last executing test programs: 12.219179355s ago: executing program 4 (id=249): syz_usb_connect(0x0, 0x286, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000a1f169405909d02b9848000000010902740201000000000904a80010ff8a3700090505104000057f03090507010002080b04090503"], 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x26, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x4}, [@jmp={0x5, 0x1, 0x4, 0xa, 0xe699cb8d88ef25d5, 0xffffffffffffffff, 0x6b9c5ae879fa2d4d}, @printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x80}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x17b5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x201eabf0c2c3bdfc}}, @map_fd={0x18, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x8001}, @cb_func={0x18, 0x2}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @alu={0x7, 0x1, 0x2, 0x1, 0xd, 0x0, 0x8}]}, &(0x7f0000000200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000000280)={0x3, 0x6, 0x0, 0x1}, 0x10, 0x0, 0x0, 0x7, 0x0, &(0x7f00000002c0)=[{0x1, 0x5, 0xe, 0x7}, {0x2, 0x5, 0x8, 0x1}, {0x0, 0x1, 0x1, 0x1}, {0x0, 0x1, 0x8, 0x8}, {0x5, 0x2, 0xb, 0x5}, {0x5, 0x5, 0xc, 0x7}, {0x3, 0x3, 0xe, 0xf}], 0x10, 0xb}, 0x94) syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r1, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{0x1, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r3 = openat$incfs(0xffffffffffffffff, &(0x7f00000004c0)='.log\x00', 0x214000, 0x40) r4 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x58, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r6, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x0, 0x4, 0xae, 0x2, 0xe, 0x450e}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0x3, 0x9}}]}}}]}, 0x58}}, 0x44080) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r6, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x55}, 0x4000) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='oom_score_adj\x00') readlinkat(r7, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000540)=""/76, 0x4c) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x18, 0x14, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xc}, [@call={0x85, 0x0, 0x0, 0x74}, @tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x2}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f00000005c0)='syzkaller\x00', 0x1, 0xc9, &(0x7f0000000600)=""/201, 0x41100, 0x0, '\x00', r6, 0x0, r7, 0x8, &(0x7f0000000700)={0xa, 0x2}, 0x8, 0x10, &(0x7f0000000740)={0x4, 0x5, 0x200, 0x4}, 0x10, 0x0, 0x0, 0xa, &(0x7f0000000780)=[r8], &(0x7f0000000800)=[{0x5, 0x4, 0x5, 0x4}, {0x1, 0x5, 0xa, 0x3}, {0x3, 0x1, 0x4, 0xa}, {0x2, 0x1, 0x8, 0x5}, {0x3, 0x2, 0xf}, {0x4, 0x5, 0x6, 0x8}, {0x3, 0x2, 0x9, 0x1}, {0x5, 0x2, 0x8, 0x5}, {0x0, 0x3, 0x2, 0xb}, {0x0, 0x2, 0x1, 0x7}], 0x10, 0x2}, 0x94) mbind(&(0x7f00005b4000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x100000000000041, 0x2) symlinkat(0x0, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) poll(&(0x7f0000000200)=[{r9, 0x8110}], 0x1, 0x7f) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000000)='cq_schedule\x00', r0}, 0x18) 9.902861267s ago: executing program 1 (id=258): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x100, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x701203, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6(0xa, 0x1, 0x0) sendmsg$inet6(r3, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1400000000000000010000000c0000002b"], 0x30}, 0x0) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000040), 0x0, &(0x7f0000000000)={[{@mpol={'mpol', 0x3d, {'bind', '', @void}}}]}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) r6 = socket$unix(0x1, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x8, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80003, {0x0, 0x0, 0x0, r8, {}, {0x10, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x7}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 9.211189288s ago: executing program 1 (id=260): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0xb9) mount(&(0x7f00000002c0)=@nullb, 0x0, 0x0, 0x1000, 0x0) r0 = open(&(0x7f00000005c0)='./bus\x00', 0x145842, 0x0) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x100000}], 0x2, 0x0, 0x0, 0xb) 9.10949872s ago: executing program 1 (id=261): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac14140f00000000000000001400020002000000ffffffff00000000000000000d0001007564703a73797a32"], 0x54}}, 0x0) r3 = syz_io_uring_setup(0x3b9, &(0x7f0000000300)={0x0, 0x0, 0x40, 0xfffffffc, 0x30a}, &(0x7f0000000400), &(0x7f0000000280)) io_uring_enter(r3, 0x47fb, 0x0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100280000000000000002000000200001800d0001007564703a73797a"], 0x34}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r4 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000c80)) recvmmsg$unix(r4, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="000000000200"/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000ff0d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) r5 = syz_open_dev$video4linux(&(0x7f0000000080), 0x100, 0x20000) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={r4, 0xe0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0xa, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x35, &(0x7f0000000440)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000480), &(0x7f00000004c0), 0x8, 0xe4, 0x8, 0x8, &(0x7f0000000500)}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000840)={'tunl0\x00', r6, 0x700, 0x8000, 0x2, 0x0, {{0x17, 0x4, 0x2, 0x4, 0x5c, 0x67, 0x0, 0x20, 0x2f, 0x0, @broadcast, @multicast1, {[@timestamp_addr={0x44, 0x2c, 0x24, 0x1, 0xf, [{@multicast1, 0x400}, {@multicast1, 0xf}, {@rand_addr=0x64010101, 0x5}, {@multicast1, 0x7}, {@loopback, 0x7}]}, @generic={0x7, 0xf, "93fe121dcc88405d3ab5491ceb"}, @noop, @generic={0x88, 0xa, "e5cf44ed66fb786d"}]}}}}}) ioctl$VIDIOC_S_DV_TIMINGS(r5, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0x8, 0x5, 0x0, 0x1, 0xd26f, 0x4, 0x7, 0x9, 0x0, 0x3579, 0x93, 0xfffffffc, 0x81, 0x2, 0x3, 0x0, {0x8dc5, 0x94}, 0x7, 0x3}}) r7 = syz_open_dev$video4linux(&(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_QUERYMENU(r7, 0xc040564a, &(0x7f0000000140)={0x0, 0x1, @value=0x1012}) 7.930788065s ago: executing program 1 (id=265): sendmsg$inet(0xffffffffffffffff, 0x0, 0x2008084) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) bpf$MAP_CREATE(0x0, 0x0, 0x50) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x0, 0x122, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, 0x0) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000340)={'batadv_slave_1\x00'}) socket(0x2, 0x3, 0x67) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f024}) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000540)={0x2, @pix={0x3, 0x401, 0x3132564e, 0x1, 0x3, 0x3, 0xc, 0x7, 0x0, 0x0, 0x0, 0x3}}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000d5030000020000838500000071000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kmem_cache_free\x00', r5}, 0x18) r6 = epoll_create1(0x0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) epoll_pwait2(r6, &(0x7f00000000c0)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r7, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_MOD(r6, 0x3, r7, &(0x7f0000000080)={0x20000011}) syz_emit_ethernet(0x76, &(0x7f0000000640)=ANY=[@ANYBLOB="aaaaaaaaaabbaaaaaaaaaa000800450000680000000040019078ac1e0001ffffffff08009278000200026c97ffff63094009a6859ebda9652d295c2a7aec68b0fdddd4588eb7c584453dbd75cf74bd6831475b82f4402cc780c2fd56938ad6fb19b8347f2de7dc208c3b7ef94693a897540553c526da3d212081cc296f22e26261bca8d05842124c5b5065cdbb64abf25a3c49aa0b07fe54efa476fcd3bfd64c6294cf171a86f64b90dbba72fab4d03021dbd7477776dd470bbcf4605e1b06ebb08b1335f0e1153e3ee3e28534c0ca373b16403174a2115342d39e85bad1ffc9f8dc7e9727afc0dfa0cb7314b73d3e49cc0caffeda509b"], 0x0) 6.208517918s ago: executing program 4 (id=267): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = socket$netlink(0x10, 0x3, 0x0) dup(0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r5, 0x0, 0x0) mq_notify(0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newtaction={0x9c, 0x30, 0x48b, 0x0, 0x0, {}, [{0x88, 0x1, [@m_ctinfo={0x30, 0x2, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc}}}, @m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @remote, @remote}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x9c}}, 0x0) mremap(&(0x7f00005a9000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f00004b0000/0x4000)=nil) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r6, 0xf3, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x1, 0x0, r0, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) close_range(r0, r0, 0x0) 5.401198635s ago: executing program 2 (id=268): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x88, 0x30, 0x1, 0x70bd2d, 0x0, {}, [{0x74, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_ife={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f0000000340)='./file0\x00', 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x11000) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x28, r5, 0x603, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000001780), 0x8, &(0x7f0000000240)=ANY=[]) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r6 = socket(0x40000000015, 0x5, 0x0) bind$inet(r6, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x4e24, 0x7f, @dev={0xfe, 0x80, '\x00', 0x41}, 0xca}, 0x1c) sendto$inet(r6, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010012000000000000000700000a20000000000a03000000000000000000070000000900010073797a300000000044000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000200800034000000005140000001100"], 0x8c}}, 0x0) 4.255023155s ago: executing program 3 (id=271): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0xb9) mount(&(0x7f00000002c0)=@nullb, 0x0, 0x0, 0x1000, 0x0) r0 = open(&(0x7f00000005c0)='./bus\x00', 0x145842, 0x0) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x100000}], 0x2, 0x0, 0x0, 0xb) 3.574707755s ago: executing program 4 (id=272): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x180, 0x4, 0x28}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000050000850000001b000000b7000000000000009500"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r1}, 0x18) (async) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r2) ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(r2, 0x4068aea3, &(0x7f0000000180)={0xc1, 0x0, 0x1}) (async) syz_clone(0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x4000, 0x0) 3.455269122s ago: executing program 1 (id=273): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='highspeed\x00', 0xa) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x0, 0x0, 0x7fffffff}}}}]}, 0x4c}}, 0x0) r5 = syz_io_uring_setup(0x4ed, &(0x7f0000000140)={0x0, 0xfec9, 0x0, 0x0, 0x20024c}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x9, &(0x7f00000004c0)={0x77359400}, 0x1, 0x40, 0x1}) io_uring_enter(r5, 0xdb4, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r5, 0x18, &(0x7f0000000000)={0x6, 0xffffffffffffffff, 0x21, {0x4, 0x1}, 0x6}, 0x1) shutdown(r1, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000100)={'dummy0\x00', &(0x7f00000000c0)=@ethtool_eee={0x44, 0x2, 0x8, 0x4, 0xf, 0x2, 0x1, 0x4e0, [0xfffffffe, 0x2]}}) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x33, 0x0, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x6000, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000004900831c3ebd7000fedbdf250a80ff00", @ANYRES32, @ANYBLOB="0380000014000100fe88000000000000000000000000010108"], 0x38}, 0x1, 0x0, 0x0, 0x10000}, 0x4) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000080)={'ip6_vti0\x00', 0x1}) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000000)=""/10, 0x2}, 0x20) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000240)={{0x6, 0x8, 0x100, 0x7}, 'syz1\x00', 0x18}) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) 3.391051296s ago: executing program 2 (id=274): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x15, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) memfd_create(&(0x7f0000000640)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc9\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\xa4(V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93i|\xc0\x00\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\xfd\x89\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\xb5\x13^\x13\xcb\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000001c0), 0x0, 0x40000042, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000), 0x101000, 0x800, 0x3, 0x1}, 0x20) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'veth1_virt_wifi\x00'}) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) 3.368957914s ago: executing program 3 (id=275): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x48140, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a0300000008000000000001"], 0xd4}}, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f00000001c0)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="020100090e000000000000000000000005000600000000000a00000000000000fc000000000000000000000000000000000000000000000005000500000000000a00000000000000060100000000000000000000000000aa0100000000000000020013"], 0x70}}, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r4, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x400c800) preadv(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd600a847500140600fe8000"/35, @ANYRES32=0x41424344], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_open_dev$dri(&(0x7f0000000140), 0x100000000000, 0x44600) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000180)={{{@in=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {0x7fffffff}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2e9c8f856eb8cee6}, {{@in=@empty, 0x0, 0x6c}, 0xa, @in6=@loopback, 0x0, 0x4}}, 0xe8) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x10) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, r7, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x24, 0x2b, 0x107, 0xfffffffe, 0x0, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @ipv4=@broadcast}]}, @nested={0x4, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) 3.085193507s ago: executing program 0 (id=276): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r0, 0x3b87, &(0x7f00000003c0)={0x18, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) capset(&(0x7f0000000480)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x7e, 0xffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net\x00') fcntl$notify(r2, 0x402, 0xc0000001) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='loginuid\x00') write$binfmt_format(r3, &(0x7f0000000040)='1\x00', 0x2) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x4, r1, 0x0, &(0x7f0000000180)="f1", 0x1, 0xfffffffffffffffd}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b7020000f53f6314bfa300000000000024020000fffeff7f7a0300fef0ffffff79a4f0ff00000000b7060000ffffffff2e64050000000000750afaff07cd02020404000000247d60b7030000030a00006a0a00fe0000000c850000003f000000b70000000000002995000000000000001da5ad3548ebb63d18c5071c7e821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1a15750ab9a780001000000000000d4bf20c2bd152d814f01f2cd519e078d4ffab418e4682b2aec5e4a35629e8ef040c50287c37a7f4182f32333b08c6e497687e10a4daea5cac0ceafdbb126eb02a1f5104d16ddb64963d84d91814cd5817e0b8f6f5e6ee7a39e180b5a18ed786b782ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a6211e52bb3598e9b5d4f22d8c19f958e8b34de35949a7a48ce18799ee53da177a81ea65e652c1d71b7ee86a75b0100000042127a8f84538a9a311c757f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d32e3f4ee367c5a769c0a606636c9f4a4413c098f4fcc96623b7c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7d9ebe3be70c436432b70a80cce69df30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48e7565efff2dbbb512218c98442406333c890923a797e00b75481739952fe87fde27ce81893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7025759d4b45576c205c70631e8ad585951950e521f4e210b6494e3c52d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7fd0d9338923789a1edcd8043fe83919088383268324a25df14010c8ed6b8d43400eaa00ff9bc46e1cfecbdc0e451ac53b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404e0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37deee7a60b903d2d9fe9d451cafcc8dc389671c2d08b6e264150a6b9445b00cee4585af04fa69e0380be0d66649dcf3bf8a906b029faca75ce34c41aec7aa86e596119109ea8b3f7c65c902499227c087301643baab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628e3e77a0de32e356521df06f995cb57f97052fc4158250ccecfb67ea8faf509593fadc7eafb613327b052397af1ede94d87590ce90a0a7579766f0e5eb09d38ac46e99e7ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6e0b67f62a83a256474c97c925d9d447175b535c87dbdeb0dcca5303eed6689ea91e1665c691df736368dde47e6672e93a314c5f60e7b68c2242bd0f0d8c66449d8687dcf2d0f76668b2b9bf8b32b99b7daf34b2d825d192ade90a1162acfe9749d516d014cef5f99126324ea02baea5808c430985749901b09e4902a6f5addc0103756b894418e4591c624a9b206abbfb888d413d923b0d7c9d997d6d8e64787c4d397f57a15b6e0b4212b6cb55b9c207bbe08f483b1bea05f41b9a1d3af087047c568ae6ebfc0bb5ec10b6290dc757a4903a88fb2c035b2349b6d2f0c051b8b7718384eebd5fc19928cea713ff09e179c308fbe9bd64374d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad1030a79517a88de7596429a20793e12616aa32b3e720c6521fbe93963e9536d16f3db211fca7dd99c0a0125ff8ef534b93dcb34e1da2c008a9f2a29e30823bf0ec3639cadaf9be9608358e1e5ab17eea477b1754f78f45468c9568471667f82f5e250b979b9f2bd0d1b6bc03d11811ac6eec9a3ecd9e3c3299ee5eb3c6cac8fbd06514b7ee743ece79c04566d02a08fd5fcabbab3d129c0cced3ce11dafa380700000000000000c114d0b423e64c6157fac5e4e2168f33541daeff9983d0e488a78bef538f870b84798272b2101e0abf1cd64500b79e01e11d727389653bd80a39d5bbe2e23d2f5ff10047423429981bd9b4ce680e174c266391e3e7689452654e5cd5ada6e025327a1942b5a068f15fa58eaa267d4e0881783dddbdd777f8be0824ffdf6d06c621880dbbe9534f15e8c2e364d3ec67deb6ab9f2a0f03212972dbd38500000008173553a67be48633103809eee0be51d67d7ce230b389607b4c3b18da1c48f3180f2e0d79e54565fdd9a099b5b5ba2761905b88b7cbfc39c35dd153609da3da263438f12769602c2195245ff83e249119d4f6cabfbdef84ada19ef4a67ed66d7043036515d0be5a231f99e71aba5d5ae04676eff3e85f0844c41bbcfde7a931d1ec55c01f703bfd1b97756bfe55a91f6b379f34a018906339771157c66dbd7471d1beec7f029ef552cf5e92a1a0db21b59355763967ce26a577bc514b6d22a09c385c5ba6caf524e1688fc0f29f8bb35ae7bc8eb5ba51aebdf7d972c3267cedbe77ed70d9c539bc455a6f88b39196c8a224b0acf4d796fea59a07baa34cc270fb096ef330fbebdf872d7d0bc4f9a963355c554abc5cdb91464faabcd09cd9a53f5d1b2ea7e96f428f7cd6735c19c61dc9942d30bf29ef85ed01c2fcd6060aa40eeff971477b4fde48507b7bad95a496540adff7e4a72fd1f94d7c703ab1525c946c54e0da3d7ebfcc8cea2e84c3b310aaea5a1627df898c00a9aaf2d88a36afa4c5b1816384310600001c33125ad7f7970beeb256aec06e39fc6c66544e1d1dc5fea4b68a82e3568ca30aea9a1d097f06f11dc362f4bae5ef57c67686a15855cd351bf26f40fb1348cfce79897682228e6d9643530c81bab27bf7b1c4a76a5be180bb830cf06827c3f38a9c9c580c732c30aaceda78b0297de35a922b1375b129655beb31899e26052cc216f832fdb0a0015f93c9cff77f59cda1ec5f3e358848756cebb074266a47e39ae26e80e8c65aaf73c24925458520a9ca98760d1005c9f81846459ae6d5baa4f02807939ddc29c3520f7c58ed9bc5a569c7a1bc33cf4f330a18276ffb4550b9166c3939e8041094bec034aa0ec6638b74fe34f0f1ec6903a1135808d5d8d26c9203c3f87e66c407b7c5c0888d4558dd657cc0213efad68e76fdd7b23e68064fd4b271ed79c50abacdd2871b0c1f8c971df59a5a1901ddf804bed43e391f882d2a45c51cdbba86b2a1b7c0c4923642a731ea4dcbad2b6ebbebe787a8e28e781d75beee924b3b1e390750f316648133922c021f98fd2d5d71a7a3679397ef6cf432837b7e264831ec01c4c3146ba0caac3b13d55945ec00e978a1c1712cd51187936200606c9cd6877b2f72125295c54721f8e15df2ae282a8becb99a726fd92acc92141e1f574b4b0b3c992a61af3372d0d9217776b1a42cd2cee816a70bf1ddd69b590d53e28ba356e74b38e23e50d898e95cdc7cc809e462c884b53f672aab1411ecfd4c91e7a9782fc6763f0efd4bcbaf1fc3a00000000000000000000000000000000500000000000000000000000048e510340087caf22439d5304bd704a6a78a512269a9b1cbd13bea78c807bbc73853ae187cbb768673e9d1bf74a3b0a6c234accd8506adf314f4c5e08174540b69d3c0da660052b43b86baf49e7ac64d9c21598b1e01dc1e1b5a53626b090496dbf7af441e397016c3c094d5c91ffe0a7ceacfd225ed9a6c905f79ad7052747dd6cceef4c310e0e935311118bc6bf0e5ca6c7cca7d5c03be570308da8a40578b4db14961fbccf6e2f2d56e9509c434126515b56d032e20c12e830d1bc64826fc9b318da5911e466878dbb81edeff69363fb75af5cd80536f14d2eaa7764db23acdbd394bbbbccfd8b129258bb0a93cee1d44f8665172c06933d20f184b78b435462c52a85149451ffd564c56a7cbf11a1127c77242915e43b2bc"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x200000, 0x10, &(0x7f0000000000), 0x143}, 0x48) 2.974654548s ago: executing program 0 (id=277): setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @local}}, 0x0, 0x18, 0x0, 0x0, 0x500}, 0x9c) r0 = dup(0xffffffffffffffff) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0), 0x400, &(0x7f0000000080)=ANY=[@ANYBLOB='mpxl=local:,\x00']) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) memfd_create(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$inet6(0xa, 0x400000000001, 0x0) r3 = socket(0x2a, 0x2, 0x0) getsockname$packet(r3, &(0x7f00000006c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f00000011c0), &(0x7f0000001200)=0x4) r5 = syz_open_dev$loop(&(0x7f0000000140), 0x760, 0xa382) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r5, 0x400c6615, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xfffa, 0x2}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x73}]}}]}, 0x44}}, 0x24000000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000180)={'sit0\x00', &(0x7f0000000240)={'syztnl1\x00', r4, 0x20, 0x7, 0xb418, 0x7, {{0x17, 0x4, 0x3, 0x19, 0x5c, 0x9b, 0x0, 0x5, 0x2d, 0x0, @remote, @remote, {[@timestamp_prespec={0x44, 0x2c, 0xf9, 0x3, 0x7, [{@multicast1, 0x3}, {@multicast1, 0x8}, {@rand_addr=0x64010100, 0x157e}, {@loopback, 0x3ff}, {@remote, 0x400}]}, @ssrr={0x89, 0xf, 0x9c, [@multicast1, @dev={0xac, 0x14, 0x14, 0x2f}, @broadcast]}, @ra={0x94, 0x4}, @cipso={0x86, 0x6, 0x2}]}}}}}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0xe90, 0x30, 0x25, 0x70bd2b, 0x0, {}, [{0xe7c, 0x1, [@m_pedit={0xe78, 0x1, 0x0, 0x0, {{0xa}, {0xe4c, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x28, 0x5, 0x0, 0x1, [{0x24, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}]}]}, @TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x24, 0x9, 0x4, 0x200, 0x8}, 0x1, 0x8}, [{0x6, 0x80000000, 0x5, 0x6495, 0xef1, 0x400}, {0x6, 0x6, 0x7fff, 0x7fffffff, 0x1, 0xffffdb16}, {0x9, 0x2, 0x5d, 0xb, 0x8001, 0x8}, {0x80000000, 0x3, 0x7, 0x7ff, 0x6, 0x48000000}, {0x440e, 0x1ff, 0x2, 0x0, 0x40, 0x5}, {0x5, 0x7, 0x1, 0x6, 0x401, 0x401}, {0xcf, 0x2, 0x5, 0xb037, 0x7, 0x101}, {0xa933, 0x80000000, 0x4, 0x58cc, 0x1ff, 0x1}, {0x7, 0x7, 0x7, 0xfdaecfe, 0x8, 0x44}, {0x7, 0x8, 0x800, 0x5, 0x9, 0x5}, {0x4, 0x5, 0x3ff, 0xff, 0x2, 0x7f}, {0x21d6, 0xd7, 0xffffffff, 0x1, 0x6, 0xffffff80}, {0x5, 0x6, 0x7fff, 0x7, 0x3, 0xe00}, {0x10, 0x7eb9, 0x8, 0x7fff, 0x9}, {0x80000001, 0x5, 0x4, 0x8, 0x1b7, 0x1}, {0x1, 0xc0, 0x6, 0x73, 0x9, 0x400}, {0x6, 0x1, 0x3ff, 0x2, 0x2, 0xfffffff8}, {0xd, 0x4, 0x827a, 0x2e7f, 0xfd9, 0xff}, {0x2, 0xffff7f0a, 0x6, 0x400, 0x3683, 0x3}, {0x8, 0x9, 0x78, 0x2, 0x705cdee5, 0xff}, {0x7ff, 0x7, 0x4, 0x400, 0x3, 0x9}, {0x0, 0x10000, 0x9, 0x2, 0x4, 0x94d0}, {0x100, 0x9, 0x9, 0x609, 0xc, 0x1ff}, {0x45, 0x7, 0x7f, 0x4576, 0x7, 0x81}, {0x2, 0xb, 0x9, 0x2, 0x10, 0x1000}, {0x0, 0x10000, 0x1, 0x0, 0x2, 0x9}, {0xfef4, 0xd13, 0x3, 0x2, 0x9, 0x4}, {0x9, 0xb0, 0x9, 0x1, 0x4, 0x9}, {0x0, 0x140000, 0x4, 0x81, 0x4, 0x7f}, {0x7, 0x8, 0x8, 0x1, 0x10000, 0x3c97}, {0xe00, 0x8001, 0x7ff, 0x7fffffff, 0x4, 0x9}, {0xc1df, 0x7, 0x499, 0x1000, 0x8, 0x100}, {0x100, 0x3, 0x1ff, 0x6, 0x1, 0x6}, {0x3262, 0x474a, 0x10, 0x1b, 0x8, 0x7fff}, {0xffffffff, 0xe6, 0x0, 0xfff, 0x2, 0x8}, {0xfffffffe, 0xae7d, 0xbd15, 0x10, 0x5, 0x8}, {0x9, 0x8001, 0x6, 0x1ff, 0x2, 0x1000}, {0x9, 0x1, 0x9, 0x5, 0x75, 0x4}, {0x5, 0x10200000, 0x1, 0x10001, 0x3fb4, 0xb5e}, {0x9, 0xbca9, 0x10001, 0x9, 0x8000, 0x8}, {0x200, 0x5, 0x8, 0x0, 0x4}, {0x8, 0x8, 0x4, 0x3, 0x7, 0x681e96f2}, {0x414, 0x5, 0x401, 0x3, 0xe, 0x37}, {0xb1e, 0x5, 0xfffffff6, 0x7, 0xd, 0x8}, {0x4, 0x929, 0x6b3d, 0x27e020c9, 0x3, 0x800000}, {0x8, 0x700, 0x2, 0x4, 0x4, 0x4}, {0x3, 0x6, 0x9d, 0x4, 0xd, 0x56d0}, {0x9, 0x77eb, 0x5, 0x6, 0x7fffffff, 0x35}, {0xecea, 0x80000001, 0x2, 0x4, 0x3fb, 0x7}, {0xcb9, 0x3, 0x41f8, 0x8, 0x7, 0x7}, {0xc, 0x3d7b, 0x6, 0x8, 0x3, 0x2}, {0x2, 0x800, 0xe04, 0x0, 0x10, 0x3}, {0x7, 0x6, 0x7fff, 0x9, 0x3, 0xc217}, {0x6, 0x38a8, 0x7, 0x9, 0xd, 0x4}, {0x9, 0x8, 0x2, 0x5, 0x95, 0x7}, {0x200, 0x5, 0x1, 0x3}, {0x401, 0x8000, 0x2522, 0x8, 0x9, 0x1}, {0x9, 0x6, 0x7ff, 0xfffffffb, 0x8, 0x3}, {0x1, 0x2, 0x8f, 0xf3800000, 0x80000000, 0x9}, {0x1, 0x4, 0x9, 0x8, 0x1, 0x2}, {0x10, 0x8, 0xfed, 0x1, 0xcd9, 0xff}, {0x2, 0x6, 0x7, 0x7f, 0xffff, 0xd}, {0xa9f, 0x7, 0x8, 0x8, 0x0, 0x5}, {0x8, 0x2, 0x9, 0x4, 0x2000, 0x9}, {0x100, 0x2, 0x6, 0x40}, {0x0, 0x6, 0x5, 0x1, 0x40, 0x5}, {0x2, 0x1, 0x6, 0x7, 0x1, 0xffffffff}, {0x7, 0x81, 0x8, 0x8, 0xfff, 0x81}, {0x8, 0xf, 0xb, 0x80000000, 0x5, 0x2}, {0x5, 0x0, 0x0, 0x6, 0xa, 0x2}, {0x8, 0x101, 0x400, 0x5, 0x2, 0xf67d}, {0x8, 0x0, 0x6, 0x200000, 0x5, 0x9c66}, {0x800, 0x0, 0x9, 0x7, 0x6, 0x62}, {0x4, 0x7, 0x4, 0xb, 0x8, 0x8}, {0x9, 0x9, 0x1, 0xfff, 0xfffffffa, 0x5}, {0x5, 0x1000, 0x81, 0x80000001, 0x0, 0x80000000}, {0xe, 0x4, 0xff, 0xb757, 0x6, 0x669}, {0x2b, 0x5, 0x6, 0x0, 0x8, 0xe0000}, {0x6, 0xa, 0x8, 0xdc, 0x5, 0xe}, {0xfffffffc, 0x101, 0x6, 0x2, 0xcea3, 0x7fffffff}, {0x816, 0x80, 0xfffff37a, 0x8, 0x2, 0x7}, {0xe7a, 0x9, 0x52, 0x7, 0x100, 0x6}, {0x2, 0x845, 0x76fe, 0x1000, 0x7, 0x4}, {0x7, 0x6, 0x9, 0xfffffff8, 0x1, 0xa479}, {0x738, 0x36, 0x400, 0xd, 0x400}, {0x7, 0x767c, 0x0, 0x81, 0x4, 0x65ec}, {0x6, 0x62d5ed5b, 0xffff, 0x4, 0x6, 0x3ff}, {0x4, 0x7, 0x5, 0xc5c, 0x6, 0x9}, {0x0, 0xbbb, 0xe0d, 0x2, 0x2, 0x3}, {0x3, 0x0, 0x1, 0x1a3, 0x1, 0x6}, {0x7, 0x3, 0x5, 0x7, 0x4, 0x2}, {0x7f, 0x1, 0x4, 0x0, 0xffffffff, 0x6}, {0x7, 0x5d, 0x9, 0x2f1bd1fc, 0x3, 0x2}, {0x1, 0x1, 0x8, 0x4bf, 0xfffffffc, 0xfffffffe}, {0x4, 0x40, 0x2, 0x7f, 0x1, 0xffff}, {0x2, 0x8, 0x1, 0x0, 0x2, 0x3}, {0x0, 0x80000001, 0x6, 0x701, 0x3, 0x5}, {0x9, 0x0, 0x0, 0x3c1, 0xf, 0x2}, {0x4, 0x10, 0x1, 0x1, 0x452, 0x800}, {0x5308, 0x8, 0x9, 0x6, 0xf, 0x4}, {0xb9, 0x0, 0xcde4, 0x9be4, 0x80, 0x8}, {0x7, 0xa, 0x0, 0x7, 0x2, 0x7fffffff}, {0xd6d4, 0x1549, 0xffffffff, 0x0, 0xffffffc0, 0x2}, {0x7, 0x72f0, 0x10, 0x4, 0x1}, {0x5, 0x1, 0x4, 0x58cd, 0x2, 0x9a}, {0x6, 0x8000, 0x6, 0x7, 0x3f1, 0x2}, {0x2, 0xff1, 0x6441, 0x2, 0xb7f, 0xc3}, {0xfffffffc, 0x90, 0x0, 0x0, 0x31b1, 0x8}, {0x800, 0x5, 0x100, 0x0, 0xa, 0x5}, {0x4, 0xac, 0x1, 0x8a0, 0x1000, 0x5}, {0x33a9, 0x0, 0xfffffff8, 0x39, 0x400, 0x6}, {0x7, 0x480000, 0x800, 0x1, 0x1, 0x400}, {0x1, 0x7, 0xf, 0xfffffffa, 0x4, 0x6}, {0x101, 0x3, 0x7, 0x47fb, 0x7ffffff7, 0x18b7}, {0xffff7fff, 0x1, 0x3, 0x75bd, 0x7f, 0x36a5}, {0x4, 0x600000, 0x4, 0x9, 0x5c5, 0xe98}, {0x6, 0xc, 0xfff, 0x5, 0x8000}, {0x6, 0xfffffffd, 0x9, 0x3c80, 0xe7, 0x10}, {0x5, 0x6, 0x5f, 0x8, 0xe, 0x2}, {0x7, 0x1, 0x5, 0x6, 0x7f}, {0x7, 0xb5cb, 0xffffffff, 0x0, 0x1ff, 0x180}, {0x8, 0x401, 0x31, 0x6, 0x4, 0x4}, {0xbe1, 0x4d1, 0x7, 0x7f, 0x7, 0xfffffff8}, {0x0, 0x3, 0x8, 0x4, 0x9014, 0x800}, {0x83, 0x7, 0x9, 0xc6, 0xfffffff7, 0x6}, {0x7f, 0x1, 0x380, 0x3, 0x0, 0x8}, {0x80000001, 0x5, 0x5, 0x9, 0x5, 0x3}, {0x4, 0x78, 0x1, 0x68, 0x5d6a, 0x3}], [{}, {0x7, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {}, {0x7}, {}, {0x2, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x5}, {0x1, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x5}, {0x2, 0x1}, {0x1, 0x1}, {0x3}, {0x3, 0x1}, {0x1, 0x1}, {0x1}, {0x5, 0x1}, {0x1}, {0x3, 0x1}, {0x1}, {0x3}, {0x473fa55f353b9f8f, 0x1}, {0x4}, {0x4, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x2}, {0x2, 0x1}, {0x3, 0x1}, {0x2}, {0x3, 0x1}, {0x5, 0x1}, {0x5}, {0x2}, {0x1}, {0x3}, {0x2, 0x1}, {0x5}, {0x3}, {0x1}, {0x5, 0x1}, {0x5, 0xdfb49ec46723bfa7}, {0x5, 0x1}, {0x1}, {}, {0x4, 0x1}, {0x3, 0x1}, {0x5}, {0x2}, {0x2, 0x1}, {0x1}, {0x7}, {0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {0x3}, {0x5, 0x1}, {0x4}, {0x2}, {0x2, 0x1}, {}, {0x6}, {0x5}, {0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x1}, {0x1}, {0x4, 0x1}, {0x3}, {0x2}, {0x1, 0x2}, {0x3}, {0x2, 0x1}, {0x7}, {0x4, 0x1}, {0x2, 0x1}, {0x3}, {}, {0x5}, {0x3}, {0x3}, {0x2}, {0x3}, {}, {0x1}, {0x2}, {0x4, 0x1}, {0x3}, {0x2, 0x1}, {0x0, 0x1}, {0x2}, {0x1}, {}, {0x3, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {}, {0x0, 0x1}, {0x2, 0x1}, {0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x3}, {0x2}, {0x1}, {0x0, 0x1}, {0x0, 0x1}, {}, {0x1}, {0x4}, {0x3, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3}, {}, {0x4, 0x1}, {0x3}, {}, {0x5}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe90}}, 0x0) 2.971864625s ago: executing program 4 (id=278): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x6) sendmsg$netlink(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x10) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r3 = fanotify_init(0xf00, 0x0) getpid() pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f}, 0x0, 0x0) fanotify_mark(r3, 0x1, 0x10001043, r2, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x42, 0x58) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', r2, &(0x7f00000004c0)='./file0\x00', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='.\x00', 0x0, 0x0) renameat2(r4, &(0x7f0000000380)='./file0\x00', r4, &(0x7f0000000200)='./bus/file0\x00', 0x0) write$cgroup_int(r1, &(0x7f00000000c0)=0x7fff, 0x12) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x103000, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="b80000001900674c25bd700000000000fe800000000000000000000000000008e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000000000004000000000000000010bd000000000000000000000000000001000000000000"], 0xb8}}, 0x4000000) r7 = geteuid() setresuid(0xee01, 0x0, r7) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000040)) 2.426757532s ago: executing program 2 (id=279): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) io_setup(0x42, &(0x7f0000000100)=0x0) io_submit(r2, 0x20000000000000f0, &(0x7f0000000580)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x6, 0x0, r0, &(0x7f00000002c0)="a7750180000000000000deb229347eb08479b3b90e6fa7b4789864f6c9389ebc5899b49fb8ecf9", 0x3d, 0x0, 0x0, 0x2}]) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000200), 0x410000, 0x0) sendmmsg(r1, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)="a790d2fba125ebfda0d509044a40f7148fa32aed92575610997f0aa2a31440619522a640ae0a3a6d35c170d4bb175794", 0x30}, {&(0x7f0000000240)="b099455a889da88f2159b068461614191831996fd48a62aa79bdf736b197eb932527867385314b2c1b0edc37a727e0f62a1807905f6e1cf12889594dd72e1f700b41518c9a4e337bd9cb1867f59286f39d", 0x51}, {&(0x7f0000000380)="af15e6ec98ab55a802a955f5cec899749fb5e3c672843b5e0e126ee54efdc4268f936fee836c8974d3e88cac841f04ebb3538f4f1223f36e8fb667ae55fc87f2304111f01e87f36e1f6c5ae8fa49d90f844430373ce4cee9b4dee5c3847d7c74160e254b97160a48f732498f1ef1096493ecebf3b230ec5697dcf6e87c5d3809911bdb2edf0c9cb9ac05a7173b3dc5e31e7530ded5692f0ef05613cba91b6400c5265cd18517456dfe3f1bd9d296322c7ca9", 0xb2}, {&(0x7f00000000c0)="34f0b9ae55530dc2e4ccd66699488127f5a9a1c74afb10e81791583c069e10330d2b0fc46d", 0x25}], 0x4}}], 0x1, 0x2000800d) 2.107043969s ago: executing program 0 (id=280): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r0, 0x5607, 0x404) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x8000) 1.934986819s ago: executing program 3 (id=281): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x8b}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() bind$alg(0xffffffffffffffff, 0x0, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x4000800) (async) r2 = fsopen(&(0x7f00000000c0)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) (async) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) (async) r3 = gettid() (async) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) tkill(r3, 0xb) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000680)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @initr0, @exit, @alu={0x6, 0x0, 0x3, 0xa, 0x0, 0x2}, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x94) 1.934194403s ago: executing program 2 (id=282): socket$igmp6(0xa, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00000002c0)={r3, 0x7, 0x30}, &(0x7f00000000c0)=0xc) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000440)={r3, @in6={{0xa, 0x4e23, 0x70cd, @rand_addr=' \x01\x00', 0x80}}}, 0x90) bpf$MAP_CREATE(0x0, 0x0, 0x50) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200000700000000000000000000008500000041000000850000000500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r5, 0x27, 0x25, 0x0, &(0x7f00000007c0), 0x0, 0x702, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_generic(r4, &(0x7f00000001c0)={0x0, 0x14, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x38, 0x701, 0xfffffffc, 0x0, {0x6}}, 0x14}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000100)={'wpan0\x00'}) 1.834005385s ago: executing program 0 (id=283): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) r0 = socket$kcm(0x10, 0x2, 0x0) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x3, 0x100005, 0xb, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r1, &(0x7f0000000100), &(0x7f0000000000), 0x2}, 0x20) (async, rerun: 32) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) (async, rerun: 32) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0xa0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_SYNPROXY={0x4}, @CTA_PROTOINFO={0x8, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x4}}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20040010}, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e23, 0x4, @empty, 0x6}}, 0x38, 0x0, 0x4, 0x3, 0x4, 0x1, 0x1}, &(0x7f0000000100)=0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000140)={r4, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xd}}}, 0x1, 0x8fb0, 0xa, 0x3a, 0x20, 0x1, 0x2}, 0x9c) 1.763161676s ago: executing program 1 (id=284): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = getpid() syz_pidfd_open(r0, 0x0) syz_usb_connect(0x6, 0x2c9, &(0x7f0000000a80)=ANY=[@ANYBLOB], &(0x7f0000000280)={0x0, 0x0, 0x27, &(0x7f00000001c0)=ANY=[], 0x1, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x406}}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getrlimit(0x2, &(0x7f0000000400)) pipe2(0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000001800)=[{&(0x7f0000000180)="c580c81ff9b13addc77f98c18cba39250bb06bacc43bd382aaad4b67aec3134bbef2cfec3183f39dabf7313c2ecd615e56ea00317ff08f40a4b4af2b1839b2ca5a1b7d4afe9302468d80e495f0688d8633ba04f6d7bb6c0d708ef02b8f4099fd84e5326ced6aa19e098f4549bd4da4ddce52", 0x72}, {&(0x7f0000000300)="a5e0dd8b71855a57203368b8a2845343c7f3175f612c613b898a1db161b1647da8d8aacec95be18b7b618f7233043f6f3dc5ae39c4a67b72f85d46b14cb8675e2891b8e265a8019607e4b9c00cd570a96d8617d0bec3e6742dd143bb33fce5d5068252e29cc24e0e8c1ef1991e68fdb64f7846673912a51b23918e285d08ee8122c20cfa0e7b93ce2cd08d6e13dc008ce6005034540fbf90b45b69e13ab36927b379427ddb68eeee369d2c1bf89a11", 0xaf}, {&(0x7f0000000100)='\fh.', 0x3}, {&(0x7f0000000600)="af4018f1e10e600cf260fdf38fe362793645b67e1d508c09ce01dd7f8f041d313f9c2edab1d88d867bab9efb0ec8692dd3a7b38903dcf69edb80cb156260aa76ddc89d5ad019d5e3822a9082e306348b3f1447d8420cd44bc0d777629bcd188be5dd0332f2b0c4cb05fa5f0984896b482522f5cf4a0b78c3a3418f66af64d023e9213b3542254a98873ddf275b9cae9617445819deb7094250ba93b5298be5b8eaca77b47f71e0a64a683d20cad38c69577f610bac046dff5eaa5f92e590b20dfc24dd2fb81e9d4ad07eca74168768453b57dc847692dca64e0708bca147189a1f960c74e02ff40b229087d8d66bc4ae429b86dbbc574e621e9c0d58ee577aca4583996a43e72a422d5a33a83c5f3b2b36e95bac239bca6bfe7a63561c32def0254e729595296031eb8efe64c2293d894bb162aea3d1d23ec059721e93d0542467f9b363f4b0a132725d2b7960c90f6e8929869029bd4b58d620d588b4203501ec9e6b32d9738bc5da007c2b11c7e6513eaf371fb03caf58ce4c88dfee1a79d4d6ab55afd441e2342fb1b21d57dbf311bde6a62067ae12b53925466f6da559fb3af412aa24ad66af232d46043a84e205ec53821939d3b5a79962c79f4d2b0e15f47530c3bd108116d7087828edc61c2d6e8c971134f78eda107fb88e1b92f961a38108283ddef0053806e96e65a2de1f7ed957184950d862923961469bbddff1808557bad8a12c54e4707eaa1a3c6506e9371cb8d3419e79bb74c26dbbe17a5fbdc512b9b5111cec2e0b7571d1af010bc1b2bd867295b646323bc3537482baf1e4b4939c620df886b703d64e8681be8bc19415abfe06301c357ec559175f4dbeaea21b689e8aca3db8d413656b169a6b47a31d8882667d5ac7b8800b302ef925ee6c8ae9f83dc22b036d4797a857474d7c8935598ccadfbeb4fbc7147e0151d1d95a41763a3d9295dfcaa82a75a130991082cc55b7f9f826869a90e2d2520fc7e3f08575c9fe9fbba2f96b4c28b9733437e9447bce36d42558676f288cbdea054fa9c1d9367e8f1518efa6142bc92810a5fb9ae6df462040bfcbbc12f94b5bc9eaf68ed78a2af622cad05a2b1928273671e29103be45a18bfe4302643acc4a612bc767d4d7708b6ef885e8d8f42327b5b69a49894b91b86bf436c816b9ea4a21a2cd279db566a1d8d7ba149abe3830fc8d6b8f4ff4b06f1622c45bc4a5014c040e5aff589228485e76692702b9528b83a80a4f3e0369f6c9b81c2a30984907bfb9b939b2b2e29769e8c61c42346db844d7501b2ebbca7b8384768bdb67fd7baf462fec29092dfd511bdf7428de8e70dbfb60ea6a34859568b6b5525c4aaaa31c377bb4a6c942bfd32702c6a2a9b8a44e771b0f36b179566d072bd95966a28d49e08d9919bcb16a03d70a84c60380cfa7ebf5c928884933c93b5f5e14b984c56304b7a6bf9446f5436e05cff796db51471c6c0fc7aa3fd29085926fa757283d1baca2a64e13405c7993776bf02b56f9b8edc2d89bcc654b9cedb014036bed85ca37bfc286673b96f172dda42eb9980ac9faf9e570ee8ec833113800b0579d2ab182e42567f120045387a16f75010b07363b2a13d29a30a203d239d6e2e433b14948bac30450205524d42d8efcdf9955c8717640ab486829caa5ab1991c4ef5f9df86aed7d3bb35033865ac4125d26883d435bdaea2f394932d0e1398b872b4c1e7e16c889f5fec24e3dca1abd73e516eac05403360c469c868ba70ef6d1a3de92ba0204077374a459da4fc282b1aeef0ad315e626e39b6f1fff9e1f03c85452a8022d6c03661adf1394e489d4b5e91dd5e5d10c5db98d6c7cdeffe7a249a6a33438a2e2d9c549fa7589f1de9761cb5c7504f11d7485e766b4e0039ff8ae155c4961af9c0f1a5c7b648b94c53fcd93fe2ac6d2a5a2cd887c56bc2eef9e791562f4bf88d16f9be5b193036b641ad87ed49b9413e8e4ad92ab03978a05aa424b6c33fea3ffea42269f9a89ba12ca060ce968e391430e96088b495b9c4448e629baf8959813f611e9410084b945d7c9f5ebec0887bae12daaca73f8e21f6a13a92a979742b46d137897c09cf7e4f2de12aef528cd54ccf2ecc87b6b67fab2077aa4cfa4f907b619a4af854ca8ea436389e7b5e3d630bfd2eff828cf652a297f2d5e3639c03eef53e0ed8aff74c6fd9238304d08ec97a089fc8395c9e741d47f580655519978d5a07861937fa4a1915aeef41b4f47d893521cb601a0634a453aef153d029e0ad925efeb3ebf65c9a2797dbc483e2bd824594e26b6c3eaa87ec493f603e26c913ae9c3cceb5c8c25867aca5d7e61ce507baf6d7536257213bc42169a813d3a62fb25090b3f7a037a30003c045af6d63ecb508ec28d4b9dbe7db88bd72127a618ab4a2dfafd2700cafee0f0f3b5f17b090284da1d5239846a9d75f4a76ed12eefab0232fe5214675821751be066c2ab144e9db57c6afa72d9c826905cf7b0ecd2a5ec48109ca8f963d94c5d421546e4a44f1e436e54306539af32c227df20d0536b7323227f8394788750086aa19113aa6e299d13bd6c38ff4e29de57ae63d1768d9f4c4ac05fe3a5b4b99543c6a955d0841c3cffec3b8e9b72353981af1d534f4b08f676915062e5fcf42af9e852e8c4ed75940febdcdf6891f7cb25be75ab2f3e3f3861bb9a4dbf5e67e269dcd5efc94bc75540aaea442e6f2c1dfe952143a716c5a9e2ff27040a74879f8c9f725baee7e38bbeeb4219fc28455d85650a92e65828cbf24d2210dc8c10b7b69df3cd49e633c684b62b179e441342e4b23dc3eaa4e7356d20be9e9e421c4a903b82b9129c3dae3596dc19119a6de24ede09c19557743d5005240c3de0d410f83f89f3fb68ad77926b39ed4149030755d8ae5adab5395f43f20e763d03a41eaf2f67dab281163d961b61a3fe8b317a9f01e44680bee6c15eafb4502bde61d8d4807bb89d687967c7b6275a96ad2f5e65e7bfb10bea28ccc24b9526d1fefb1cef64854d13213b001f46f67b8c6429526032a890d818ce621f0e5fa3ddfaca27192eab0d4bb83ac2ce2aa2dc223eb66d37ba764dc569c428e9bf4f8bd6895d21394dddf9d7fa327bab8262724a45639cdc8e3d7c35d4d7cfc97e500cbc75a602a5c491e2b63fa64e82b538ca8ea11f07ba9809850732aaffb1e043519d180e71c145818d3e9a115c6b9393d25be159b6cbcd75e5b538a548eeaf99564a12d7713d44b5488de5e537ca9ba3e389f56bab3120e5a29f4596a775b96c04eb223af7bc4753b85c5f9057b27d767813b2f74c8c805e5685b5b3158fab83bac473a611e162adf9951e74622c58228e19526fbdcf846c4e5d89b08a046fb08b33e30a7274abcc6301292d9721f3b1cfd504c123fc0f35d8b987455e7fa2da6f02dc6d93f4f24553fe02b5e21f8b475ff206d921d67c00219aeb0485832e0e4790dcd4f934e10f46d2e1a6c315254deafd0bc2ded057a12d45dff0a80cfce5476e3e6f5c852e77026aaa69e6baa65db99eb341ccc11a6fc020f67808091c03f728f68388e38f87d3d0ce87eaa99c2572c0ca360c06e28928a40343f45b93979e46e280e5553d2924cc99c3643430c9957f906f5cd747d69ba1b5b1d884edac806f9aac214924ed2e88d20c1a5ea1d00a48fe641fa9f90a3e5c4394fd78711c15bb30fc87870f3a70f2c363e8ab6cc595543256f5f0eb2342500a5bc46851645f6eee6367fc587867b70b0142f63d5cf1d537ea5f4a2305a7193a8971893069eed27a22705264e9e85acfc5dc79e145d9fa34570d95d838c611e5c41491d4dc733d53deada252359d8a1453cb3baa88a5f5c03a3ae1f3921a31fbae680fab4b1fe9f928b14355a4b54f81e00fee037772ac9791cf8e2dbf501b390d89f51a4a3ab368db5afa6d27ba785bb84633acf92536df64ba4259dd4c3c94f771a9f927fbfb1deb705ae4dc6022d67fef77be05e1e3aa7f5d7493b95ef9a4688de2843d850a2692152068298ddb4804338ebdb73a218fa167ba52aaf46033d1befba2f26e23566f26652a8749d86ea000900c4377f615e6c855fdf4efa8980c519844c30fa72ca3933aa533b128364126600b34ee55da9a9588e2fa17ad4db377fb624147140f2ea6a79edb6106aa923cef00a87da1cac6aff1b0ba6f9d0de55487fc9b0a4da146396f42d1cee48648f06cb362f5c5ad10ad310fa092273a9e573bec36bc88ff32aee5ad5793445e92cf5bc07a2023aa1c24c1782e5e3c94df60b2c9737a4f192b85c2d481be52d11b2c143c793c408d8ab1d7fa8fc2a67ce13b7541f389010ad9989c52a0af2ee3580d96f7e32506befcbbc7fb11223f137f8ceb5c0574205306048ceb952409628b23343f3ddb384cf2542f8f284a8353500e5091b4e031a41785f741257ac3e81d7b5a2014b3395a637608ee532b4d1c62fb9328aa8a5a76fa3c057f22c1886cfd408261d9439f17887ada1041d467d90fc6130c8ba48802fce3ba751182e9ba681218cc6d8946792fd89fb1dc38a59aa70aad0b1664ad9e524ebe2b21ad3200f690c14c92f03ca3973624928422d8404ab041d113d1e328140d05aa76579e287d949498dd0bf4725f7dd1eb5471cecdcf1cffc5af4d9a461b6f88ab60882e01705941f8a26daea726c05efa9a93a417e5ad00f1afb7901f3b2c030d9819d6f9481ce6fde6e94a3c44ba8c2f6cd1abdc4c67b8e216cc1f2e703f116cb060a320236d9063cfb10bb12295324b3bb15d16eb803e7e7af14314a7edc1574aa0a53c9a83ba49b7eac0955f5aded48e620fba5ac774811b0fd124cabd5ae54e7602cc0cdaba98098e34d9d36ecfbfdd1c65f1fadfc5bfe6e469322da9e3039e1c1c6b0d9d83cb47ac332969b635646971b6ba7863b40b3b91e0b69f940327fab5a6459a3816f1830c799466a84cb31aca463e528fd4845c3a1ce036d1dc5744ad591967abbb76bf68ab7dbe9defffc124a5519f79f6d6e0f21b2218061bad4d5b1b600abe1da842511761f60d20431afe961356f756dc02f00ff4e0950230c97f19ec07516063e67564a0cc6d3ba49fbf54745083081cb96fe87cea2a68e3c2b0303daba828330239773b5331b73fcaedf48280d53703de1ecb3636e56ab30a8e82784300bcb7bbba7fcdc67ee85119f11d87780fc5add3b8f59a2efbac7f84bc4567c8f0be58a722cecde091b86b078d8a8159f736bf0d29e13bde5f5a65e3e77ff0142e1f029a1f305b865d390b4e22706d795d2f38ac79514bae60f85bde2c5ad336d283c8be74eb432ca882565348d109412e61c17bde8373d06c276f74a337437fd4f0adc7fb51a55b10e21d2cab8668e07bb8471a476aa76078120082aade0d64b8466460266b4afbb8b8f7e5f2f5c36bb8ca330cf0ef6aafb53842f14dfe8ca31744e8cd3f93a72b04288752a1bf639c49237434ca9e79aed217b2fb3ee8d209e51ce628aee148fabc16bd55917eff5aab6dd8809d7f93abdcdc18c7f9ee64dbc1cdd9718cc6f1f795df0546afa5672544f26c6f4bdabafaca8b806bf0ea65a35e0dac971df43a55ba2a18512f9892cf80d3d424c6513e0cf1fd69cbaaadadeee95b067118db04d011ab951640fd6a7152ac99f4de33d84848b484abf45f0bf133a6e6226c0eb0a58d3586beeee7b49aaa549fd89099b500878dd0cd5514dde3fbc76b4fb0b757e29f2b058bd99431234494d792302e7f4f3e14813a49179405634600f44d71d45e96dc7b723865567018c381f540dd0adefee0b2ac8c3890fc81a94e3f86845612fc6853", 0x1000}, {&(0x7f00000018c0)="511b779ca022e920c978075c6c34abbb270f58bfe2dcdf475c169dd2d8d6a090884b00bcfcd944d0fa4e1569641870f289be7753b02998ff76a0cc20f7175e0c455c319ed0ca8181a686f9c5a984609badb986a7d8e1d4eba628356e2b40bf643be9ac7bc71b7f9adf65bd9eedc9816d443af8b3d50e9c02a46fc431c856c02d2e8325ed39253c4f12e93bc4", 0x8c}, {&(0x7f0000000480)="b9406b2e0a675474acfa56309ace75c97bd71bb6e17a9f18073cac520cba420355b0a55902fbc2a65d7947b9f2945d57d66ed51abbd49531eb96b73c050eec0acaa95f42472ff6c38bb4dc884962a3abb791f1359bf37945991f3456f2baa8cd0c9b29f4e082f5e08309b2605533fa7e9579be5d42252cc2fa55c2396bdcf6447c0b250c25639c748f7bda5a258918bb139ba2c7a0d92946", 0x98}, {&(0x7f0000001600)="299e5583b5aef44091641c23448eccb3060d4e560d345e4189aa60a11902ae2bd80e114415ebb05ca1196b105d28acabaf80174a44c338f6dcfadba37f4e9a793fe86a6a28926e200593a475fdc7949c7b7af37f4881c7f0a8d034738e2fad814cddf9c1452508ef51ff5ec6eb2e47a7c9400b65caffde845e9a7ab22e2ea6c4e2b105be5f2f1f362862789794535cf7d76b5de9db952530782e27c213e46a6b4523be3f0b05c55730202ced7036bca763d21b4fea753cfb0cdc3b0d2a9bd4fd900cf55702b6a8c4981bbe6088f63eac6addb0a8", 0xd4}, {&(0x7f0000001700)="467e94b8128f968491403022890f5b797586c892d5e41adcf5ed3ff6b68b769f4fbae3b894caf3debaefdb5fd22f4f19ffe9c794279a1ae63fb0a5118ee80c1f0c04125a5c004f6dca94b9bada8f9e30dfebd7e9e6266f14ab932c1c4ad0670728f9413c553027a0b4071bb5c3066bd391b6bed7bbebdb65384b17bf0bfab0dd6edc016ce846f716aa05df926472d13f3e4358facc7204cf7aa143f457ce8a823a8e21cadf4791", 0xa7}, {&(0x7f0000000540)="73c46b0177b8652c367c4e9ed556dc320ef1c5229a18ccb1f07df83273b81a95c534de5620d01ee44e3cc3c4b8542e9c0d797e6c3988eb446a45693d8220f76c19f7b4082ae06a067330afb924f204985e81bfd2dad25fa612bbd767c4a391b92420b4fe402700497a565f70", 0x6c}, {&(0x7f00000017c0)}], 0xa, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1f00}, 0x94) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') getdents(r3, &(0x7f00000029c0)=""/4114, 0xfffffd33) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='contention_end\x00', r2}, 0x18) r4 = syz_open_dev$evdev(&(0x7f0000000100), 0x1, 0x400) ioctl$EVIOCGRAB(r4, 0x40044590, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) prlimit64(r1, 0x7, 0x0, 0x0) socket(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r7 = creat(&(0x7f00000005c0)='./file0\x00', 0x0) write$P9_RSTATu(r7, 0x0, 0x5a) mount(&(0x7f0000000080)=@nullb, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='vfat\x00', 0xa08410, 0x0) 1.523063301s ago: executing program 3 (id=285): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0xb9) mount(&(0x7f00000002c0)=@nullb, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) r0 = open(0x0, 0x145842, 0x0) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x100000}], 0x2, 0x0, 0x0, 0xb) 1.124949069s ago: executing program 4 (id=286): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYRES8=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b708000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) fallocate(r2, 0x8, 0x5, 0x800) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f00000004c0)={0x0, 0xc7, "a88763299785f711f23c35b76c30c6f5c385f389a981ab5b341cfb4b0e362a520db27ebfd4315b80de0caf97f2b05538cb2e1127a03886f26039738006d58b1a8e150a3525c371243738308e051641667a3f28d5d64756ba978332c22a37fe13f6105fce9b53334862e486645bcb8d2b07e7829347e4c4b1eede2c0940ab609f12123bb25573527d75442e5923f2a4bb86378811a1def5282fdc7ff5955d222fa51ee777d655fc774a8db29450a01c0d68b0e7e68668bcbd58b1fc7e287ce69719e272a5b20ae6"}, &(0x7f0000000340)=0xcf) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000003c0)={0x7, 0x7, 0x7, 0x8, 0x5f2, 0x9f, 0xfee, 0x3, r3}, 0x20) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x17) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000780)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="020026bd7000ffdbdf25810000000c0099002f0000003b0000000a00060008021100000100000a000600ffffffffffff00000b94c940fc006e5db3ce2fd1697bdcae447c5f4971442ab6892e00b138359f3dffa19ce5a760e80d08875bd2a1d32e7aa4e9476539f060390b8b893c94f6ae0dcd59d80a46c6b5bc084160c1a3eb675048caa3db22dc0c7deefedae3"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x24004041) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000a00000000000000000000020000000000000000010000840800000006000000b6df000004000000000000002e5cf5b2"], 0x0, 0x46, 0x0, 0x1}, 0x28) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000d0a010200000000000000000a0000010900020073797a3100000000090001007379123100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) sendto$ax25(0xffffffffffffffff, &(0x7f00000005c0)="d8b3723948d15c33a14f11ec7111103f48d60c663653e5d02a785b9522f280f2d55d3ea94fd89d82c98b89b9981ef7", 0x2f, 0x8000, &(0x7f0000000600)={{0x3, @null, 0x6}, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x48) close(r7) recvfrom(r8, 0x0, 0x0, 0x40002062, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000080)='9p_client_res\x00', r6}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000680)='f2fs_write_end\x00'}, 0x18) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r11 = dup(r10) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x4000, &(0x7f0000000440)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r11}, 0x2c, {[], [], 0x6b}}) write$P9_RXATTRCREATE(r10, &(0x7f0000000000)={0x7, 0x21, 0x2}, 0x7) 1.016788627s ago: executing program 0 (id=287): r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x1fffff, 0x1, 0x11, r0, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0xe) (async) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, 0x0, 0x0) (async) mremap(&(0x7f000008f000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000486000/0x1000)=nil) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000200)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='3\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="bc81"], 0x20) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x25, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x4c}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) 972.258346ms ago: executing program 2 (id=288): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000000)={'wg1\x00', 0x0}) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000006, 0x9132, 0xffffffffffffffff, 0x9aa9b000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000a62000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000956000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ce3000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00009e6000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0}, 0x68) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') read$FUSE(r2, &(0x7f0000001780)={0x2020}, 0x2020) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="580000001000010400000000fddbdf2500000000", @ANYRES32=r1, @ANYBLOB="0b85000000000022280012800a000100767863616e000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB="000000000200000008000500", @ANYRES32=0x0, @ANYBLOB='\b\x00,\x00\x00\x00\x00\x00'], 0x58}}, 0x0) 766.751172ms ago: executing program 3 (id=289): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x509401, 0x0) ioctl$IOC_PR_RESERVE(r0, 0x401070c9, &(0x7f0000000040)={0x9, 0x7}) r1 = openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$smackfs_logging(r1, &(0x7f00000000c0)=0x1, 0x14) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f0000000100)={0x2, 0x3, 0x8}) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_GET_VRING_BASE(r2, 0xc008af12, &(0x7f0000000180)) (async, rerun: 64) r3 = syz_open_dev$usbfs(&(0x7f00000001c0), 0x100000000, 0x440000) (rerun: 64) ioctl$USBDEVFS_SETINTERFACE(r3, 0x80085504, &(0x7f0000000200)={0x1, 0xfff}) (async) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder1\x00', 0x802, 0x0) (async, rerun: 64) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000280)={0x1b, 0x0, 0x0, 0x400000, 0x0, 0xffffffffffffffff, 0xb06, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x2}, 0x50) (async, rerun: 64) r6 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000300)={0xffffffffffffffff, 0x101}, 0xc) (async, rerun: 64) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000340), &(0x7f0000000380)}, 0x20) (rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x13, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, [@map_fd={0x18, 0x2, 0x1, 0x0, r5}, @initr0={0x18, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x40100}, @map_fd={0x18, 0x1, 0x1, 0x0, r6}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x8, 0xa, 0x5, 0x28}]}, &(0x7f00000004c0)='GPL\x00', 0x6, 0xbb, &(0x7f0000000500)=""/187, 0x41000, 0x21, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000005c0)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000000600)={0x4, 0x6, 0x1, 0x1}, 0x10, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000640)=[{0x4, 0x2, 0x1, 0x2}, {0x1, 0x5, 0xa}, {0x1, 0x2, 0x3, 0xa}, {0x3, 0x1, 0xb, 0xa}, {0x5, 0x2, 0x10, 0xc}, {0x2, 0x4, 0x1, 0xa}, {0x5, 0x1, 0x1}], 0x10, 0x8}, 0x94) (async) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000780), 0x200000, 0x0) ioctl$PPPIOCSNPMODE(r8, 0x4008744b, &(0x7f00000007c0)={0x8029}) (async) r9 = syz_io_uring_setup(0x5935, &(0x7f0000000800)={0x0, 0xb7ea, 0x200, 0x3, 0x342}, &(0x7f0000000880), &(0x7f00000008c0)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r9, 0x10, &(0x7f0000000d40)={0xfffffc9b, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000900)=""/249, 0xf9}, {&(0x7f0000000a00)=""/57, 0x39}, {&(0x7f0000000a40)=""/104, 0x68}, {&(0x7f0000000ac0)=""/120, 0x78}, {&(0x7f0000000b40)=""/29, 0x1d}, {&(0x7f0000000b80)=""/97, 0x61}, {&(0x7f0000000c00)=""/118, 0x76}], &(0x7f0000000d00)=[0x8, 0x80000001, 0x7], 0x7}, 0x20) ioctl$FS_IOC_GETVERSION(r7, 0x80087601, &(0x7f0000000d80)) r10 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000dc0), 0x42a02, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000e00)={0x0, 0x6, 0x8, 0xffff, 0x1, 0x7, 0x5, 0x52, {0x0, @in6={{0xa, 0x4e24, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x13}}, 0x70af5133}}, 0x4, 0x4, 0xd, 0xa284, 0x6}}, &(0x7f0000000ec0)=0xb0) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r10, 0x84, 0xa, &(0x7f0000000f00)={0x7, 0x5, 0x8001, 0xe, 0x6, 0x6, 0x7fff, 0x3, r11}, 0x20) (async) ioctl$MON_IOCH_MFLUSH(r4, 0x9208, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r10, 0x89f1, &(0x7f0000000fc0)={'syztnl0\x00', &(0x7f0000000f40)={'syztnl2\x00', 0x0, 0x1, 0x10, 0x5, 0xbb, {{0x16, 0x4, 0x1, 0x1d, 0x58, 0x64, 0x0, 0x8, 0x2f, 0x0, @broadcast, @multicast1, {[@timestamp={0x44, 0x24, 0xe6, 0x0, 0x2, [0x1, 0x1, 0x40, 0x6, 0x4, 0x5, 0x0, 0x2]}, @lsrr={0x83, 0x1f, 0xb1, [@empty, @multicast2, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @dev={0xac, 0x14, 0x14, 0x1c}, @local]}, @noop]}}}}}) setsockopt$packet_drop_memb(r10, 0x107, 0x2, &(0x7f0000001000)={r12, 0x1, 0x6, @local}, 0x10) openat$nullb(0xffffffffffffff9c, &(0x7f0000001040), 0x10201, 0x0) write$USERIO_CMD_REGISTER(r4, &(0x7f0000001080)={0x0, 0x20}, 0x2) (async) shmget$private(0x0, 0x1000, 0x1, &(0x7f0000fff000/0x1000)=nil) (async, rerun: 32) syz_clone3(&(0x7f00000012c0)={0x20400, &(0x7f00000010c0), &(0x7f0000001100)=0x0, &(0x7f0000001140), {0x17}, &(0x7f0000001180), 0x0, &(0x7f00000011c0)=""/165, &(0x7f0000001280)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5, {r10}}, 0x58) (rerun: 32) prlimit64(r13, 0xb, &(0x7f0000001340)={0x8, 0x4}, &(0x7f0000001380)) 155.419378ms ago: executing program 0 (id=290): syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) r0 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x656a, 0x100, 0x2, 0xbfdffffc}, 0x0, &(0x7f0000000280)=0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f00000000c0)={0x0, 0x7}, &(0x7f0000000100)=0x8) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f00000003c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c00018006000600800a0000d1000280cb0014"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) io_uring_enter(r0, 0x75fa, 0xe475, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x1e4411, 0x0) 137.573407ms ago: executing program 2 (id=291): socket$l2tp6(0xa, 0x2, 0x73) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001640)={0x28, 0x37, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x8, 0x6a, 0x0, 0x1, [@nested={0x4, 0x10}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) (async) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x5, 0x1000086}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) (async, rerun: 32) ioprio_set$uid(0x3, 0x0, 0x0) (rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') (async) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendfile(r1, r0, 0x0, 0x7ffffffd) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000040)={0x28, 0x2, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x804) socket$kcm(0x29, 0x7, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, 0x0, 0x0) (async, rerun: 32) r4 = socket$inet6(0xa, 0x3, 0x7) (async, rerun: 32) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x4, 0x2004, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r5, 0x2, 0x1}, 0x50) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (rerun: 32) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000480)={0x0, 0x60, &(0x7f0000000140)={&(0x7f00000002c0)={0x1c, r7, 0x9c3fa077fa966179, 0x0, 0x700, {{0x7e}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) (async) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@dev={0xfe, 0x80, '\x00', 0xff}, @in=@empty, 0x0, 0x0, 0x1, 0x4, 0xa}, {0xbd1, 0x0, 0x3}, {0x81, 0x2}, 0x1fffffc, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8000, 0x33}, 0x0, @in6=@empty, 0x1, 0x0, 0x0, 0x7, 0x6, 0x0, 0x10000}}, 0xe8) (async) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0xffe0) 67.134307ms ago: executing program 4 (id=292): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r0}, 0x10) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) (async) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000340)={&(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x10000}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='net_prio.prioidx\x00', 0x275a, 0x0) (async) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0xfffffffffffffffc, 0xc4, 0x89, @scatter={0x1, 0x0, &(0x7f0000000140)=[{&(0x7f0000001300)=""/4096, 0x1000}]}, &(0x7f00000004c0)="91de1c818e8c1222650791cedbfd2f339dcf74cd0307cb02412f380c6b672bd71db9e380ec36d1c60e2e44562338bd7738e3c41badcae01bf4b0afcb4be111a8e5167d27d063e9e2d84c1c02d7949ee3f1ab557d373f87492a30392c53dc5fa880b8aabda5cc4070a37781ff443915703f854f40372fd0924fdd96aed29678968bf015f1f927e5b8d075074b1243de7f49a55165b9971af31ce586014d165586644ea5ccc442f01475e4ce65b22c4fb67e916343bd9cb44bee90388c0933ba7c6115d0ea", &(0x7f0000000640)=""/239, 0x7f, 0x10007, 0x1, &(0x7f0000000240)}) (async) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x8401, 0x0) write$binfmt_misc(r4, 0x0, 0x0) dup2(r3, r2) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x12, r2, 0x0) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000012c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) (async) sendmsg$inet(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000001c0)="d080", 0x1}], 0x1, 0x0, 0x0, 0x800300}, 0x20000801) (async) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) time(&(0x7f0000000040)) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) syz_clone(0x900a000, 0x0, 0x0, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) 0s ago: executing program 3 (id=293): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000140)=ANY=[@ANYBLOB="1807000000000d000000000000000000851000000200000026000000feffff859500007b0000000095"], &(0x7f0000000400)='GPL\x00', 0x2, 0x91, &(0x7f00000004c0)=""/145, 0x1e00, 0x0, '\x00', r2}, 0x94) (async) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x649, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000240)={0x1, @raw_data="a425e2f1a54d24f14752424760608d70566e425a6c36af37b33fac9d31c8a9c7044410d324b03e044e454d2092a62fea8f13441431ce248bfc73a6726ee61ba491d15d8f392ff66fe0b17f0e11f5d2367d5593205ab1efa97d40619a553e7da2518125b850a186ef691daa55c9e50ffaf6ddc25220ded32aeba4524cec1afbd17abba1d15ea05e97ed3dcad452db6e08a991e2c78b057f55de7fdeba7411ce65700c0a1ad7946ff7c355db87566e3e5abb7a37a06731ed19ddfa970bb58a27fd9fa194c092730319"}) (async) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000007c0)=@filter={'filter\x00', 0xe, 0x4, 0x268, 0xffffffff, 0x138, 0x138, 0x0, 0xffffffff, 0xffffffff, 0x248, 0x248, 0x138, 0xffffffff, 0x4, 0x0, {[{{@ip={@remote, @rand_addr=0x64010102, 0x0, 0xffffffff, 'dummy0\x00', 'pimreg0\x00', {0xff}, {}, 0x0, 0x0, 0x24}, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x1, 0x6, 0x4}, {0x4, 0x0, 0x4}, 0x2, 0xd}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x3}}}, {{@ip={@empty, @remote, 0xff, 0xe92f794a3f81b63e, '\x00', 'ip_vti0\x00', {}, {}, 0x6c, 0x0, 0xc}, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c8) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.70' (ED25519) to the list of known hosts. [ 75.888196][ T5823] cgroup: Unknown subsys name 'net' [ 75.999941][ T5823] cgroup: Unknown subsys name 'cpuset' [ 76.008730][ T5823] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 77.374755][ T5823] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 81.434842][ T5836] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 81.442851][ T5836] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 81.451391][ T5836] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 81.459578][ T5843] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 81.490626][ T5846] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 81.498805][ T5846] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 81.507438][ T5846] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 81.515273][ T5846] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 81.520329][ T5836] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 81.531541][ T5836] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 81.540304][ T5836] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 81.540429][ T5846] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 81.548041][ T5836] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 81.562763][ T5836] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 81.562899][ T5846] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 81.570675][ T5836] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 81.586135][ T5836] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 81.586248][ T5846] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 81.593810][ T5836] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 81.607534][ T5846] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 81.637580][ T5843] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 81.646965][ T5843] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 81.654515][ T5843] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 81.662852][ T5843] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 81.671030][ T5843] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 82.279493][ T5840] chnl_net:caif_netlink_parms(): no params data found [ 82.578950][ T5844] chnl_net:caif_netlink_parms(): no params data found [ 82.591737][ T5837] chnl_net:caif_netlink_parms(): no params data found [ 82.609337][ T5833] chnl_net:caif_netlink_parms(): no params data found [ 82.700376][ T5849] chnl_net:caif_netlink_parms(): no params data found [ 82.735750][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.743170][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.750856][ T5840] bridge_slave_0: entered allmulticast mode [ 82.757981][ T5840] bridge_slave_0: entered promiscuous mode [ 82.799337][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.806620][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.813909][ T5840] bridge_slave_1: entered allmulticast mode [ 82.821325][ T5840] bridge_slave_1: entered promiscuous mode [ 82.941673][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.949843][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.957461][ T5844] bridge_slave_0: entered allmulticast mode [ 82.964398][ T5844] bridge_slave_0: entered promiscuous mode [ 82.974864][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.988178][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.030440][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.037853][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.045447][ T5844] bridge_slave_1: entered allmulticast mode [ 83.053407][ T5844] bridge_slave_1: entered promiscuous mode [ 83.096227][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.103927][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.111632][ T5833] bridge_slave_0: entered allmulticast mode [ 83.119737][ T5833] bridge_slave_0: entered promiscuous mode [ 83.128657][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.136783][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.144000][ T5833] bridge_slave_1: entered allmulticast mode [ 83.152269][ T5833] bridge_slave_1: entered promiscuous mode [ 83.183035][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.190982][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.198254][ T5837] bridge_slave_0: entered allmulticast mode [ 83.205237][ T5837] bridge_slave_0: entered promiscuous mode [ 83.229741][ T5849] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.236981][ T5849] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.244106][ T5849] bridge_slave_0: entered allmulticast mode [ 83.251912][ T5849] bridge_slave_0: entered promiscuous mode [ 83.299157][ T5840] team0: Port device team_slave_0 added [ 83.309082][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.318359][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.325533][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.333092][ T5837] bridge_slave_1: entered allmulticast mode [ 83.340803][ T5837] bridge_slave_1: entered promiscuous mode [ 83.350447][ T5849] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.358030][ T5849] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.365211][ T5849] bridge_slave_1: entered allmulticast mode [ 83.373094][ T5849] bridge_slave_1: entered promiscuous mode [ 83.382679][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.393784][ T5840] team0: Port device team_slave_1 added [ 83.402764][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.458369][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.509513][ T5844] team0: Port device team_slave_0 added [ 83.529848][ T5843] Bluetooth: hci2: command tx timeout [ 83.534764][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.567910][ T5849] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.606293][ T5844] team0: Port device team_slave_1 added [ 83.614660][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.638524][ T5849] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.665725][ T5833] team0: Port device team_slave_0 added [ 83.672878][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.680340][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.706733][ T5843] Bluetooth: hci0: command tx timeout [ 83.706742][ T5846] Bluetooth: hci1: command tx timeout [ 83.706966][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.716880][ T5843] Bluetooth: hci3: command tx timeout [ 83.766190][ T5843] Bluetooth: hci4: command tx timeout [ 83.781341][ T5849] team0: Port device team_slave_0 added [ 83.789744][ T5833] team0: Port device team_slave_1 added [ 83.795944][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.803863][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.830191][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.850272][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.857640][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.883842][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.898765][ T5837] team0: Port device team_slave_0 added [ 83.906876][ T5849] team0: Port device team_slave_1 added [ 83.927885][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.934864][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.961415][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.974834][ T5837] team0: Port device team_slave_1 added [ 84.035933][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.043669][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.070045][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.122298][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.129401][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.155802][ T5849] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.169918][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.176984][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.203080][ T5849] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.215088][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.222365][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.248337][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.265618][ T5840] hsr_slave_0: entered promiscuous mode [ 84.272764][ T5840] hsr_slave_1: entered promiscuous mode [ 84.280237][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.287438][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.313811][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.367155][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.374136][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.400720][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.458522][ T5844] hsr_slave_0: entered promiscuous mode [ 84.464730][ T5844] hsr_slave_1: entered promiscuous mode [ 84.471368][ T5844] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.479442][ T5844] Cannot create hsr debugfs directory [ 84.521199][ T5849] hsr_slave_0: entered promiscuous mode [ 84.528401][ T5849] hsr_slave_1: entered promiscuous mode [ 84.534613][ T5849] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.542267][ T5849] Cannot create hsr debugfs directory [ 84.629576][ T5833] hsr_slave_0: entered promiscuous mode [ 84.635880][ T5833] hsr_slave_1: entered promiscuous mode [ 84.642569][ T5833] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.651468][ T5833] Cannot create hsr debugfs directory [ 84.717119][ T5837] hsr_slave_0: entered promiscuous mode [ 84.723400][ T5837] hsr_slave_1: entered promiscuous mode [ 84.731147][ T5837] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.738805][ T5837] Cannot create hsr debugfs directory [ 85.275962][ T5840] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 85.292809][ T5840] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 85.303494][ T5840] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 85.322225][ T5840] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 85.387887][ T5849] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 85.402758][ T5849] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 85.413584][ T5849] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 85.423757][ T5849] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 85.521417][ T5844] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 85.548129][ T5844] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 85.582574][ T5844] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 85.594078][ T5844] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 85.615565][ T5843] Bluetooth: hci2: command tx timeout [ 85.690798][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.708891][ T5837] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 85.723804][ T5837] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 85.752776][ T5837] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 85.766558][ T5846] Bluetooth: hci1: command tx timeout [ 85.772233][ T5846] Bluetooth: hci0: command tx timeout [ 85.778220][ T5843] Bluetooth: hci3: command tx timeout [ 85.789743][ T5837] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 85.815866][ T5840] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.846971][ T5843] Bluetooth: hci4: command tx timeout [ 85.858544][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.865737][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.874609][ T5833] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 85.884832][ T5833] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 85.894839][ T5833] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 85.907275][ T5833] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 85.952624][ T1156] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.959812][ T1156] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.050763][ T5849] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.111221][ T5849] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.193448][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.200774][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.240378][ T78] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.247592][ T78] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.342286][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.378318][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.407415][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.454633][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.472129][ T5833] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.493496][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.500781][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.524057][ T5837] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.550090][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.557307][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.574969][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.582189][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.600427][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.607633][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.639696][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.646918][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.664563][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.671811][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.754019][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.811484][ T9] cfg80211: failed to load regulatory.db [ 86.882977][ T5849] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.944611][ T5833] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 87.120285][ T5849] veth0_vlan: entered promiscuous mode [ 87.163057][ T5849] veth1_vlan: entered promiscuous mode [ 87.244505][ T5849] veth0_macvtap: entered promiscuous mode [ 87.280456][ T5849] veth1_macvtap: entered promiscuous mode [ 87.395126][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.443373][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.501172][ T5849] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.522413][ T5849] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.533277][ T5849] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.542597][ T5849] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.574456][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.609948][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.620564][ T5840] veth0_vlan: entered promiscuous mode [ 87.677054][ T5840] veth1_vlan: entered promiscuous mode [ 87.687353][ T5843] Bluetooth: hci2: command tx timeout [ 87.691589][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.765381][ T5837] veth0_vlan: entered promiscuous mode [ 87.812576][ T5844] veth0_vlan: entered promiscuous mode [ 87.843604][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.854093][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.856697][ T5840] veth0_macvtap: entered promiscuous mode [ 87.862989][ T5843] Bluetooth: hci3: command tx timeout [ 87.867367][ T5846] Bluetooth: hci0: command tx timeout [ 87.872503][ T5156] Bluetooth: hci1: command tx timeout [ 87.891018][ T5837] veth1_vlan: entered promiscuous mode [ 87.907513][ T5844] veth1_vlan: entered promiscuous mode [ 87.927019][ T5156] Bluetooth: hci4: command tx timeout [ 87.934042][ T5840] veth1_macvtap: entered promiscuous mode [ 87.980424][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.997739][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.005589][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.013652][ T5833] veth0_vlan: entered promiscuous mode [ 88.035544][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.046885][ T5840] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.055604][ T5840] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.068497][ T5840] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.077284][ T5840] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.134214][ T5833] veth1_vlan: entered promiscuous mode [ 88.141710][ T5837] veth0_macvtap: entered promiscuous mode [ 88.165069][ T5837] veth1_macvtap: entered promiscuous mode [ 88.181474][ T5844] veth0_macvtap: entered promiscuous mode [ 88.187079][ T5849] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 88.193117][ T5844] veth1_macvtap: entered promiscuous mode [ 88.314741][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.340924][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.357304][ T5954] overlayfs: failed to resolve './file0': -2 [ 88.371594][ T5954] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 88.395644][ T5833] veth0_macvtap: entered promiscuous mode [ 88.405539][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.409976][ T5833] veth1_macvtap: entered promiscuous mode [ 88.429793][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.482779][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.494527][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.536844][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.549740][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.557159][ T5844] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.571532][ T5844] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.581800][ T5844] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.592760][ T5844] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.611355][ T5837] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.620512][ T5837] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.629348][ T5837] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.638702][ T5837] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.660984][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.706983][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.789920][ T5833] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.836435][ T5833] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.861554][ T5833] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.873047][ T5833] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.929318][ T5961] warning: `syz.0.7' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 89.164447][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.177528][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.196903][ T5958] syz.0.7 (5958) used greatest stack depth: 19784 bytes left [ 89.215778][ T5970] process 'syz.4.8' launched '/dev/fd/9' with NULL argv: empty string added [ 89.254472][ T3520] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.276063][ T3520] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.320555][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.352355][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.379286][ T5973] [U]  [ 89.383312][ T5973] openvswitch: netlink: Message has 8 unknown bytes. [ 89.430899][ T3520] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.469992][ T3520] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.549216][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.583810][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.654455][ T3520] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.681560][ T3520] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.767061][ T5156] Bluetooth: hci2: command tx timeout [ 89.859653][ T5951] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 89.927109][ T5156] Bluetooth: hci0: command tx timeout [ 89.933128][ T5843] Bluetooth: hci1: command tx timeout [ 89.933171][ T5846] Bluetooth: hci3: command tx timeout [ 90.006773][ T5846] Bluetooth: hci4: command tx timeout [ 90.056271][ T5951] usb 1-1: device descriptor read/64, error -71 [ 90.308054][ T5951] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 90.368576][ T5997] syzkaller1: entered promiscuous mode [ 90.383358][ T980] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 90.395860][ T5997] syzkaller1: entered allmulticast mode [ 90.449795][ T5951] usb 1-1: device descriptor read/64, error -71 [ 90.494972][ T6004] ipt_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 90.559587][ T980] usb 4-1: config 0 interface 0 has no altsetting 0 [ 90.576165][ T980] usb 4-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 90.585860][ T980] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.602520][ T5951] usb usb1-port1: attempt power cycle [ 90.632869][ T980] usb 4-1: config 0 descriptor?? [ 90.750180][ T6008] loop9: detected capacity change from 0 to 7 [ 90.935355][ T5889] Buffer I/O error on dev loop9, logical block 0, async page read [ 90.963285][ T5951] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 91.075181][ T5889] Buffer I/O error on dev loop9, logical block 0, async page read [ 91.115353][ T5951] usb 1-1: device descriptor read/8, error -71 [ 91.150096][ T5889] Buffer I/O error on dev loop9, logical block 0, async page read [ 91.233530][ T5889] Buffer I/O error on dev loop9, logical block 0, async page read [ 91.302255][ T980] video4linux radio48: keene_cmd_set failed (-71) [ 91.349760][ T5889] Buffer I/O error on dev loop9, logical block 0, async page read [ 91.391646][ T5951] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 91.399651][ T980] radio-keene 4-1:0.0: V4L2 device registered as radio48 [ 91.509263][ T5951] usb 1-1: device descriptor read/8, error -71 [ 91.587266][ T980] usb 4-1: USB disconnect, device number 2 [ 91.654052][ T6016] Buffer I/O error on dev loop9, logical block 0, async page read [ 91.692605][ T6016] Buffer I/O error on dev loop9, logical block 0, async page read [ 91.712755][ T5951] usb usb1-port1: unable to enumerate USB device [ 91.736838][ T6016] Buffer I/O error on dev loop9, logical block 0, async page read [ 91.754907][ T5981] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 91.790136][ T6016] Buffer I/O error on dev loop9, logical block 0, async page read [ 91.821086][ T6016] Buffer I/O error on dev loop9, logical block 0, async page read [ 91.896631][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 91.961521][ T5981] usb 2-1: Using ep0 maxpacket: 16 [ 91.997814][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.096310][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 92.107831][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 92.130979][ T10] usb 3-1: config 4 has an invalid interface number: 30 but max is 0 [ 92.143395][ T5981] usb 2-1: too many configurations: 29, using maximum allowed: 8 [ 92.150731][ T10] usb 3-1: config 4 has no interface number 0 [ 92.195321][ T10] usb 3-1: config 4 interface 30 has no altsetting 0 [ 92.195850][ T5981] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 92.207481][ T10] usb 3-1: string descriptor 0 read error: -22 [ 92.219203][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 92.236667][ T10] usb 3-1: New USB device found, idVendor=9022, idProduct=d484, bcdDevice=ff.88 [ 92.248047][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.255319][ T5981] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.281053][ T5981] usb 2-1: Product: syz [ 92.300773][ T5981] usb 2-1: Manufacturer: syz [ 92.305424][ T5981] usb 2-1: SerialNumber: syz [ 92.315634][ T10] dvb-usb: found a 'TeVii S482 (tuner 2)' in warm state. [ 92.329420][ T5981] r8152-cfgselector 2-1: Unknown version 0x0000 [ 92.345168][ T10] dw2102: su3000_power_ctrl: 1, initialized 0 [ 92.356138][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 92.359271][ T5981] r8152-cfgselector 2-1: config 0 descriptor?? [ 92.379981][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 92.520587][ T6011] dvb-usb: bulk message failed: -22 (3/0) [ 92.529291][ T6011] dw2102: i2c transfer failed. [ 92.535428][ T10] dvbdev: DVB: registering new adapter (TeVii S482 (tuner 2)) [ 92.543148][ T10] usb 3-1: media controller created [ 92.548809][ T6011] dvb-usb: bulk message failed: -22 (3/0) [ 92.555142][ T6011] dw2102: i2c transfer failed. [ 92.571371][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 92.602915][ T5931] r8152-cfgselector 2-1: USB disconnect, device number 2 [ 92.622993][ T10] dw2102: i2c transfer failed. [ 92.726696][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 92.736537][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 92.807169][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 92.830848][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 92.840344][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 92.897848][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 92.933250][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 92.942822][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 93.624167][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 93.631005][ T10] dw2102: i2c transfer failed. [ 93.635882][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 93.844990][ T10] dw2102: i2c transfer failed. [ 93.876587][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 93.902834][ T10] dw2102: i2c transfer failed. [ 93.921953][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 93.966378][ T10] dw2102: i2c transfer failed. [ 93.979176][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 93.995090][ T10] dw2102: i2c transfer failed. [ 94.005640][ T10] dvb-usb: MAC address: 02:02:02:02:02:02 [ 94.194665][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 94.196961][ T6034] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 94.324505][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 94.360965][ T6037] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 94.380083][ T30] audit: type=1800 audit(1755960108.732:2): pid=6037 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.26" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 94.537869][ T6037] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 94.548059][ T6037] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 94.564066][ T10] dw2102: command 0x0e transfer failed. [ 94.577116][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 94.644562][ T6047] capability: warning: `syz.1.25' uses deprecated v2 capabilities in a way that may be insecure [ 94.674490][ T6047] trusted_key: syz.1.25 sent an empty control message without MSG_MORE. [ 94.971255][ T10] dw2102: command 0x0e transfer failed. [ 95.346253][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 95.352069][ T10] dw2102: command 0x0e transfer failed. [ 95.386183][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 95.411873][ T10] dw2102: command 0x0e transfer failed. [ 95.431008][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 95.463825][ T10] dw2102: command 0x51 transfer failed. [ 95.484823][ T10] dvb-usb: bulk message failed: -22 (5/0) [ 95.536122][ T10] dw2102: i2c probe for address 0x68 failed. [ 95.702765][ T10] dvb-usb: bulk message failed: -22 (5/0) [ 95.758620][ T10] dw2102: i2c probe for address 0x69 failed. [ 95.785891][ T10] dvb-usb: bulk message failed: -22 (5/0) [ 95.799106][ T10] dw2102: i2c probe for address 0x6a failed. [ 95.842966][ T10] dw2102: probing for demodulator failed. Is the external power switched on? [ 95.895977][ T10] dvb-usb: no frontend was attached by 'TeVii S482 (tuner 2)' [ 97.227998][ T10] rc_core: IR keymap rc-tt-1500 not found [ 97.262420][ T10] Registered IR keymap rc-empty [ 97.294755][ T10] rc rc0: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 97.357981][ T10] input: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input5 [ 97.395164][ T10] dvb-usb: schedule remote query interval to 250 msecs. [ 97.414625][ T10] dw2102: su3000_power_ctrl: 0, initialized 1 [ 97.434156][ T10] dvb-usb: TeVii S482 (tuner 2) successfully initialized and connected. [ 97.514928][ T10] usb 3-1: USB disconnect, device number 2 [ 97.767990][ T6095] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 97.784388][ T6087] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 98.907126][ T10] dvb-usb: TeVii S482 (tuner 2) successfully deinitialized and disconnected. [ 99.785443][ T6115] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 99.880356][ T6116] tty tty23: ldisc open failed (-12), clearing slot 22 [ 99.896834][ T6118] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 99.964388][ T6131] netlink: 48 bytes leftover after parsing attributes in process `syz.4.44'. [ 100.076216][ T5981] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 100.297832][ T5981] usb 3-1: unable to get BOS descriptor or descriptor too short [ 100.427939][ T5981] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 100.634539][ T5981] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 100.648315][ T5981] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 0 [ 100.660627][ T5981] usb 3-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=b5.39 [ 100.679117][ T6140] syz.1.49 uses obsolete (PF_INET,SOCK_PACKET) [ 100.695570][ T5981] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.704983][ T6110] netlink: 28 bytes leftover after parsing attributes in process `syz.4.44'. [ 100.720566][ T6140] veth1_to_bond: entered allmulticast mode [ 100.891055][ T5978] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 100.927700][ T5981] usb 3-1: Product: 㚰໒韑ʾﮥ爺㫓注ﵱ氪⺞톿璆༽齣ꛔ꼎Ⴒ甹蟨㖻鶉揃沦嬃Ȉ・쵏哗⫖轰漴쥗㡿ﳍ➴ℝ듃竀ꛂ [ 100.975224][ T5981] usb 3-1: Manufacturer: 祆ⶔ嶧䜌ꩀ庽ⴿǒᵙಁ붑ﳃ窻닀廸⿗⾸洈尿곹銸ℯꄅ [ 100.994162][ T5981] usb 3-1: config 0 descriptor?? [ 101.074682][ T5981] pn533_usb 3-1:0.0: NFC: Could not find bulk-in or bulk-out endpoint [ 101.106557][ T5978] usb 1-1: Using ep0 maxpacket: 16 [ 101.127639][ T5978] usb 1-1: config 1 has an invalid interface number: 105 but max is 0 [ 101.153660][ T5978] usb 1-1: config 1 has no interface number 0 [ 101.226316][ T5978] usb 1-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 101.394113][ T5978] usb 1-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 101.403947][ T5931] usb 3-1: USB disconnect, device number 3 [ 101.471069][ T5978] usb 1-1: config 1 interface 105 has no altsetting 0 [ 101.539068][ T5978] usb 1-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 101.575613][ T5978] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.592222][ T5978] usb 1-1: Product: syz [ 101.699119][ T5978] usb 1-1: Manufacturer: syz [ 101.704351][ T5978] usb 1-1: SerialNumber: syz [ 101.713698][ T6144] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 101.733273][ T6144] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 102.508001][ T6151] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 102.520893][ T6151] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 102.557434][ T6151] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 102.638920][ T6151] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 102.663099][ T6151] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 102.691833][ T6160] netlink: 76 bytes leftover after parsing attributes in process `syz.1.55'. [ 102.730397][ T6151] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 102.743265][ T6151] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 102.752402][ T6151] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 102.775068][ T6151] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 102.794426][ T6151] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 102.803048][ T6151] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 103.055775][ T6151] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 103.169715][ T6151] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 103.191897][ T6151] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 103.221674][ T6151] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 103.799309][ T5156] Bluetooth: hci0: command 0x0c1a tx timeout [ 103.935447][ T6144] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 103.943155][ T6144] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 103.987013][ T6164] [U] [ 104.656378][ T5156] Bluetooth: hci1: command 0x0c1a tx timeout [ 104.806814][ T5843] Bluetooth: hci3: command 0x0c1a tx timeout [ 104.814274][ T5839] Bluetooth: hci2: command 0x0c1a tx timeout [ 105.150674][ T6183] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 105.206165][ T5156] Bluetooth: hci4: command 0x0c1a tx timeout [ 105.357667][ T6190] netlink: 36 bytes leftover after parsing attributes in process `syz.1.61'. [ 105.766190][ T5846] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 105.846152][ T5156] Bluetooth: hci0: command 0x0c1a tx timeout [ 106.080519][ T5978] aqc111 1-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x20) reg index 0x0000: -71 [ 106.133992][ T5978] aqc111 1-1:1.105: probe with driver aqc111 failed with error -71 [ 106.224589][ T5978] usb 1-1: USB disconnect, device number 6 [ 106.247758][ T6192] ======================================================= [ 106.247758][ T6192] WARNING: The mand mount option has been deprecated and [ 106.247758][ T6192] and is ignored by this kernel. Remove the mand [ 106.247758][ T6192] option from the mount to silence this warning. [ 106.247758][ T6192] ======================================================= [ 106.298064][ T6192] tmpfs: Unknown parameter 'smackfsroo' [ 106.669658][ T5978] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 106.886523][ T5846] Bluetooth: hci2: command 0x0c1a tx timeout [ 106.894388][ T5156] Bluetooth: hci3: command 0x0c1a tx timeout [ 106.909063][ T5978] usb 1-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0x31, changing to 0x1 [ 107.128509][ T5156] Bluetooth: hci1: command 0x0c1a tx timeout [ 107.184174][ T5978] usb 1-1: config 36 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 13364, setting to 64 [ 107.337594][ T5156] Bluetooth: hci4: command 0x0c1a tx timeout [ 107.416513][ T5978] usb 1-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=26.29 [ 107.425856][ T5978] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 107.436775][ T5978] usb 1-1: Manufacturer: syz [ 107.441476][ T5978] usb 1-1: SerialNumber: syz [ 107.450295][ T6215] C: renamed from team_slave_0 (while UP) [ 107.535890][ T6215] netlink: 152 bytes leftover after parsing attributes in process `syz.3.67'. [ 107.817732][ T5978] usbhid 1-1:36.0: couldn't find an input interrupt endpoint [ 107.927574][ T5156] Bluetooth: hci0: command 0x0c1a tx timeout [ 108.060721][ T5978] usb 1-1: USB disconnect, device number 7 [ 108.121647][ T6222] 9pnet: p9_errstr2errno: server reported unknown error @΂(0x0000000000000003 [ 108.634245][ T6229] futex_wake_op: syz.0.71 tries to shift op by -1; fix this program [ 108.736107][ T6229] 9pnet_fd: Insufficient options for proto=fd [ 108.741405][ T6231] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 108.983108][ T5846] Bluetooth: hci2: command 0x0c1a tx timeout [ 108.989987][ T5156] Bluetooth: hci3: command 0x0c1a tx timeout [ 109.217485][ T5156] Bluetooth: hci1: command 0x0c1a tx timeout [ 109.373809][ T5156] Bluetooth: hci4: command 0x0c1a tx timeout [ 109.706195][ T977] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 110.726909][ T5850] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 110.826183][ T977] usb 4-1: Using ep0 maxpacket: 8 [ 110.835609][ T977] usb 4-1: config 0 has an invalid interface number: 52 but max is 0 [ 110.846090][ T977] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 110.859177][ T977] usb 4-1: config 0 has no interface number 0 [ 110.865299][ T977] usb 4-1: config 0 interface 52 has no altsetting 0 [ 110.874114][ T977] usb 4-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 110.883614][ T977] usb 4-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 110.892243][ T977] usb 4-1: Manufacturer: syz [ 110.900364][ T977] usb 4-1: config 0 descriptor?? [ 111.068387][ T5850] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 52, changing to 4 [ 111.079632][ T5850] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 13368, setting to 1023 [ 111.107694][ T5850] usb 1-1: New USB device found, idVendor=3823, idProduct=0001, bcdDevice= 3.eb [ 111.110502][ T977] usb 4-1: Can not set alternate setting to 1, error: -71 [ 111.120019][ T5850] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.133617][ T5850] usb 1-1: Product: syz [ 111.143730][ T977] synaptics_usb 4-1:0.52: probe with driver synaptics_usb failed with error -71 [ 111.145213][ T5850] usb 1-1: Manufacturer: syz [ 111.179891][ T5850] usb 1-1: SerialNumber: syz [ 111.239679][ T5850] usb 1-1: config 0 descriptor?? [ 111.281509][ T977] usb 4-1: USB disconnect, device number 3 [ 111.404696][ T6272] netlink: 'syz.2.84': attribute type 1 has an invalid length. [ 111.462325][ T6253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 111.738618][ T6253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 111.820955][ T5850] input: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input6 [ 112.065498][ T5850] usb 1-1: USB disconnect, device number 8 [ 112.239459][ T10] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 112.724880][ T10] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 112.735324][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.776342][ T10] usb 4-1: Product: syz [ 112.780558][ T10] usb 4-1: Manufacturer: syz [ 112.820234][ T10] usb 4-1: SerialNumber: syz [ 113.047083][ T10] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 114.112465][ T977] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 115.228168][ T977] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 117.038297][ T977] ath9k_htc: Failed to initialize the device [ 117.922168][ T5910] usb 4-1: USB disconnect, device number 4 [ 117.996634][ T6306] comedi comedi0: mpc624: I/O port conflict (0xee,16) [ 118.570688][ T5910] usb 4-1: ath9k_htc: USB layer deinitialized [ 118.708344][ T6310] syz.0.93: attempt to access beyond end of device [ 118.708344][ T6310] nbd0: rw=0, sector=2, nr_sectors = 2 limit=0 [ 118.746905][ T6310] vxfs: unable to read disk superblock at 1 [ 118.834974][ T6310] syz.0.93: attempt to access beyond end of device [ 118.834974][ T6310] nbd0: rw=0, sector=16, nr_sectors = 2 limit=0 [ 118.956135][ T6310] vxfs: unable to read disk superblock at 8 [ 118.962194][ T6310] vxfs: can't find superblock. [ 119.027904][ T6318] program syz.1.96 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 119.047078][ T6316] overlay: Unknown parameter '\eiserfs' [ 119.314528][ T977] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 119.451517][ T6329] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 119.586212][ T977] usb 1-1: Using ep0 maxpacket: 32 [ 119.675234][ T977] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC4, changing to 0x84 [ 120.556609][ T977] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 120.577688][ T977] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.16 [ 120.631822][ T977] usb 1-1: New USB device strings: Mfr=154, Product=2, SerialNumber=3 [ 120.660312][ T977] usb 1-1: Product: syz [ 120.664553][ T977] usb 1-1: Manufacturer: syz [ 120.716113][ T977] usb 1-1: SerialNumber: syz [ 120.764964][ T977] usb 1-1: config 0 descriptor?? [ 120.814579][ T977] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 121.863396][ T12] usb 1-1: Failed to submit usb control message: -110 [ 121.878346][ T12] usb 1-1: unable to send the bmi data to the device: -110 [ 121.888880][ T12] usb 1-1: unable to get target info from device [ 121.902361][ T12] usb 1-1: could not get target info (-110) [ 121.934623][ T12] usb 1-1: could not probe fw (-110) [ 122.166868][ T5981] usb 1-1: USB disconnect, device number 9 [ 122.327297][ T6376] Zero length message leads to an empty skb [ 123.414710][ T5981] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 123.615328][ T6393] netlink: 8 bytes leftover after parsing attributes in process `syz.4.114'. [ 123.798826][ T6392] netlink: 248 bytes leftover after parsing attributes in process `syz.4.114'. [ 123.800293][ T5981] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 124.011780][ T5981] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.050143][ T5981] usb 1-1: config 0 descriptor?? [ 124.072739][ T5981] cp210x 1-1:0.0: cp210x converter detected [ 124.306221][ T5931] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 124.318125][ T977] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 124.409381][ T6409] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 124.496249][ T977] usb 4-1: Using ep0 maxpacket: 32 [ 124.502856][ T5981] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 124.504327][ T5931] usb 3-1: config 0 has an invalid interface number: 133 but max is 0 [ 124.545787][ T5931] usb 3-1: config 0 has no interface number 0 [ 124.572766][ T977] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 124.597873][ T5981] usb 1-1: cp210x converter now attached to ttyUSB0 [ 124.600110][ T977] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 124.624152][ T5931] usb 3-1: config 0 interface 133 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 124.636135][ T977] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.671670][ T5931] usb 3-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 124.700777][ T977] usb 4-1: Product: syz [ 124.708095][ T5931] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.728866][ T10] usb 1-1: USB disconnect, device number 10 [ 124.735596][ T977] usb 4-1: Manufacturer: syz [ 124.756369][ T977] usb 4-1: SerialNumber: syz [ 124.768152][ T10] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 124.782388][ T5931] usb 3-1: Product: syz [ 124.804855][ T5931] usb 3-1: Manufacturer: syz [ 124.825121][ T5931] usb 3-1: SerialNumber: syz [ 124.839895][ T977] usb 4-1: config 0 descriptor?? [ 124.869410][ T977] usb 4-1: bad CDC descriptors [ 124.878409][ T10] cp210x 1-1:0.0: device disconnected [ 124.891520][ T6421] tipc: Started in network mode [ 124.910398][ T5931] usb 3-1: config 0 descriptor?? [ 124.922880][ T6421] tipc: Node identity caaa4ae64003, cluster identity 4711 [ 124.923319][ T977] usb 4-1: unsupported MDLM descriptors [ 124.948911][ T6421] tipc: Enabled bearer , priority 0 [ 125.183493][ T6397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.308383][ T6397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.067346][ T5981] tipc: Node number set to 2326350566 [ 126.105766][ T6421] tipc: Disabling bearer [ 126.268776][ T5931] keyspan 3-1:0.133: Keyspan 1 port adapter converter detected [ 126.307473][ T5931] keyspan 3-1:0.133: unsupported endpoint type 0 [ 126.368072][ T5931] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 81 [ 126.408028][ T5931] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 1 [ 126.461530][ T5931] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 2 [ 126.539768][ T5931] usb 3-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 126.865236][ T5931] usb 3-1: USB disconnect, device number 4 [ 127.523617][ T5931] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 127.688645][ T5978] usb 4-1: USB disconnect, device number 5 [ 127.811393][ T5931] keyspan 3-1:0.133: device disconnected [ 127.878692][ T6445] xfrm0: entered promiscuous mode [ 127.883781][ T6445] xfrm0: entered allmulticast mode [ 127.940702][ T6460] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 127.981198][ T6462] netlink: 'syz.4.128': attribute type 10 has an invalid length. [ 128.010802][ T6463] netlink: 'syz.4.128': attribute type 4 has an invalid length. [ 128.049523][ T6463] netlink: 152 bytes leftover after parsing attributes in process `syz.4.128'. [ 128.061963][ T6460] 9pnet_fd: Insufficient options for proto=fd [ 128.170955][ T6462] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 128.182338][ T6465] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 128.234668][ T6463] : renamed from bond0 (while UP) [ 128.322163][ T6460] ipip0: entered promiscuous mode [ 128.354880][ T6460] ipip0: entered allmulticast mode [ 129.043661][ T6470] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 129.075905][ T6470] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 129.106642][ T6470] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 129.124827][ T6470] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 129.164410][ T6470] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 131.166205][ T5846] Bluetooth: hci0: command 0x0c1a tx timeout [ 131.172269][ T5846] Bluetooth: hci3: command 0x0c1a tx timeout [ 131.178733][ T5846] Bluetooth: hci2: command 0x0c1a tx timeout [ 131.184786][ T5846] Bluetooth: hci1: command 0x0c1a tx timeout [ 131.252537][ T5839] Bluetooth: hci4: command 0x0c1a tx timeout [ 131.290607][ T5839] Bluetooth: hci5: command 0xfc11 tx timeout [ 131.297090][ T5156] Bluetooth: hci5: Entering manufacturer mode failed (-110) [ 131.636764][ T6525] netlink: 28 bytes leftover after parsing attributes in process `syz.3.142'. [ 131.719951][ T5978] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 131.891176][ T5978] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 131.923174][ T5978] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 131.937150][ T6533] netlink: 'syz.4.145': attribute type 1 has an invalid length. [ 131.967592][ T6533] netlink: 208 bytes leftover after parsing attributes in process `syz.4.145'. [ 131.981434][ T5978] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 132.012252][ T6533] netlink: 'syz.4.145': attribute type 1 has an invalid length. [ 132.012540][ T5978] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.033188][ T6533] netlink: 'syz.4.145': attribute type 2 has an invalid length. [ 132.207137][ T5978] usb 3-1: config 0 descriptor?? [ 132.893064][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.899658][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.986214][ T10] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 133.044688][ T6544] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 133.089469][ T5978] cp2112 0003:10C4:EA90.0001: item fetching failed at offset 5/7 [ 133.109740][ T5978] cp2112 0003:10C4:EA90.0001: parse failed [ 133.115828][ T5978] cp2112 0003:10C4:EA90.0001: probe with driver cp2112 failed with error -22 [ 133.178154][ T10] usb 1-1: config 0 has an invalid interface number: 128 but max is 0 [ 133.206328][ T10] usb 1-1: config 0 has no interface number 0 [ 133.231359][ T10] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 133.260889][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.287117][ T6507] Invalid ELF header magic: != ELF [ 133.297460][ T6507] Invalid ELF header magic: != ELF [ 133.300518][ T10] usb 1-1: Product: syz [ 133.321226][ T48] usb 3-1: USB disconnect, device number 5 [ 133.326183][ T10] usb 1-1: Manufacturer: syz [ 133.332349][ T10] usb 1-1: SerialNumber: syz [ 133.350518][ T10] usb 1-1: config 0 descriptor?? [ 133.516178][ T5978] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 133.690313][ T5978] usb 5-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 133.706087][ T5978] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.735671][ T5978] usb 5-1: config 0 descriptor?? [ 133.759090][ T5978] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 133.865072][ T10] usb 1-1: Firmware version (0.0) predates our first public release. [ 133.874843][ T10] usb 1-1: Please update to version 0.2 or newer [ 134.118448][ T6576] devtmpfs: Too few inodes for current use [ 134.125611][ T6575] devtmpfs: Too few inodes for current use [ 134.159352][ T5978] cpia1 5-1:0.0: unexpected state after lo power cmd: 00 [ 134.165462][ T10] usb 1-1: USB disconnect, device number 11 [ 134.736476][ T5978] cpia1 5-1:0.0: only firmware version 1 is supported (got: 0) [ 134.774362][ T6589] sctp: failed to load transform for md5: -2 [ 134.912546][ T48] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 134.974455][ T6596] Bluetooth: MGMT ver 1.23 [ 134.985384][ T5981] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 135.426106][ T48] usb 4-1: Using ep0 maxpacket: 8 [ 135.432975][ T48] usb 4-1: unable to get BOS descriptor or descriptor too short [ 135.442490][ T48] usb 4-1: config 9 has an invalid interface number: 112 but max is 0 [ 135.455957][ T6601] input: syz0 as /devices/virtual/input/input7 [ 135.462906][ T48] usb 4-1: config 9 has no interface number 0 [ 135.469698][ T48] usb 4-1: config 9 interface 112 has no altsetting 0 [ 135.637730][ T5981] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 135.650326][ T5981] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.675765][ T48] usb 4-1: string descriptor 0 read error: -22 [ 135.684545][ T48] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice= 8.d3 [ 135.754417][ T5981] usb 3-1: config 0 descriptor?? [ 135.784398][ T5981] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 135.797944][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.852732][ T48] r8152-cfgselector 4-1: Unknown version 0x0000 [ 135.882026][ T48] r8152 4-1:9.112: Expected endpoints are not found [ 135.933950][ T6613] overlayfs: failed to resolve './file1': -2 [ 135.958470][ T6613] overlayfs: failed to resolve './file1': -2 [ 135.995879][ T6584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.042222][ T6584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.080267][ T5981] usb 3-1: Detected FT232A [ 136.098328][ T6619] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.103220][ T5981] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 136.128841][ T5981] usb 3-1: USB disconnect, device number 6 [ 136.141969][ T5981] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 136.154786][ T5981] ftdi_sio 3-1:0.0: device disconnected [ 136.166687][ T6619] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.371817][ T48] r8152-cfgselector 4-1: USB disconnect, device number 6 [ 137.266330][ T48] usb 5-1: USB disconnect, device number 2 [ 137.375608][ T6627] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 137.400912][ T6627] netlink: 108 bytes leftover after parsing attributes in process `syz.0.166'. [ 137.458342][ T6627] netlink: 32 bytes leftover after parsing attributes in process `syz.0.166'. [ 137.584991][ T6636] netlink: 'syz.4.168': attribute type 10 has an invalid length. [ 137.643736][ T6637] loop2: detected capacity change from 0 to 7 [ 137.896294][ T6640] tipc: Started in network mode [ 137.901210][ T6640] tipc: Node identity e0000001, cluster identity 4711 [ 137.919967][ T6637] Dev loop2: unable to read RDB block 7 [ 137.930002][ T6637] loop2: unable to read partition table [ 137.950369][ T6637] loop2: partition table beyond EOD, truncated [ 137.964314][ T6640] tipc: Enabling of bearer rejected, failed to enable media [ 137.976565][ T6637] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 138.064759][ T6636] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 138.081143][ T6636] : (slave batadv0): Enslaving as an active interface with an up link [ 138.366484][ T48] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 138.428128][ T10] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 138.602296][ T48] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 138.690468][ T48] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 138.766152][ T48] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 138.801335][ T48] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 138.819989][ T48] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.849674][ T48] usb 2-1: config 0 descriptor?? [ 138.888040][ T6657] netlink: 84 bytes leftover after parsing attributes in process `syz.4.174'. [ 138.927344][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 138.943131][ T10] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 138.956159][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.974501][ T10] usb 4-1: Product: syz [ 138.978885][ T10] usb 4-1: Manufacturer: syz [ 138.983501][ T10] usb 4-1: SerialNumber: syz [ 138.991656][ T10] usb 4-1: config 0 descriptor?? [ 138.999534][ T10] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 139.046952][ T10] usb 4-1: Detected FT232H [ 139.098162][ T48] ath6kl: Failed to submit usb control message: -71 [ 139.133016][ T48] ath6kl: unable to send the bmi data to the device: -71 [ 139.166741][ T48] ath6kl: Unable to send get target info: -71 [ 139.201801][ T10] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 139.225871][ T48] ath6kl: Failed to init ath6kl core: -71 [ 139.253707][ T48] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 139.341766][ T48] usb 2-1: USB disconnect, device number 3 [ 139.620958][ T6648] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.649596][ T6648] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 139.711173][ T10] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 139.906531][ T10] usb 4-1: USB disconnect, device number 7 [ 140.013781][ T10] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 140.084416][ T10] ftdi_sio 4-1:0.0: device disconnected [ 141.442679][ T6691] netlink: 'syz.2.180': attribute type 10 has an invalid length. [ 141.521417][ T6691] team0: Port device dummy0 added [ 141.919603][ T6691] syz.2.180 (6691) used greatest stack depth: 19656 bytes left [ 141.979618][ T6690] input: syz1 as /devices/virtual/input/input8 [ 142.848466][ T6705] netlink: 24 bytes leftover after parsing attributes in process `syz.4.185'. [ 145.957285][ T6728] 8021q: VLANs not supported on sit0 [ 145.991377][ T30] audit: type=1326 audit(1755960160.362:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6727 comm="syz.0.192" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f20d318ebe9 code=0x0 [ 146.347492][ T6744] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 146.438716][ T6744] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 146.519357][ T6755] netlink: 12 bytes leftover after parsing attributes in process `syz.1.200'. [ 146.569322][ T6755] netlink: 8 bytes leftover after parsing attributes in process `syz.1.200'. [ 146.613820][ T6751] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 146.876487][ T10] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 147.063959][ T10] usb 1-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 147.110522][ T10] usb 1-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 147.151747][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 147.169370][ T10] usb 1-1: New USB device found, idVendor=044e, idProduct=120b, bcdDevice= 0.00 [ 147.191148][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.383018][ T977] IPVS: starting estimator thread 0... [ 148.067552][ T6782] IPVS: using max 26 ests per chain, 62400 per kthread [ 148.357604][ T10] usb 1-1: config 0 descriptor?? [ 148.486210][ T5931] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 148.571136][ T6788] loop8: detected capacity change from 0 to 16384 [ 148.658860][ T5931] usb 2-1: Using ep0 maxpacket: 8 [ 148.678800][ T5931] usb 2-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice= 0.6d [ 148.718016][ T5931] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.742221][ T5931] usb 2-1: Product: syz [ 148.757427][ T5931] usb 2-1: Manufacturer: syz [ 148.767605][ T6789] loop8: detected capacity change from 16384 to 16383 [ 148.782119][ T10] hid-alps 0003:044E:120B.0002: bogus close delimiter [ 148.798413][ T5931] usb 2-1: SerialNumber: syz [ 148.813858][ T10] hid-alps 0003:044E:120B.0002: item 0 0 2 10 parsing failed [ 148.834499][ T5931] usb 2-1: config 0 descriptor?? [ 148.846919][ T10] hid-alps 0003:044E:120B.0002: parse failed [ 148.853143][ T10] hid-alps 0003:044E:120B.0002: probe with driver hid-alps failed with error -22 [ 148.869089][ T5931] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 149.002401][ T6760] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 149.022625][ T6760] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 149.063021][ T5850] usb 1-1: USB disconnect, device number 12 [ 149.138473][ T6803] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 149.182910][ T6804] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 149.402539][ T6802] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 149.410514][ T6803] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 149.950984][ T6801] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 150.013553][ T6141] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 1 [ 150.031035][ T6810] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.039489][ T6810] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.059169][ T6801] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 150.163147][ T6141] Bluetooth: hci5: Frame reassembly failed (-84) [ 150.216879][ T5931] gspca_sonixj: reg_w1 err -110 [ 150.239127][ T6810] bridge0: entered allmulticast mode [ 150.256192][ T5931] sonixj 2-1:0.0: probe with driver sonixj failed with error -110 [ 150.384232][ T6814] bridge_slave_1: left allmulticast mode [ 150.392644][ T6814] bridge_slave_1: left promiscuous mode [ 150.399613][ T6814] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.435640][ T6814] bridge_slave_0: left allmulticast mode [ 150.448145][ T6814] bridge_slave_0: left promiscuous mode [ 150.458468][ T6814] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.171662][ T5931] usb 2-1: USB disconnect, device number 4 [ 152.006367][ T5156] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 152.178352][ T6849] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 152.250791][ T6848] mmap: syz.1.220 (6848): VmData 37859328 exceed data ulimit 4. Update limits or use boot option ignore_rlimit_data. [ 152.414037][ T6858] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 152.633253][ T5850] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 152.727426][ T48] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 153.277420][ T5850] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 153.303504][ T5850] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.317465][ T5850] usb 3-1: Product: syz [ 153.322218][ T5850] usb 3-1: Manufacturer: syz [ 153.329466][ T5850] usb 3-1: SerialNumber: syz [ 153.352801][ T5850] usb 3-1: config 0 descriptor?? [ 153.462370][ T48] usb 5-1: Using ep0 maxpacket: 8 [ 153.473765][ T48] usb 5-1: unable to get BOS descriptor or descriptor too short [ 153.492805][ T48] usb 5-1: config index 0 descriptor too short (expected 65534, got 116) [ 154.454434][ T5951] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 154.462188][ T5850] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 154.476177][ T48] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 154.506221][ T48] usb 5-1: config 1 interface 1 has no altsetting 0 [ 154.563542][ T48] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 154.583883][ T6871] netlink: 'syz.0.228': attribute type 21 has an invalid length. [ 154.596505][ T6871] netlink: 128 bytes leftover after parsing attributes in process `syz.0.228'. [ 154.608010][ T6871] netlink: 'syz.0.228': attribute type 5 has an invalid length. [ 154.611940][ T6861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 154.615659][ T6871] netlink: 3 bytes leftover after parsing attributes in process `syz.0.228'. [ 154.660345][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.675950][ T48] usb 5-1: Product: syz [ 154.686814][ T48] usb 5-1: Manufacturer: syz [ 154.693807][ T48] usb 5-1: SerialNumber: syz [ 154.704720][ T6861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 154.727143][ T5951] usb 2-1: Using ep0 maxpacket: 32 [ 154.739099][ T5951] usb 2-1: unable to get BOS descriptor or descriptor too short [ 154.750409][ T5951] usb 2-1: config 7 has an invalid interface number: 187 but max is 0 [ 154.759524][ T5951] usb 2-1: config 7 has no interface number 0 [ 154.768037][ T5951] usb 2-1: config 7 interface 187 has no altsetting 0 [ 154.871239][ T5951] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 154.888301][ T5951] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.900867][ T5951] usb 2-1: Product: syz [ 154.913300][ T5951] usb 2-1: Manufacturer: syz [ 154.923848][ T5951] usb 2-1: SerialNumber: syz [ 154.932504][ T6859] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.084115][ T6859] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.115676][ T48] usb 5-1: selecting invalid altsetting 0 [ 155.121810][ T48] usb 5-1: selecting invalid altsetting 0 [ 155.127821][ T48] cdc_ncm 5-1:1.0: bind() failure [ 155.137039][ T48] usb 5-1: selecting invalid altsetting 0 [ 155.143780][ T48] cdc_ncm 5-1:1.1: probe with driver cdc_ncm failed with error -22 [ 155.153204][ T6861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.162175][ T5850] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 155.163669][ T6861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.192355][ T48] usb 5-1: selecting invalid altsetting 0 [ 155.209958][ T48] cdc_mbim 5-1:1.1: probe with driver cdc_mbim failed with error -22 [ 155.236221][ T48] usb 5-1: selecting invalid altsetting 0 [ 155.242139][ T48] usbtest 5-1:1.1: probe with driver usbtest failed with error -22 [ 155.256665][ T48] usb 5-1: USB disconnect, device number 3 [ 155.331029][ T6882] netlink: 80 bytes leftover after parsing attributes in process `syz.1.226'. [ 155.386491][ T6882] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 155.607051][ T5951] usb 2-1: Cannot retrieve CPort count: -110 [ 155.635858][ T5951] usb 2-1: Cannot retrieve CPort count: -110 [ 155.642910][ T5951] es2_ap_driver 2-1:7.187: probe with driver es2_ap_driver failed with error -110 [ 155.917879][ T5931] usb 2-1: USB disconnect, device number 5 [ 156.205186][ T6887] affs: No valid root block on device nullb0 [ 156.251791][ T5931] usb 3-1: USB disconnect, device number 7 [ 156.383480][ T6893] syz_tun: entered promiscuous mode [ 156.390494][ T6893] macvtap1: entered allmulticast mode [ 156.396304][ T6893] syz_tun: entered allmulticast mode [ 156.414475][ T6893] syz_tun: left allmulticast mode [ 156.419980][ T6893] syz_tun: left promiscuous mode [ 156.614992][ T6902] batadv_slave_1: entered promiscuous mode [ 156.629148][ T6902] batadv_slave_1: left promiscuous mode [ 156.687804][ T6904] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 157.136008][ T6927] netlink: 'syz.2.241': attribute type 1 has an invalid length. [ 157.233817][ T6925] sctp: [Deprecated]: syz.0.243 (pid 6925) Use of int in max_burst socket option deprecated. [ 157.233817][ T6925] Use struct sctp_assoc_value instead [ 157.467506][ T5931] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 157.876473][ T5931] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 157.984553][ T6940] netlink: 28 bytes leftover after parsing attributes in process `syz.0.245'. [ 157.993904][ T6940] netlink: 32 bytes leftover after parsing attributes in process `syz.0.245'. [ 158.003322][ T6940] netlink: 28 bytes leftover after parsing attributes in process `syz.0.245'. [ 158.032404][ T5931] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 158.052040][ T5931] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 158.073033][ T5931] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 158.083049][ T5931] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 158.101070][ T5931] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 158.110471][ T5931] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 158.118774][ T5931] usb 3-1: Product: syz [ 158.123052][ T5931] usb 3-1: Manufacturer: syz [ 158.133265][ T5931] usb 3-1: SerialNumber: syz [ 158.165175][ T5931] usb 3-1: config 0 descriptor?? [ 158.300251][ T6942] netlink: 28 bytes leftover after parsing attributes in process `syz.0.246'. [ 158.338639][ T30] audit: type=1326 audit(1755960172.652:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6941 comm="syz.0.246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20d318ebe9 code=0x7ffc0000 [ 158.379611][ T5931] radio-si470x 3-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 158.394241][ T30] audit: type=1326 audit(1755960172.662:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6941 comm="syz.0.246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20d318ebe9 code=0x7ffc0000 [ 158.415834][ T5931] radio-si470x 3-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 158.444794][ T30] audit: type=1326 audit(1755960172.662:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6941 comm="syz.0.246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f20d318ebe9 code=0x7ffc0000 [ 158.554607][ T6946] trusted_key: encrypted_key: insufficient parameters specified [ 158.591195][ T30] audit: type=1326 audit(1755960172.662:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6941 comm="syz.0.246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20d318ebe9 code=0x7ffc0000 [ 158.625771][ T30] audit: type=1326 audit(1755960172.662:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6941 comm="syz.0.246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f20d318ebe9 code=0x7ffc0000 [ 158.657346][ T30] audit: type=1326 audit(1755960172.662:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6941 comm="syz.0.246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20d318ebe9 code=0x7ffc0000 [ 158.793315][ T30] audit: type=1326 audit(1755960172.662:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6941 comm="syz.0.246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f20d318ebe9 code=0x7ffc0000 [ 158.871703][ T30] audit: type=1326 audit(1755960172.662:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6941 comm="syz.0.246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20d318ebe9 code=0x7ffc0000 [ 158.946466][ T5931] radio-si470x 3-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 158.965166][ T5931] radio-si470x 3-1:0.0: si470x_get_scratch: si470x_get_report returned -110 [ 158.989147][ T30] audit: type=1326 audit(1755960172.662:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6941 comm="syz.0.246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f20d318ebe9 code=0x7ffc0000 [ 159.009829][ T5931] radio-si470x 3-1:0.0: probe with driver radio-si470x failed with error -5 [ 159.069924][ T30] audit: type=1326 audit(1755960172.662:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6941 comm="syz.0.246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20d318ebe9 code=0x7ffc0000 [ 159.124415][ T5951] usb 3-1: USB disconnect, device number 8 [ 159.286757][ T5910] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 159.435249][ T6958] netlink: 780 bytes leftover after parsing attributes in process `syz.3.251'. [ 159.880883][ T6961] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 159.911293][ T6962] overlayfs: upper fs does not support file handles, falling back to index=off. [ 159.930595][ T5910] usb 5-1: config 0 has an invalid interface number: 168 but max is 0 [ 159.943839][ T5910] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 159.980815][ T5910] usb 5-1: config 0 has no interface number 0 [ 160.001921][ T5910] usb 5-1: config 0 interface 168 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 160.043933][ T5910] usb 5-1: config 0 interface 168 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 16 [ 160.085792][ T5910] usb 5-1: New USB device found, idVendor=0959, idProduct=2bd0, bcdDevice=48.98 [ 160.115887][ T5910] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.212132][ T5910] usb 5-1: config 0 descriptor?? [ 160.243404][ T5910] HFC-S_USB 5-1:0.168: probe with driver HFC-S_USB failed with error -5 [ 160.366242][ T5931] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 160.596186][ T5931] usb 3-1: Using ep0 maxpacket: 16 [ 160.756206][ T6952] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 160.757497][ T5931] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 160.898818][ T6952] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 160.948135][ T5931] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 160.960356][ T5931] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 161.275840][ T5931] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 161.296147][ T5931] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.319273][ T5931] usb 3-1: config 0 descriptor?? [ 161.362702][ T6977] tmpfs: Bad value for 'mpol' [ 161.385194][ T6977] tipc: Started in network mode [ 161.392254][ T6977] tipc: Node identity 2ec65eb126c5, cluster identity 4711 [ 161.402814][ T6977] tipc: Enabled bearer , priority 0 [ 161.413658][ T6977] syzkaller0: entered promiscuous mode [ 161.429736][ T6977] syzkaller0: entered allmulticast mode [ 161.473243][ T6977] tipc: Resetting bearer [ 161.482442][ T6976] tipc: Resetting bearer [ 161.528168][ T6976] tipc: Disabling bearer [ 161.561624][ T5931] microsoft 0003:045E:07DA.0003: ignoring exceeding usage max [ 161.581425][ T5931] microsoft 0003:045E:07DA.0003: unbalanced collection at end of report description [ 161.624760][ T5931] microsoft 0003:045E:07DA.0003: parse failed [ 161.644170][ T5931] microsoft 0003:045E:07DA.0003: probe with driver microsoft failed with error -22 [ 161.760277][ T5931] usb 3-1: USB disconnect, device number 9 [ 161.872683][ T5951] usb 5-1: USB disconnect, device number 4 [ 162.041934][ T6991] tipc: New replicast peer: 255.255.255.255 [ 162.049843][ T6991] tipc: Enabled bearer , priority 10 [ 162.161436][ T6992] netlink: 12 bytes leftover after parsing attributes in process `syz.1.261'. [ 163.140335][ T7003] netlink: 348 bytes leftover after parsing attributes in process `syz.2.263'. [ 163.167034][ T5931] tipc: Node number set to 134438577 [ 165.463792][ T7016] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 167.619400][ T7036] kvm: user requested TSC rate below hardware speed [ 167.963565][ T7057] tmpfs: Unknown parameter 'mpxl' [ 168.124018][ T7056] netlink: 'syz.1.273': attribute type 39 has an invalid length. [ 168.592388][ T7049] netlink: 'syz.3.275': attribute type 1 has an invalid length. [ 169.175102][ T5981] libceph: connect (1)[c::]:6789 error -101 [ 169.242334][ T5981] libceph: mon0 (1)[c::]:6789 connect error [ 169.262917][ T7073] ceph: No mds server is up or the cluster is laggy [ 170.882831][ T7108] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 172.590939][ T49] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.705538][ T49] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.819682][ T49] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.905702][ T49] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.053887][ T49] bridge_slave_1: left allmulticast mode [ 173.060393][ T49] bridge_slave_1: left promiscuous mode [ 173.067910][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.081576][ T49] bridge_slave_0: left allmulticast mode [ 173.089406][ T49] bridge_slave_0: left promiscuous mode [ 173.095220][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.584930][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 173.603549][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 173.615502][ T49] bond0 (unregistering): Released all slaves [ 173.691194][ T49] tipc: Left network mode [ 173.911616][ T49] hsr_slave_0: left promiscuous mode [ 173.920225][ T49] hsr_slave_1: left promiscuous mode [ 173.929341][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 173.939456][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 173.950496][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 173.960737][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 173.993716][ T49] veth1_macvtap: left promiscuous mode [ 174.001264][ T49] veth0_macvtap: left promiscuous mode [ 174.011489][ T49] veth1_vlan: left promiscuous mode [ 174.019446][ T49] veth0_vlan: left promiscuous mode [ 174.520569][ T49] team0 (unregistering): Port device team_slave_1 removed [ 174.557858][ T49] team0 (unregistering): Port device team_slave_0 removed [ 175.243767][ T49] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.343929][ T49] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.444521][ T49] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.510573][ T49] : (slave netdevsim0): Releasing backup interface [ 175.523256][ T49] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.735414][ T49] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.819308][ T49] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.925926][ T49] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.010803][ T49] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.227654][ T49] bridge_slave_1: left allmulticast mode [ 176.233438][ T49] bridge_slave_1: left promiscuous mode [ 176.245548][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 176.259983][ T49] bridge_slave_0: left allmulticast mode [ 176.265664][ T49] bridge_slave_0: left promiscuous mode [ 176.288247][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 176.711683][ T49]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 176.722265][ T49]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 176.733351][ T49]  (unregistering): (slave batadv0): Releasing backup interface [ 176.745268][ T49]  (unregistering): Released all slaves [ 176.975699][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 176.987982][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 176.998079][ T49] bond0 (unregistering): Released all slaves [ 177.085035][ T49] tipc: Left network mode [ 177.525618][ T49] hsr_slave_0: left promiscuous mode [ 177.531874][ T49] hsr_slave_1: left promiscuous mode [ 177.543965][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 177.551635][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 177.562916][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 177.570451][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 177.587161][ T49] hsr_slave_0: left promiscuous mode [ 177.593226][ T49] hsr_slave_1: left promiscuous mode [ 177.602325][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 177.609909][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 177.619949][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 177.627613][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 177.644184][ T49] [ 177.646520][ T49] ====================================================== [ 177.653532][ T49] WARNING: possible circular locking dependency detected [ 177.660636][ T49] 6.16.0-syzkaller #0 Not tainted [ 177.665655][ T49] ------------------------------------------------------ [ 177.672650][ T49] kworker/u8:3/49 is trying to acquire lock: [ 177.678615][ T49] ffff88807e2f4e00 (team->team_lock_key#2){+.+.}-{4:4}, at: team_device_event+0x182/0xa20 [ 177.688551][ T49] [ 177.688551][ T49] but task is already holding lock: [ 177.695983][ T49] ffff888033a82d30 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x5a1/0x2320 [ 177.707555][ T49] [ 177.707555][ T49] which lock already depends on the new lock. [ 177.707555][ T49] [ 177.717940][ T49] [ 177.717940][ T49] the existing dependency chain (in reverse order) is: [ 177.726940][ T49] [ 177.726940][ T49] -> #1 (&dev_instance_lock_key#3){+.+.}-{4:4}: [ 177.735350][ T49] lock_acquire+0x120/0x360 [ 177.740404][ T49] __mutex_lock+0x182/0xe80 [ 177.745413][ T49] dev_set_mtu+0x10e/0x260 [ 177.750336][ T49] team_add_slave+0x8b8/0x2840 [ 177.755603][ T49] do_set_master+0x530/0x6d0 [ 177.760697][ T49] do_setlink+0xcf0/0x41c0 [ 177.765632][ T49] rtnl_newlink+0x160b/0x1c70 [ 177.770826][ T49] rtnetlink_rcv_msg+0x7cc/0xb70 [ 177.776297][ T49] netlink_rcv_skb+0x205/0x470 [ 177.781562][ T49] netlink_unicast+0x75c/0x8e0 [ 177.786858][ T49] netlink_sendmsg+0x805/0xb30 [ 177.792164][ T49] __sock_sendmsg+0x21c/0x270 [ 177.797343][ T49] ____sys_sendmsg+0x505/0x830 [ 177.802608][ T49] ___sys_sendmsg+0x21f/0x2a0 [ 177.807794][ T49] __x64_sys_sendmsg+0x19b/0x260 [ 177.813235][ T49] do_syscall_64+0xfa/0x3b0 [ 177.818238][ T49] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.824637][ T49] [ 177.824637][ T49] -> #0 (team->team_lock_key#2){+.+.}-{4:4}: [ 177.832788][ T49] validate_chain+0xb9b/0x2140 [ 177.838063][ T49] __lock_acquire+0xab9/0xd20 [ 177.843268][ T49] lock_acquire+0x120/0x360 [ 177.848272][ T49] __mutex_lock+0x182/0xe80 [ 177.853291][ T49] team_device_event+0x182/0xa20 [ 177.858741][ T49] notifier_call_chain+0x1b3/0x3e0 [ 177.864372][ T49] dev_close_many+0x29c/0x410 [ 177.869565][ T49] unregister_netdevice_many_notify+0x619/0x2320 [ 177.876408][ T49] default_device_exit_batch+0x819/0x890 [ 177.882575][ T49] ops_undo_list+0x522/0x990 [ 177.887692][ T49] cleanup_net+0x4c5/0x800 [ 177.892664][ T49] process_scheduled_works+0xade/0x17b0 [ 177.898717][ T49] worker_thread+0x8a0/0xda0 [ 177.903815][ T49] kthread+0x70e/0x8a0 [ 177.908388][ T49] ret_from_fork+0x3fc/0x770 [ 177.913491][ T49] ret_from_fork_asm+0x1a/0x30 [ 177.918834][ T49] [ 177.918834][ T49] other info that might help us debug this: [ 177.918834][ T49] [ 177.929060][ T49] Possible unsafe locking scenario: [ 177.929060][ T49] [ 177.936501][ T49] CPU0 CPU1 [ 177.941870][ T49] ---- ---- [ 177.947220][ T49] lock(&dev_instance_lock_key#3); [ 177.952416][ T49] lock(team->team_lock_key#2); [ 177.959949][ T49] lock(&dev_instance_lock_key#3); [ 177.967660][ T49] lock(team->team_lock_key#2); [ 177.972585][ T49] [ 177.972585][ T49] *** DEADLOCK *** [ 177.972585][ T49] [ 177.980767][ T49] 6 locks held by kworker/u8:3/49: [ 177.985862][ T49] #0: ffff88801b2fb948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 177.996722][ T49] #1: ffffc90000b97bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 178.007315][ T49] #2: ffffffff8f4fd310 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 178.016603][ T49] #3: ffffffff8f509f08 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch+0xdc/0x890 [ 178.026595][ T49] #4: ffff888028ed2d30 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x5a1/0x2320 [ 178.038633][ T49] #5: ffff888033a82d30 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x5a1/0x2320 [ 178.050633][ T49] [ 178.050633][ T49] stack backtrace: [ 178.056554][ T49] CPU: 1 UID: 0 PID: 49 Comm: kworker/u8:3 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 178.056567][ T49] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 178.056574][ T49] Workqueue: netns cleanup_net [ 178.056596][ T49] Call Trace: [ 178.056604][ T49] [ 178.056610][ T49] dump_stack_lvl+0x189/0x250 [ 178.056624][ T49] ? __pfx_dump_stack_lvl+0x10/0x10 [ 178.056634][ T49] ? __pfx__printk+0x10/0x10 [ 178.056647][ T49] ? print_lock_name+0xde/0x100 [ 178.056659][ T49] print_circular_bug+0x2ee/0x310 [ 178.056672][ T49] check_noncircular+0x134/0x160 [ 178.056685][ T49] validate_chain+0xb9b/0x2140 [ 178.056698][ T49] ? __lock_acquire+0xab9/0xd20 [ 178.056709][ T49] __lock_acquire+0xab9/0xd20 [ 178.056718][ T49] ? team_device_event+0x182/0xa20 [ 178.056727][ T49] lock_acquire+0x120/0x360 [ 178.056735][ T49] ? team_device_event+0x182/0xa20 [ 178.056745][ T49] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 178.056762][ T49] __mutex_lock+0x182/0xe80 [ 178.056772][ T49] ? team_device_event+0x182/0xa20 [ 178.056782][ T49] ? __try_to_del_timer_sync+0x34a/0x3a0 [ 178.056796][ T49] ? team_device_event+0x182/0xa20 [ 178.056805][ T49] ? __pfx___mutex_lock+0x10/0x10 [ 178.056815][ T49] ? __timer_delete_sync+0x218/0x2d0 [ 178.056832][ T49] team_device_event+0x182/0xa20 [ 178.056841][ T49] notifier_call_chain+0x1b3/0x3e0 [ 178.056855][ T49] dev_close_many+0x29c/0x410 [ 178.056867][ T49] ? __lock_acquire+0xab9/0xd20 [ 178.056876][ T49] ? __pfx_dev_close_many+0x10/0x10 [ 178.056890][ T49] unregister_netdevice_many_notify+0x619/0x2320 [ 178.056902][ T49] ? __local_bh_enable_ip+0x12d/0x1c0 [ 178.056924][ T49] ? __local_bh_enable_ip+0x12d/0x1c0 [ 178.056933][ T49] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 178.056947][ T49] ? unregister_netdevice_queue+0x1b3/0x380 [ 178.056958][ T49] ? batadv_meshif_destroy_netlink+0x1dd/0x270 [ 178.056973][ T49] default_device_exit_batch+0x819/0x890 [ 178.056988][ T49] ? __pfx___might_resched+0x10/0x10 [ 178.056999][ T49] ? __pfx_default_device_exit_batch+0x10/0x10 [ 178.057012][ T49] ? __pfx_rdma_dev_exit_net+0x10/0x10 [ 178.057024][ T49] ? net_generic+0x1e/0x240 [ 178.057040][ T49] ? __pfx_default_device_exit_batch+0x10/0x10 [ 178.057053][ T49] ops_undo_list+0x522/0x990 [ 178.057068][ T49] ? __pfx_ops_undo_list+0x10/0x10 [ 178.057083][ T49] cleanup_net+0x4c5/0x800 [ 178.057105][ T49] ? __pfx_cleanup_net+0x10/0x10 [ 178.057118][ T49] ? _raw_spin_unlock_irq+0x23/0x50 [ 178.057126][ T49] ? process_scheduled_works+0x9ef/0x17b0 [ 178.057136][ T49] ? process_scheduled_works+0x9ef/0x17b0 [ 178.057146][ T49] process_scheduled_works+0xade/0x17b0 [ 178.057162][ T49] ? __pfx_process_scheduled_works+0x10/0x10 [ 178.057175][ T49] worker_thread+0x8a0/0xda0 [ 178.057191][ T49] kthread+0x70e/0x8a0 [ 178.057204][ T49] ? __pfx_worker_thread+0x10/0x10 [ 178.057214][ T49] ? __pfx_kthread+0x10/0x10 [ 178.057226][ T49] ? _raw_spin_unlock_irq+0x23/0x50 [ 178.057235][ T49] ? lockdep_hardirqs_on+0x9c/0x150 [ 178.057244][ T49] ? __pfx_kthread+0x10/0x10 [ 178.057256][ T49] ret_from_fork+0x3fc/0x770 [ 178.057266][ T49] ? __pfx_ret_from_fork+0x10/0x10 [ 178.057276][ T49] ? __switch_to_asm+0x39/0x70 [ 178.057287][ T49] ? __switch_to_asm+0x33/0x70 [ 178.057298][ T49] ? __pfx_kthread+0x10/0x10 [ 178.057310][ T49] ret_from_fork_asm+0x1a/0x30 [ 178.057325][ T49] [ 178.394471][ T49] veth1_macvtap: left promiscuous mode [ 178.400771][ T49] veth0_macvtap: left promiscuous mode [ 178.406373][ T49] veth1_vlan: left promiscuous mode [ 178.411624][ T49] veth0_vlan: left promiscuous mode [ 178.417667][ T49] veth1_macvtap: left promiscuous mode [ 178.423156][ T49] veth0_macvtap: left promiscuous mode [ 178.428855][ T49] veth1_vlan: left promiscuous mode [ 178.434110][ T49] veth0_vlan: left promiscuous mode [ 178.583566][ T49] team0 (unregistering): Port device team_slave_1 removed [ 178.603213][ T49] team0 (unregistering): Port device team_slave_0 removed [ 178.791890][ T49] team0 (unregistering): Port device team_slave_1 removed [ 178.812134][ T49] team0 (unregistering): Port device team_slave_0 removed [ 178.904928][ T49] team0 (unregistering): Port device dummy0 removed [ 179.341543][ T49] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.411029][ T49] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.452856][ T49] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.502969][ T49] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.593509][ T49] bridge_slave_1: left allmulticast mode [ 179.600188][ T49] bridge_slave_1: left promiscuous mode [ 179.606796][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 179.617780][ T49] bridge_slave_0: left allmulticast mode [ 179.623446][ T49] bridge_slave_0: left promiscuous mode [ 179.631817][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 179.725290][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 179.740696][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 179.751426][ T49] bond0 (unregistering): Released all slaves [ 179.835231][ T49] tipc: Disabling bearer [ 179.846702][ T49] tipc: Left network mode [ 179.970808][ T49] hsr_slave_0: left promiscuous mode [ 179.977826][ T49] hsr_slave_1: left promiscuous mode [ 179.983608][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 179.991816][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 180.006781][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 180.014184][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 180.027773][ T49] veth1_macvtap: left promiscuous mode [ 180.033296][ T49] veth0_macvtap: left promiscuous mode [ 180.039223][ T49] veth1_vlan: left promiscuous mode [ 180.044523][ T49] veth0_vlan: left promiscuous mode [ 180.241006][ T49] team0 (unregistering): Port device team_slave_1 removed [ 180.276445][ T49] team0 (unregistering): Port device team_slave_0 removed