ubi31: empty MTD device detected [ 96.395779][ T5152] Bluetooth: hci0: command tx timeout [ 96.401789][ T5844] Bluetooth: hci1: command tx timeout [ 96.468074][ T5954] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 96.476247][ T5954] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 96.478252][ T5844] Bluetooth: hci2: command tx timeout [ 96.483574][ T5954] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 96.489867][ T5152] Bluetooth: hci4: command tx timeout [ 96.496181][ T5954] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 96.496204][ T5954] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 96.496221][ T5954] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 96.496239][ T5954] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 1382600582 [ 96.502230][ T5844] Bluetooth: hci3: command tx timeout [ 96.509176][ T5954] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 96.534541][ T5956] ubi31: background thread "ubi_bgt31d" started, PID 5956 [ 96.613696][ T1091] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.720914][ T1091] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.731021][ T1091] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.781918][ T1091] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.794258][ T1145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.811327][ T1145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.929321][ T1145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.963044][ T1145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.046870][ T1145] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.073120][ T1145] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.149610][ T5961] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6'. [ 97.225093][ T1145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.251722][ T1145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.357881][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.392507][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.443406][ T1091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.455642][ T1091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.567554][ T5974] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7'. [ 98.783251][ T5976] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5'. [ 99.434914][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 99.525499][ T0] NOHZ tick-stop error: local softirq work is pending, handler #108!!! [ 99.583314][ T5987] 8021q: VLANs not supported on ip6gre0 [ 99.628192][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 100.037642][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 100.141229][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 100.242950][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 100.955750][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 100.965946][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 101.835537][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 102.391574][ T6008] netlink: 68 bytes leftover after parsing attributes in process `syz.2.12'. [ 102.771717][ T6004] input: syz1 as /devices/virtual/input/input5 [ 102.774944][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 103.296582][ T6015] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17'. [ 104.675024][ T5831] [ 104.677399][ T5831] ============================================ [ 104.683559][ T5831] WARNING: possible recursive locking detected [ 104.689736][ T5831] 6.16.0-rc4-next-20250703-syzkaller #0 Not tainted [ 104.696438][ T5831] -------------------------------------------- [ 104.702604][ T5831] syz-executor/5831 is trying to acquire lock: [ 104.708770][ T5831] ffff88805a5a48c8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: rpc_close_pipes+0x10a/0x730 [ 104.719105][ T5831] [ 104.719105][ T5831] but task is already holding lock: [ 104.726486][ T5831] ffff88805a5a11c8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: __simple_recursive_removal+0x190/0x510 [ 104.737764][ T5831] [ 104.737764][ T5831] other info that might help us debug this: [ 104.745854][ T5831] Possible unsafe locking scenario: [ 104.745854][ T5831] [ 104.753323][ T5831] CPU0 [ 104.756624][ T5831] ---- [ 104.759916][ T5831] lock(&sb->s_type->i_mutex_key#20); [ 104.765394][ T5831] lock(&sb->s_type->i_mutex_key#20); [ 104.770868][ T5831] [ 104.770868][ T5831] *** DEADLOCK *** [ 104.770868][ T5831] [ 104.779016][ T5831] May be due to missing lock nesting notation [ 104.779016][ T5831] [ 104.787334][ T5831] 4 locks held by syz-executor/5831: [ 104.792614][ T5831] #0: ffff8880796de0e0 (&type->s_umount_key#50){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 [ 104.802819][ T5831] #1: ffff88802f8820a0 (&sn->pipefs_sb_lock){+.+.}-{4:4}, at: rpc_kill_sb+0x77/0x190 [ 104.812407][ T5831] #2: ffffffff8f6d0e30 ((rpc_pipefs_notifier_list).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90 [ 104.824519][ T5831] #3: ffff88805a5a11c8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: __simple_recursive_removal+0x190/0x510 [ 104.836198][ T5831] [ 104.836198][ T5831] stack backtrace: [ 104.842106][ T5831] CPU: 0 UID: 0 PID: 5831 Comm: syz-executor Not tainted 6.16.0-rc4-next-20250703-syzkaller #0 PREEMPT(full) [ 104.842126][ T5831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 104.842143][ T5831] Call Trace: [ 104.842152][ T5831] [ 104.842160][ T5831] dump_stack_lvl+0x189/0x250 [ 104.842188][ T5831] ? __pfx_dump_stack_lvl+0x10/0x10 [ 104.842212][ T5831] ? __pfx__printk+0x10/0x10 [ 104.842235][ T5831] ? print_lock_name+0xde/0x100 [ 104.842252][ T5831] print_deadlock_bug+0x28b/0x2a0 [ 104.842277][ T5831] validate_chain+0x1a3f/0x2140 [ 104.842308][ T5831] __lock_acquire+0xab9/0xd20 [ 104.842330][ T5831] ? rpc_close_pipes+0x10a/0x730 [ 104.842349][ T5831] lock_acquire+0x120/0x360 [ 104.842367][ T5831] ? rpc_close_pipes+0x10a/0x730 [ 104.842391][ T5831] down_write+0x96/0x1f0 [ 104.842409][ T5831] ? rpc_close_pipes+0x10a/0x730 [ 104.842428][ T5831] ? __pfx_down_write+0x10/0x10 [ 104.842444][ T5831] ? __pfx_find_submount+0x10/0x10 [ 104.842462][ T5831] ? _raw_spin_unlock+0x28/0x50 [ 104.842484][ T5831] ? d_walk+0x6f4/0x780 [ 104.842501][ T5831] rpc_close_pipes+0x10a/0x730 [ 104.842522][ T5831] ? d_invalidate+0x204/0x260 [ 104.842539][ T5831] ? __pfx_rpc_close_pipes+0x10/0x10 [ 104.842559][ T5831] ? up_write+0x1c4/0x420 [ 104.842583][ T5831] ? __pfx_rpc_close_pipes+0x10/0x10 [ 104.842603][ T5831] __simple_recursive_removal+0x20b/0x510 [ 104.842626][ T5831] ? __pfx_rpc_close_pipes+0x10/0x10 [ 104.842646][ T5831] rpc_unlink+0x56/0x80 [ 104.842665][ T5831] rpc_pipefs_event+0xc0/0x170 [ 104.842682][ T5831] notifier_call_chain+0x1b3/0x3e0 [ 104.842707][ T5831] blocking_notifier_call_chain+0x6a/0x90 [ 104.842731][ T5831] rpc_kill_sb+0xd0/0x190 [ 104.842754][ T5831] deactivate_locked_super+0xb9/0x130 [ 104.842774][ T5831] cleanup_mnt+0x425/0x4c0 [ 104.842792][ T5831] ? lockdep_hardirqs_on+0x9c/0x150 [ 104.842818][ T5831] task_work_run+0x1d1/0x260 [ 104.842835][ T5831] ? __pfx_task_work_run+0x10/0x10 [ 104.842851][ T5831] ? __x64_sys_umount+0x122/0x160 [ 104.842875][ T5831] ? exit_to_user_mode_loop+0x40/0x110 [ 104.842895][ T5831] exit_to_user_mode_loop+0xec/0x110 [ 104.842914][ T5831] do_syscall_64+0x2bd/0x3b0 [ 104.842929][ T5831] ? lockdep_hardirqs_on+0x9c/0x150 [ 104.842953][ T5831] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.842969][ T5831] ? clear_bhb_loop+0x60/0xb0 [ 104.842987][ T5831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.843003][ T5831] RIP: 0033:0x7f98cd58fc57 [ 104.843022][ T5831] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 104.843036][ T5831] RSP: 002b:00007fffcbade6c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 104.843054][ T5831] RAX: 0000000000000000 RBX: 00007f98cd610925 RCX: 00007f98cd58fc57 [ 104.843065][ T5831] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffcbade780 [ 104.843075][ T5831] RBP: 00007fffcbade780 R08: 0000000000000000 R09: 0000000000000000 [ 104.843085][ T5831] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fffcbadf810 [ 104.843097][ T5831] R13: 00007f98cd610925 R14: 00000000000189e7 R15: 00007fffcbadf850 [ 104.843114][ T5831] [ 106.362145][ T6027] 8021q: VLANs not supported on ip6gre0 [ 106.810642][ T6043] netlink: 4 bytes leftover after parsing attributes in process `syz.0.22'.