last executing test programs: 17m35.395719007s ago: executing program 0 (id=383): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x12, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x3, 0x0, 0x4, 0x0, 0x2, 0x0, 0x7fffffff], 0x80a0000}) openat$vcsu(0xffffffffffffff9c, 0x0, 0x183822, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffe54}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_INPUT(r3, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) mount(&(0x7f0000000440)=@nullb, &(0x7f0000000300)='./cgroup\x00', &(0x7f0000000100)='nfsd\x00', 0x200480, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @remote, 0xffffffff}, 0x1c) syz_open_dev$ptys(0xc, 0x3, 0x0) 17m34.641307677s ago: executing program 0 (id=385): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x28801, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 17m33.041174909s ago: executing program 0 (id=388): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x20943, 0x0) writev(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_dev$dri(0x0, 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x400001) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f0000000340)={r5, 0x0, 0x0, 0x0, 0x1, [0x0], [0x9c, 0x7], [0x0, 0x1080, 0x2], [0x0, 0x0, 0x1, 0xfffffffffffff001]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f0000000080)={r6}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000300)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800faa62e58b633151ac12275ba584db6a334fb000000000000"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x18) r8 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x129340, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r8, 0xc0184800, &(0x7f0000000100)={0x7fff, 0xffffffffffffffff}) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000240), 0x200800, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r9, 0x40086200, &(0x7f0000000040)=0x1) 17m31.961559385s ago: executing program 0 (id=392): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x4a, &(0x7f00000000c0)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r2, &(0x7f0000000040)="88", 0x1) syz_usb_connect(0x0, 0x55, &(0x7f00000014c0)=ANY=[@ANYBLOB="1201000031693b083e13150886f2430002000000000904000000ff01060009040000045ab99a0909050000000400000609050000000007000009050000000000000009050000000000000002000200"], 0x0) syz_open_dev$evdev(0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x575, &(0x7f0000000780)=ANY=[], 0x0) syz_usb_ep_read(0xffffffffffffffff, 0x3, 0x96, &(0x7f00000004c0)=""/150) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0xac, &(0x7f0000000580)="8fa7e22283d521bf369dc74db103c70d63c0be4f4ae8359c1eeb4d0c23bb0d09f7c9ab6827d2516dcd64d22766ccb9c13bdb50ddaca75a7869fb2de4ca79127cbd3340c19f681afc0dc5b3d00110859f7bcd0cf51c067cd00e436f72cc5b42b910dab1945b7212dc7247670bb516e3fbec3bc13e1646cd3ad17bd340b146b577bc30e1805e605b3583f905ed1754deedec02b80ac75b3c1f5413650121fbb2a9c0ce70905ff212d512462e6d") r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x28de, 0x1205, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x9, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_connect$uac1(0x0, 0x9f, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8d, 0x3, 0x1, 0x10, 0x10, 0x6, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x8001}, [@extension_unit={0x7, 0x24, 0x8, 0x4, 0x1, 0x5}, @processing_unit={0xc, 0x24, 0x7, 0x3, 0x0, 0x0, "d885700585"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x4, 0x3, 0x3, 0x1, 'b', 'Qq\t'}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x14, 0x4, 0xcc, {0x7, 0x25, 0x1, 0x1, 0x7f, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x6896, 0x2, 0x0, "78f4cd9535ca"}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x7, 0x4, 0x3, {0x7, 0x25, 0x1, 0x0, 0xf8, 0x1}}}}}}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0}) 17m29.883879014s ago: executing program 32 (id=360): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r1, 0x100, 0x70bd26, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x1) r2 = syz_genetlink_get_family_id$gtp(0x0, 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYBLOB='\a\x00', @ANYRES32, @ANYBLOB="08000400000000000c0003000000000000000100080005000000000008000100", @ANYBLOB="0800020000"], 0x50}}, 0x0) r3 = socket(0x1e, 0x805, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, 0x0, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r5}, 0x10) ppoll(&(0x7f0000000500), 0x0, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) epoll_create1(0x80000) connect$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0xe429, @none, 0x401}, 0xe) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000140)={r4}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x20, 0x70bd26, 0x25dfdbfd, {}, [@GTPA_FAMILY={0x5, 0xd, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40880}, 0x40) socket$nl_route(0x10, 0x3, 0x0) 17m27.757063413s ago: executing program 0 (id=405): r0 = syz_open_procfs(0x0, &(0x7f00000011c0)='net/dev\x00') prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair(0x28, 0xa, 0x8000, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r5, 0x1, 0x70bd28, 0x25dfdbf9, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='illinois\x00', 0x9) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r2, &(0x7f0000000400)="001d71d52a3879c9c7649475728f8a25a071a59c20c131e0364e8828e50cfb69d0561b1bf87522000e42847c81695082fb23c905f5713aa8cadb181f50020730a3af1c", 0x43, 0x4044000, 0x0, 0x0) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) preadv(r0, &(0x7f00000002c0)=[{&(0x7f0000002080)=""/4101, 0x1005}], 0x1, 0x18e4, 0xffffffff) 17m26.147413206s ago: executing program 0 (id=407): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x100000000, 0x100) ioctl$VIDIOC_SUBDEV_G_CROP(r0, 0xc038563b, &(0x7f0000000040)={0x1, 0x0, {0x3, 0x5, 0x10003, 0x6}}) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) ppoll(&(0x7f0000000000)=[{r1, 0x8108}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000640)=0x10) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r1, 0x0) r2 = epoll_create(0x20) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000180)={0x60002003}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000009380)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x25dfdbff}, 0x24}, 0x1, 0x0, 0x0, 0x40051}, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[], 0x76) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) finit_module(0xffffffffffffffff, 0x0, 0x100000000000000) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, &(0x7f0000000140)={0x2, 'macvlan0\x00', 0x2}, 0x18) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[], 0x50) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004b74ffec850000006d000000850000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000680)='virtio_transport_alloc_pkt\x00', r5}, 0x10) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000100), 0x10) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r8 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000240)="b000000016007f029e78f6030f7a0a762353bfb89fd8c902317bab30f89f080aaaaeb9d8091c815dcf03e14e877733fff4fe20a5be870f576b162e7de2d02673e789a4950c9cdc206e086fd0dc8ca9afcd9d522ac78876a4595146add31b35355848794ca3f8b38aef1e114ab9fb0200000000000000a3b0c81c6f8144e74fe13b80ca46c1a6c04ad73c9d44b605f900"/158, 0x9e}, {&(0x7f00000000c0)="68c32a7de6a2395800"/18, 0x12}], 0x2}, 0x0) shutdown(r7, 0x0) recvmmsg(r7, &(0x7f0000001d00)=[{{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000001d40)=""/4078, 0xfee}, {&(0x7f0000000340)=""/141, 0x8d}, {&(0x7f0000002d40)=""/4116, 0x1005}, {&(0x7f0000000400)=""/6, 0x6}, {&(0x7f0000000440)=""/231, 0xe7}], 0x5}}], 0x3ffffbd, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x8031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c000000040000000400d0d2df61000000000000", @ANYRES32=r4, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 17m10.592270885s ago: executing program 33 (id=407): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x100000000, 0x100) ioctl$VIDIOC_SUBDEV_G_CROP(r0, 0xc038563b, &(0x7f0000000040)={0x1, 0x0, {0x3, 0x5, 0x10003, 0x6}}) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) ppoll(&(0x7f0000000000)=[{r1, 0x8108}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000640)=0x10) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r1, 0x0) r2 = epoll_create(0x20) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000180)={0x60002003}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000009380)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x25dfdbff}, 0x24}, 0x1, 0x0, 0x0, 0x40051}, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[], 0x76) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) finit_module(0xffffffffffffffff, 0x0, 0x100000000000000) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, &(0x7f0000000140)={0x2, 'macvlan0\x00', 0x2}, 0x18) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[], 0x50) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004b74ffec850000006d000000850000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000680)='virtio_transport_alloc_pkt\x00', r5}, 0x10) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000100), 0x10) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r8 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000240)="b000000016007f029e78f6030f7a0a762353bfb89fd8c902317bab30f89f080aaaaeb9d8091c815dcf03e14e877733fff4fe20a5be870f576b162e7de2d02673e789a4950c9cdc206e086fd0dc8ca9afcd9d522ac78876a4595146add31b35355848794ca3f8b38aef1e114ab9fb0200000000000000a3b0c81c6f8144e74fe13b80ca46c1a6c04ad73c9d44b605f900"/158, 0x9e}, {&(0x7f00000000c0)="68c32a7de6a2395800"/18, 0x12}], 0x2}, 0x0) shutdown(r7, 0x0) recvmmsg(r7, &(0x7f0000001d00)=[{{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000001d40)=""/4078, 0xfee}, {&(0x7f0000000340)=""/141, 0x8d}, {&(0x7f0000002d40)=""/4116, 0x1005}, {&(0x7f0000000400)=""/6, 0x6}, {&(0x7f0000000440)=""/231, 0xe7}], 0x5}}], 0x3ffffbd, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x8031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c000000040000000400d0d2df61000000000000", @ANYRES32=r4, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 6m24.883133035s ago: executing program 3 (id=2206): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9", 0xf}], 0x1}, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x0, 0xee01}}, './file0\x00'}) recvmsg(r0, 0x0, 0x141) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB], &(0x7f00000000c0)='GPL\x00', 0x0, 0x100a, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000003c0)={r1, 0x20, &(0x7f0000000380)={&(0x7f0000000300)=""/104, 0x68, 0x0, &(0x7f00000004c0)=""/226, 0xe2}}, 0x10) r6 = open_tree(0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00', 0x80000) ioctl$AUTOFS_DEV_IOCTL_FAIL(r1, 0xc0189377, &(0x7f0000000680)={{0x1, 0x1, 0x18, r2, {0x6, 0x8}}, './file0\x00'}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000740)=@bpf_lsm={0x1d, 0x0, 0x0, &(0x7f0000000940)='GPL\x00', 0x101, 0x86, &(0x7f00000001c0)=""/134, 0x40f00, 0x3, '\x00', r4, 0x1b, r1, 0x8, &(0x7f0000000280)={0x9, 0x1}, 0x8, 0x10, 0x0, 0x0, r5, 0x0, 0x1, &(0x7f0000000900)=[r1, r1, r6, r1, r7], &(0x7f0000000700)=[{0x0, 0x5, 0xc, 0x7}], 0x10, 0x80000000, @void, @value}, 0x94) acct(&(0x7f0000000000)='./file0\x00') memfd_secret(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r9 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r9, 0x8914, &(0x7f0000000000)) syz_init_net_socket$x25(0x9, 0x5, 0x0) r10 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r10, 0x890b, &(0x7f0000000380)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) r11 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r11, 0x890b, &(0x7f00000007c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x6, @bcast, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) 6m22.857251322s ago: executing program 3 (id=2211): kexec_load(0x7fffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$int_out(0xffffffffffffffff, 0x5462, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_init(0x8, 0x80000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0x20ff, 0x5, 0x89, 0xd615, 0x9, 0x7fffffff, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x13}}}, 0xa0) sendfile(r1, r1, &(0x7f0000000080), 0x7f03) 6m22.657832795s ago: executing program 3 (id=2214): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x3, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) socket$netlink(0x10, 0x3, 0x0) pipe2(0x0, 0x84880) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4008044) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x28, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFT_MSG_NEWSETELEM={0x14, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x8c}}, 0x0) connect$tipc(0xffffffffffffffff, &(0x7f0000000040)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) sendto$inet6(r0, &(0x7f0000000240)=':', 0x1, 0x24008844, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000380)='yeah\x00', 0x5) shutdown(r0, 0x1) syz_usb_connect(0x0, 0x3f, &(0x7f0000000500)=ANY=[@ANYBLOB="12011001d31ad240f0031d5842bb0102030109022d0001000000000904c50003ff01070009050100000000030109050c00ff03028603090587"], 0x0) 6m21.768087347s ago: executing program 3 (id=2218): openat$dir(0xffffffffffffff9c, 0x0, 0x2, 0x40) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) io_uring_setup(0x4edd, 0x0) r3 = socket$caif_stream(0x25, 0x1, 0x5) recvmmsg(r3, &(0x7f0000006980)=[{{&(0x7f0000000240)=@nfc_llcp, 0x80, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)=""/224, 0xe0}, 0x7}, {{0x0, 0x0, &(0x7f0000000900)=[{0x0}, {0x0}, {&(0x7f0000000640)=""/72, 0x48}, {&(0x7f00000006c0)=""/47, 0x2f}, {&(0x7f0000000700)=""/207, 0xcf}], 0x5}, 0x9cd0}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000d80)=""/228, 0xe4}, 0x2}, {{0x0, 0x0, &(0x7f0000001000)=[{0x0}], 0x1}, 0x1}, {{0x0, 0x0, 0x0}, 0x80}, {{&(0x7f0000003840)=@llc, 0x80, 0x0, 0x0, &(0x7f0000004d00)=""/164, 0xa4}, 0x18}, {{&(0x7f0000004dc0)=@llc, 0x80, &(0x7f0000006340)=[{0x0}, {&(0x7f0000004f00)=""/226, 0xe2}, {&(0x7f0000005000)=""/147, 0x93}, {&(0x7f00000050c0)=""/183, 0xb7}, {0x0}, {&(0x7f0000005340)=""/4096, 0x1000}], 0x6}, 0x2}, {{&(0x7f0000006400)=@ieee802154={0x24, @long}, 0x80, 0x0}, 0x5}, {{&(0x7f00000067c0)=@ethernet={0x0, @local}, 0x80, 0x0, 0x0, &(0x7f0000006900)=""/117, 0x75}, 0x3}], 0x9, 0x2, 0x0) 6m14.057302962s ago: executing program 3 (id=2232): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000820004000000000000000c00850000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key(&(0x7f0000000080)='user\x00', &(0x7f0000000000)={'syz', 0x2}, &(0x7f0000000040)='9', 0x1, 0xfffffffffffffffc) keyctl$chown(0x4, r4, 0xee00, 0xffffffffffffffff) 6m12.846521399s ago: executing program 3 (id=2234): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0x5) ppoll(&(0x7f0000000200)=[{r1, 0x20}], 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000005c0)=[{{0x0, 0xfffffffffffffc4c, 0x0}}], 0x3ffffffffffff62, 0x0, 0x0) 5m57.390834319s ago: executing program 34 (id=2234): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0x5) ppoll(&(0x7f0000000200)=[{r1, 0x20}], 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000005c0)=[{{0x0, 0xfffffffffffffc4c, 0x0}}], 0x3ffffffffffff62, 0x0, 0x0) 5m48.582807388s ago: executing program 5 (id=2293): bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0), 0x8) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) listen(r0, 0xfff) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x1d, 0x2, 0x6) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x6, &(0x7f0000000f00)=0x5, 0x4) r3 = socket$can_bcm(0x1d, 0x2, 0x2) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$IP_VS_SO_SET_STARTDAEMON(r4, 0x0, 0x48b, 0x0, 0x0) sendmsg$IPSET_CMD_SAVE(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB], 0x30}, 0x1, 0x0, 0x0, 0x2404a411}, 0x4000) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)=ANY=[@ANYRES8=r2, @ANYRES8=r3, @ANYRES32, @ANYRES16=r1], 0x20) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x3e0, 0x1b0, 0xc8, 0x8, 0x1b0, 0x5803, 0x310, 0x2e8, 0x2e8, 0x310, 0x2e8, 0x3, 0x0, {[{{@ipv6={@loopback, @mcast1, [], [], 'erspan0\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1b0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1}}, @common=@inet=@socket1={{0x28}, 0xa490f54eab606508}]}, @unspec=@TRACE={0x20}}, {{@ipv6={@remote, @mcast2, [], [], 'macvtap0\x00', 'syzkaller1\x00'}, 0x0, 0xf8, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x440) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x17, 0x6, &(0x7f0000000680)=@framed={{0x18, 0x8, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x5}, [@func={0x85, 0x0, 0x1, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0xba}, @generic={0xa7}]}, &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x34, r7, 0x1, 0x70bd25, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_TX_MAX_FRAMES={0x8, 0x7, 0x4}]}, 0x34}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a4c000000060a0b040000000000000000000100736f636b65740000040002800900010073797a30000000000900020073797a32000000000500074057000000140000001100010000000000000000000000000a"], 0x74}}, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r2, 0x0, 0x484, &(0x7f0000000500)=""/135, &(0x7f0000000140)=0x87) accept(r2, 0x0, &(0x7f0000000400)) socket$nl_generic(0x10, 0x3, 0x10) write$cgroup_subtree(r3, &(0x7f0000000b00)={[{0x2b, 'net_cls'}, {0x2d, 'blkio'}, {0x2b, 'hugetlb'}]}, 0x19) 5m47.75069221s ago: executing program 5 (id=2296): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001280)={0x11, 0x3, &(0x7f0000000940)=ANY=[@ANYBLOB="1800000008000000000000000000000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000780)='contention_end\x00', r0}, 0x10) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, 0x0) r1 = openat$dsp(0xffffff9c, &(0x7f0000000280), 0x80000, 0x0) ioctl$SOUND_MIXER_READ_STEREODEVS(r1, 0x80044dfb, &(0x7f0000000300)) 5m47.596676702s ago: executing program 5 (id=2297): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x40004) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'ip_vti0\x00', &(0x7f00000002c0)={'erspan0\x00', 0x0, 0x20, 0x8, 0x8, 0xffffffff, {{0x5, 0x4, 0x2, 0x3, 0x14, 0x64, 0x0, 0x0, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x28}, @empty}}}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, 0x0) socket$nl_generic(0x10, 0x3, 0x10) unshare(0x2040600) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xb, 0xff, 0x2, 0x9, 0x1, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000380)={r1, &(0x7f0000000300), &(0x7f0000000340)=""/55}, 0x20) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000440), 0x2) r3 = memfd_create(&(0x7f00000009c0)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdbU\xb1\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\x90i\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14O\xf8\xb5C\x1f\xb6b8b\x06A2@D\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\x05\x00\x00\x00\x00\x00\x00\x00\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\x88\xd1\x1eQB\x18\xc1-\xc4\x8fK\xf8\xfa\xb6\xf8\v;\xaa\x8fW\xcc\n\x17\x7f\x98\xb7\xcdqV\xd4\xf0)\xfa\x0fG\xc8\xbf\xfd\xe8>K\f\xcd+\xb0\x99Q\xba/\xa8\xb9`k\b\xd1\xcc\xfc\xeaA\"\v=\x83fC\x90%\xa1d\x91\xf8:\x16<\xad\xc2\x18\xdf\x01\xe2\x96\xfcj\xe9\xa4\x065m\x03\x05Np\xda\"\xf1\xb6\xbcP\x8fP\x8d\x89%\xf2\x12T\xd0\xc3\x15W\x9c\x87\x1b\x8c\xc9\xd9\xc6\xad\x96-d\xa2wFB\xcaB\xa5\x15\xf8,\x04\x1c*\xd98\x8bG\x90\x81`\x03\xe0\xde\x9c\x9a\x0f\x1b\x8f\xd2%*&$Wc\xb3\xa6\xc4TK1}2\xb3\xab\xf4\xb7\xb7\x85\apa\xaf\x1c\x10i\xb9\x9f\x06\xff4%\"7f \x0e\xf5Bk\r\xac\"\x13tNx\xc0$\x85\x9f', 0x3) ftruncate(r3, 0xffff) fcntl$addseals(r3, 0x409, 0x7) r4 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000100)={r3, 0x0, 0x0, 0x1000}) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, &(0x7f0000000080)=0x2) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, &(0x7f00000000c0)=0x5) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1) 5m46.882499062s ago: executing program 5 (id=2298): setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x8001000000000000, 0x40, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x9, 0x744, 0x6}) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000040)=0x1) socket(0x400000000010, 0x3, 0x0) openat(0xffffffffffffff9c, 0x0, 0x40, 0x1) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=']) read$FUSE(r1, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f000001a4c0)={0x50, 0xfffffffffffffff5, 0x0, {0x7, 0x1f, 0x0, 0x420, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4}}, 0x50) syz_fuse_handle_req(r1, &(0x7f0000008380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) ioctl$HIDIOCSUSAGES(r2, 0x501c4814, 0x0) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, 0x0, 0x20044000) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r3, &(0x7f0000000140)={{0x6, @rose}, [@bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000100)={'nr0\x00', 0x2}) 5m44.82269402s ago: executing program 5 (id=2304): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb44", 0x1d}], 0x1}, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x0, 0xee01}}, './file0\x00'}) recvmsg(r0, 0x0, 0x141) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB], &(0x7f00000000c0)='GPL\x00', 0x0, 0x100a, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000003c0)={r1, 0x20, &(0x7f0000000380)={&(0x7f0000000300)=""/104, 0x68, 0x0, &(0x7f00000004c0)=""/226, 0xe2}}, 0x10) r6 = open_tree(0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00', 0x80000) ioctl$AUTOFS_DEV_IOCTL_FAIL(r1, 0xc0189377, &(0x7f0000000680)={{0x1, 0x1, 0x18, r2, {0x6, 0x8}}, './file0\x00'}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000740)=@bpf_lsm={0x1d, 0x0, 0x0, &(0x7f0000000940)='GPL\x00', 0x101, 0x86, &(0x7f00000001c0)=""/134, 0x40f00, 0x3, '\x00', r4, 0x1b, r1, 0x8, &(0x7f0000000280)={0x9, 0x1}, 0x8, 0x10, 0x0, 0x0, r5, 0x0, 0x1, &(0x7f0000000900)=[r1, r1, r6, r1, r7], &(0x7f0000000700)=[{0x0, 0x5, 0xc, 0x7}], 0x10, 0x80000000, @void, @value}, 0x94) acct(&(0x7f0000000000)='./file0\x00') memfd_secret(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r9 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r9, 0x8914, &(0x7f0000000000)) syz_init_net_socket$x25(0x9, 0x5, 0x0) r10 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r10, 0x890b, &(0x7f0000000380)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) r11 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r11, 0x890b, &(0x7f00000007c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x6, @bcast, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) r12 = syz_open_dev$swradio(&(0x7f00000000c0), 0x0, 0x2) ioctl$VIDIOC_S_CTRL(r12, 0xc0205647, &(0x7f0000000000)={0x0, 0x40000000}) 5m43.850713773s ago: executing program 5 (id=2307): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0x5) clock_gettime(0x0, &(0x7f0000000240)) recvmmsg(r1, &(0x7f00000005c0)=[{{0x0, 0xfffffffffffffc4c, 0x0}}], 0x3ffffffffffff62, 0x0, 0x0) 5m28.419719903s ago: executing program 35 (id=2307): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0x5) clock_gettime(0x0, &(0x7f0000000240)) recvmmsg(r1, &(0x7f00000005c0)=[{{0x0, 0xfffffffffffffc4c, 0x0}}], 0x3ffffffffffff62, 0x0, 0x0) 4m18.852730229s ago: executing program 7 (id=2552): syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) syz_io_uring_setup(0x834, &(0x7f0000000180)={0x0, 0x679a, 0x400, 0x6, 0x3cc}, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$inet_sctp(0x2, 0x1, 0x84) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r4, 0x80, &(0x7f00000000c0)=@nl=@proc={0x10, 0x0, 0x25dfdbfe, 0x4090000}}) socket$inet6(0xa, 0x800000000000002, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') read$char_usb(r6, &(0x7f0000000240)=""/36, 0x24) setsockopt$inet6_IPV6_RTHDRDSTOPTS(0xffffffffffffffff, 0x29, 0x37, &(0x7f0000000080)=ANY=[], 0x8) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x40) ptrace(0x10, r7) ptrace$setsig(0x4203, r7, 0x2, &(0x7f0000000040)={0x15, 0xa, 0x1e0000}) fsetxattr$security_capability(r4, &(0x7f0000000040), &(0x7f0000000200)=@v2={0x2000000, [{0x8, 0x1}, {0x7, 0x80}]}, 0x14, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x42, &(0x7f0000000200)={0x0, 0xea60}, 0x10) getsockopt$sock_timeval(r1, 0x1, 0x14, 0x0, &(0x7f00000000c0)) socket(0x1, 0x803, 0x5bd) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0x3}]}, 0x3c}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xc4, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@private0, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0xfffffffffffffffc}, {0x0, 0xacb0, 0x80000000000000}, 0x400}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xc4}}, 0x4c050) 4m16.272747544s ago: executing program 7 (id=2559): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) chdir(0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0x10, 0x2, 0x10) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = syz_io_uring_setup(0x5c2, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x3, 0x348}, &(0x7f0000000480)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000004c0)=@IORING_OP_TIMEOUT={0xb, 0x18, 0x0, 0x0, 0x4, &(0x7f0000000280)={0x0, 0x989680}, 0x1, 0x40, 0x1}) io_uring_enter(r2, 0x6e2, 0x3900, 0x1, 0x0, 0xe00) rt_sigsuspend(&(0x7f00000002c0), 0x8) write(0xffffffffffffffff, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000a80)='/proc/meminfo\x00', 0x0, 0x0) preadv(r5, &(0x7f0000000100)=[{&(0x7f0000000000)=""/221, 0x34b}], 0x1, 0x1c0, 0x0) 4m15.262893828s ago: executing program 7 (id=2564): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb4400", 0x1e}], 0x1}, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x0, 0xee01}}, './file0\x00'}) recvmsg(r0, 0x0, 0x141) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x100a, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000003c0)={r1, 0x20, &(0x7f0000000380)={&(0x7f0000000300)=""/104, 0x68, 0x0, &(0x7f00000004c0)=""/226, 0xe2}}, 0x10) r6 = open_tree(0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00', 0x80000) ioctl$AUTOFS_DEV_IOCTL_FAIL(r1, 0xc0189377, &(0x7f0000000680)={{0x1, 0x1, 0x18, r2, {0x6, 0x8}}, './file0\x00'}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000740)=@bpf_lsm={0x1d, 0x0, 0x0, &(0x7f0000000940)='GPL\x00', 0x101, 0x86, &(0x7f00000001c0)=""/134, 0x40f00, 0x3, '\x00', r4, 0x1b, r1, 0x8, &(0x7f0000000280)={0x9, 0x1}, 0x8, 0x10, 0x0, 0x0, r5, 0x0, 0x1, &(0x7f0000000900)=[r1, r1, r6, r1, r7], &(0x7f0000000700)=[{0x0, 0x5, 0xc, 0x7}], 0x10, 0x80000000, @void, @value}, 0x94) acct(&(0x7f0000000000)='./file0\x00') memfd_secret(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r9 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r9, 0x8914, &(0x7f0000000000)) syz_init_net_socket$x25(0x9, 0x5, 0x0) r10 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r10, 0x890b, &(0x7f0000000380)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) r11 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r11, 0x890b, &(0x7f00000007c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x6, @bcast, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) r12 = syz_open_dev$swradio(&(0x7f00000000c0), 0x0, 0x2) ioctl$VIDIOC_S_CTRL(r12, 0xc0205647, &(0x7f0000000000)={0x0, 0x40000000}) 4m14.986299412s ago: executing program 7 (id=2569): syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) syz_io_uring_setup(0x834, &(0x7f0000000180)={0x0, 0x679a, 0x400, 0x6, 0x3cc}, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$inet_sctp(0x2, 0x1, 0x84) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r4, 0x80, &(0x7f00000000c0)=@nl=@proc={0x10, 0x0, 0x25dfdbfe, 0x4090000}}) socket$inet6(0xa, 0x800000000000002, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') read$char_usb(r6, &(0x7f0000000240)=""/36, 0x24) setsockopt$inet6_IPV6_RTHDRDSTOPTS(0xffffffffffffffff, 0x29, 0x37, &(0x7f0000000080)=ANY=[], 0x8) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x40) ptrace(0x10, r7) ptrace$setsig(0x4203, r7, 0x2, &(0x7f0000000040)={0x15, 0xa, 0x1e0000}) fsetxattr$security_capability(r4, &(0x7f0000000040), &(0x7f0000000200)=@v2={0x2000000, [{0x8, 0x1}, {0x7, 0x80}]}, 0x14, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x42, &(0x7f0000000200)={0x0, 0xea60}, 0x10) getsockopt$sock_timeval(r1, 0x1, 0x14, 0x0, &(0x7f00000000c0)) socket(0x1, 0x803, 0x5bd) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0x3}]}, 0x3c}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xc4, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@private0, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0xfffffffffffffffc}, {0x0, 0xacb0, 0x80000000000000}, 0x400}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xc4}}, 0x4c050) 4m13.908745586s ago: executing program 7 (id=2575): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) chdir(0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0x10, 0x2, 0x10) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = syz_io_uring_setup(0x5c2, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x3, 0x348}, &(0x7f0000000480)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000004c0)=@IORING_OP_TIMEOUT={0xb, 0x18, 0x0, 0x0, 0x4, &(0x7f0000000280)={0x0, 0x989680}, 0x1, 0x40, 0x1}) io_uring_enter(r2, 0x6e2, 0x3900, 0x1, 0x0, 0xe00) rt_sigsuspend(&(0x7f00000002c0), 0x8) write(0xffffffffffffffff, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000a80)='/proc/meminfo\x00', 0x0, 0x0) preadv(r5, &(0x7f0000000100)=[{&(0x7f0000000000)=""/221, 0x34b}], 0x1, 0x1c0, 0x0) 4m11.238104493s ago: executing program 7 (id=2583): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0001}]}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) lremovexattr(&(0x7f0000000140)='./file0/file0/file0\x00', &(0x7f0000000100)=@known='security.apparmor\x00') r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)=0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20000004) mkdir(&(0x7f0000000300)='./bus\x00', 0x113) mount(&(0x7f0000000000)=@nullb, &(0x7f0000000040)='./bus\x00', &(0x7f00000000c0)='ufs\x00', 0x21864a, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, 0x0, 0x0) fstat(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, 0xffffffffffffffff, r6) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000380)) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000040)={0x780, 0xa0, 0x0, 0x0, 0x0, 0x7, 0x20, 0x1000000, {0x3, 0x6fb4}, {}, {}, {0x0, 0x0, 0x400}, 0x0, 0x40, 0x0, 0x0, 0x1, 0x0, 0x0, 0xecfe, 0x0, 0x6, 0x0, 0x0, 0x1, 0x2, 0x3}) r7 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588) timer_settime(r2, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x71, 0x200000009}) syz_init_net_socket$ax25(0x3, 0x2, 0x3) pread64(r0, 0x0, 0x0, 0xce2) syz_usb_connect(0x0, 0x24, 0x0, 0x0) 3m56.01333509s ago: executing program 36 (id=2583): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0001}]}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) lremovexattr(&(0x7f0000000140)='./file0/file0/file0\x00', &(0x7f0000000100)=@known='security.apparmor\x00') r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)=0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20000004) mkdir(&(0x7f0000000300)='./bus\x00', 0x113) mount(&(0x7f0000000000)=@nullb, &(0x7f0000000040)='./bus\x00', &(0x7f00000000c0)='ufs\x00', 0x21864a, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, 0x0, 0x0) fstat(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, 0xffffffffffffffff, r6) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000380)) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000040)={0x780, 0xa0, 0x0, 0x0, 0x0, 0x7, 0x20, 0x1000000, {0x3, 0x6fb4}, {}, {}, {0x0, 0x0, 0x400}, 0x0, 0x40, 0x0, 0x0, 0x1, 0x0, 0x0, 0xecfe, 0x0, 0x6, 0x0, 0x0, 0x1, 0x2, 0x3}) r7 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588) timer_settime(r2, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x71, 0x200000009}) syz_init_net_socket$ax25(0x3, 0x2, 0x3) pread64(r0, 0x0, 0x0, 0xce2) syz_usb_connect(0x0, 0x24, 0x0, 0x0) 2m26.24911266s ago: executing program 9 (id=2897): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x20943, 0x0) writev(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_dev$dri(0x0, 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x400001) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f0000000340)={r5, 0x0, 0x0, 0x0, 0x1, [0x0], [0x9c, 0x7], [0x0, 0x1080, 0x2], [0x0, 0x0, 0x1, 0xfffffffffffff001]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f0000000080)={r6}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000300)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x18) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r9 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x129340, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r9, 0xc0184800, &(0x7f0000000100)={0x7fff, r8}) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000240), 0x200800, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000040)=0x1) 2m24.693800522s ago: executing program 9 (id=2901): socket$nl_route(0x10, 0x3, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x7) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)=ANY=[@ANYRES32=0x1, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="05000000000000"], 0x50) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$inet6(0xa, 0x1, 0x8010000000000084) r4 = openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0) r5 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) lseek(r5, 0xa, 0x1) write$cgroup_devices(r4, &(0x7f0000000140)=ANY=[@ANYBLOB], 0xa) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) socket$unix(0x1, 0x1, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, &(0x7f0000000180)={0x0, 0x2, 0x0, 0x0, 0x3}) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161142, 0x0) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f0000000140)=0x7ffd) ioctl$PPPIOCSPASS(r6, 0x40107447, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) 2m22.353141914s ago: executing program 9 (id=2907): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f0000000340)='./file0\x00', 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_WPAN_PHY(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="030626bd7000fedbdf250100000008000300", @ANYRES32=0x0, @ANYBLOB="0c0006400100000001000000"], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000001780), 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYBLOB, @ANYRESHEX=r5, @ANYBLOB=',sgq']) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ptrace(0x10, r3) socket$nl_generic(0x10, 0x3, 0x10) bind$inet(0xffffffffffffffff, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e24, 0x7f, @dev={0xfe, 0x80, '\x00', 0x41}, 0xca}, 0x1c) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010012000000000000000700000a20000000000a03000000000000000000070000000900010073797a300000000044000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000020080003400000000514000000110001"], 0x8c}}, 0x0) socket$kcm(0x25, 0x1, 0x0) 2m21.524455115s ago: executing program 9 (id=2910): r0 = socket$can_j1939(0x1d, 0x2, 0x7) read$FUSE(r0, &(0x7f0000002780)={0x2020}, 0x2020) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000100)={0x1d, r1, 0x0, {0x0, 0x0, 0x4}, 0x1}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000000)=0x9, 0x4) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000400)="81b641f1f3843704b6", 0x9}], 0x1}, 0x48005) 2m19.834361878s ago: executing program 9 (id=2914): r0 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0xfffffffffffffe7d, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0xb, 'McE7'}]}}, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000007c0)=@newtaction={0x70, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8}, @TCA_SAMPLE_PARMS={0x18}, @TCA_SAMPLE_RATE={0x8}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x20774, 0x8000, 0x40, 0x0, 0x3, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x3, 0x0, 0x4, 0x6, 0x2, 0x0, 0x7fffffff], 0x80a0000}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f0000000140)=@ethtool_gfeatures}) ioctl$KVM_RUN(r3, 0xae80, 0x0) semctl$SETVAL(0x0, 0x1, 0x10, &(0x7f0000000000)=0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r7, 0x0) r8 = socket$inet(0x2, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x33, &(0x7f00000a2000)={0x0, 0x0}, 0x10) sendmsg$NFNL_MSG_CTHELPER_NEW(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="58000000000901010000000000000000000000000c0002800500010000000000e0fc028008000100ac1414bb08000200ac14140008000340000000010900010073797a3100000000"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 2m16.490650794s ago: executing program 9 (id=2922): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0001}]}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) lremovexattr(&(0x7f0000000140)='./file0/file0/file0\x00', &(0x7f0000000100)=@known='security.apparmor\x00') r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)=0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20000004) mkdir(&(0x7f0000000300)='./bus\x00', 0x113) mount(&(0x7f0000000000)=@nullb, &(0x7f0000000040)='./bus\x00', &(0x7f00000000c0)='ufs\x00', 0x21864a, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, 0x0, 0x0) fchown(r3, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000380)) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000040)={0x780, 0xa0, 0x0, 0x0, 0x0, 0x7, 0x20, 0x1000000, {0x3, 0x6fb4}, {}, {}, {0x0, 0x0, 0x400}, 0x0, 0x40, 0x0, 0x0, 0x1, 0x0, 0x0, 0xecfe, 0x0, 0x6, 0x0, 0x0, 0x1, 0x2, 0x3}) r6 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588) timer_settime(r2, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x71, 0x200000009}) syz_init_net_socket$ax25(0x3, 0x2, 0x3) pread64(r0, 0x0, 0x0, 0xce2) syz_usb_connect(0x0, 0x24, 0x0, 0x0) 2m1.193483471s ago: executing program 37 (id=2922): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0001}]}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) lremovexattr(&(0x7f0000000140)='./file0/file0/file0\x00', &(0x7f0000000100)=@known='security.apparmor\x00') r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)=0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20000004) mkdir(&(0x7f0000000300)='./bus\x00', 0x113) mount(&(0x7f0000000000)=@nullb, &(0x7f0000000040)='./bus\x00', &(0x7f00000000c0)='ufs\x00', 0x21864a, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, 0x0, 0x0) fchown(r3, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000380)) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000040)={0x780, 0xa0, 0x0, 0x0, 0x0, 0x7, 0x20, 0x1000000, {0x3, 0x6fb4}, {}, {}, {0x0, 0x0, 0x400}, 0x0, 0x40, 0x0, 0x0, 0x1, 0x0, 0x0, 0xecfe, 0x0, 0x6, 0x0, 0x0, 0x1, 0x2, 0x3}) r6 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588) timer_settime(r2, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x71, 0x200000009}) syz_init_net_socket$ax25(0x3, 0x2, 0x3) pread64(r0, 0x0, 0x0, 0xce2) syz_usb_connect(0x0, 0x24, 0x0, 0x0) 9.334812393s ago: executing program 8 (id=3257): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000007c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\f\n5', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) 8.87237538s ago: executing program 8 (id=3259): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc1105518, &(0x7f0000000040)={{0x22, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x7, 0xfffffffffffffffc, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5fa, 0x0, 0x0, 0x8000000000000, 0x0, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0x40000, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x6, 0x4, 0x6, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x8001]}) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc1105518, &(0x7f0000000c40)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x80000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x108000000000000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x80000000000000, 0x0, 0x0, 0x0, 0x0, 0x40, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x80000000000000, 0xfffffffc, 0x1, 0x8, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x4, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x5, 0xfffffffc, 0x7]}) 8.722879371s ago: executing program 8 (id=3260): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) msgsnd(0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) syz_open_dev$sndctrl(0x0, 0x8, 0x800) preadv2(r2, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x100000}], 0xc4, 0x0, 0x0, 0x9) r3 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x4008000, &(0x7f0000000280)={0xa, 0x4e1f, 0x80000, @loopback, 0x7}, 0x1c) sendto$inet6(r3, &(0x7f00000009c0), 0x0, 0xc001, 0x0, 0x0) setsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet6_udp_int(r3, 0x11, 0x1, &(0x7f0000000080), 0x4) 8.410132766s ago: executing program 8 (id=3265): openat$dir(0xffffffffffffff9c, 0x0, 0x2, 0x40) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10) io_uring_setup(0x4edd, 0x0) r4 = socket$caif_stream(0x25, 0x1, 0x5) recvmmsg(r4, &(0x7f0000006980)=[{{&(0x7f0000000240)=@nfc_llcp, 0x80, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)=""/224, 0xe0}, 0x7}, {{0x0, 0x0, &(0x7f0000000900)=[{0x0}, {0x0}, {&(0x7f0000000640)=""/72, 0x48}, {&(0x7f00000006c0)=""/47, 0x2f}, {&(0x7f0000000700)=""/207, 0xcf}], 0x5}, 0x9cd0}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000d80)=""/228, 0xe4}, 0x2}, {{0x0, 0x0, &(0x7f0000001000)=[{0x0}], 0x1}, 0x1}, {{0x0, 0x0, 0x0}, 0x80}, {{&(0x7f0000003840)=@llc, 0x80, 0x0, 0x0, &(0x7f0000004d00)=""/164, 0xa4}, 0x18}, {{&(0x7f0000004dc0)=@llc, 0x80, &(0x7f0000006340)=[{0x0}, {&(0x7f0000004f00)=""/226, 0xe2}, {&(0x7f0000005000)=""/147, 0x93}, {&(0x7f00000050c0)=""/183, 0xb7}, {0x0}, {&(0x7f0000005340)=""/4096, 0x1000}], 0x6}, 0x2}, {{&(0x7f00000067c0)=@ethernet={0x0, @local}, 0x80, 0x0, 0x0, &(0x7f0000006900)=""/117, 0x75}, 0x3}], 0x8, 0x2, 0x0) 6.154617476s ago: executing program 8 (id=3267): r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000200)=""/55, 0x37) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0xc, &(0x7f0000000900)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @void, @value}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x1e, 0x4, 0x0) socket(0x1e, 0x4, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) dup(r1) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x453, 0x20, 0x70bd2b, 0x25dfdbfb, '\x00'}, 0x14}, 0x1, 0x0, 0x0, 0x4008140}, 0x880) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000006c0)={0x0, 0x0, 0x42, {0x0, 0x1}, {0x47, 0xfffe}, @cond=[{0x84, 0x3ff, 0x4404, 0x4, 0x1, 0xd}, {0x0, 0xa0, 0x1, 0x5, 0x800, 0xff01}]}) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x12d8) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x8, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) getdents64(r0, 0xfffffffffffffffe, 0x29) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1038, 0x12b6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000d40), 0x2, 0x0) ioctl$FITRIM(r4, 0xc0185879, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, &(0x7f0000000240)={0x14, &(0x7f0000000880)={0x40, 0x9, 0x28, {0x28, 0xf, "89b81875976ef7a158973dbdb2b94a34cf8d3d2a8d1c2a6007477812017cf3ee3095a28de547"}}, 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000280)={0x2c, &(0x7f0000000100)={0x40, 0xa, 0xb5, {0xb5, 0x22, "cac6988edb48fb4751f6c6b498b0fd17252a61b34cd81ee6ec7f9a0303cbc33d87146694540db9f3d76b52f797032c17c0b457421d49f69d74dd2f77e4c56a42fea21abd340fcf92230e7cd89240a02ca76924b6c683cb5b4866b0219bf6b730c77e664c22752fdc80a2ab821f408ec95389e40a6a0b4fe3b93b21596ebdfc300688c1ddc58f0300767886ce9f40be54149c40ad352583d37f45412af3833347f1056f684426e0ec70cc45fe71740d915657a9"}}, &(0x7f0000000a40)={0x0, 0x3, 0x8a, @string={0x8a, 0x3, "d5065830fbb09fd4fedfd873867d733accd14c2289013893cea7aa441255fc8077b77c8a9e786f6ecc5276786405d25cb242d255a9303d5c2ad830eacd1d425bcaf2ac159f17cce0141ec5e14f0eac6b58731f4b07b647d0e7d8e316bb1991307cb6a237553fd5b6d3e97f4fad73484a158428d88d71a918a39edc38c0b96625c736e6e6c839b99b"}}, &(0x7f0000000080)={0x0, 0xf, 0x12, {0x5, 0xf, 0x12, 0x2, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x1, 0x4, 0x3, 0x3}]}}, &(0x7f00000001c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7, 0x2, 0xfe, 0x3, "779c9a9d", "5bc8cf47"}}, &(0x7f0000000200)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x81, 0x8, 0x9, 0x5, 0x15, 0x7, 0x10}}}, &(0x7f0000000780)={0x84, &(0x7f00000002c0)={0x20, 0x9, 0xa7, "9df592292ce4095676f647cd88b467b822d963381d8c389a1165e8198e2576189ae23ce93e50401d2f90cfd30c8944d079271e35c1cebeb0a611ab7963a44b6daaa48d0560bb61095bbfdb805c1aafc1b388c4f2e929ac5c981f182785fc73f6608c0a20aeffd51ec5c43777617269480ee0b8f42e6195c0683fc42c7799e80a28561c2ebde6b272eaa3e56410a78a67093dfb256a990ed5aaec231e322b2786106e0bd1e9dc92"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0xef}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f00000000c0)=ANY=[@ANYBLOB="9d9bc2c8720f0fa37d200004000000200120007af15cd91c05c6357cb70ca451f008da3f840a09b5c01b65f963615f8ff68d2a820ee1c2787cac43e64459"], &(0x7f00000004c0)={0x40, 0x7, 0x2, 0x4}, &(0x7f0000000500)={0x40, 0x9, 0x1, 0xb}, &(0x7f0000000540)={0x40, 0xb, 0x2, "9f87"}, &(0x7f0000000580)={0x40, 0xf, 0x2, 0xc}, &(0x7f00000005c0)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}}, &(0x7f0000000600)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000640)={0x40, 0x19, 0x2, "1b07"}, &(0x7f0000000680)={0x40, 0x1a, 0x2, 0xb72d}, &(0x7f00000006c0)={0x40, 0x1c, 0x1, 0x6}, 0x0, &(0x7f0000000740)={0x40, 0x21, 0x1, 0x10}}) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r5, 0x65, 0x2, &(0x7f0000000840)=0x100, 0x4) 5.293246168s ago: executing program 4 (id=3269): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) unshare(0x400) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x34, &(0x7f00000000c0), 0x4) 5.1262779s ago: executing program 4 (id=3270): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) chdir(0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0x10, 0x2, 0x10) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = syz_io_uring_setup(0x5c2, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x3, 0x348}, &(0x7f0000000480)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000004c0)=@IORING_OP_TIMEOUT={0xb, 0x18, 0x0, 0x0, 0x4, &(0x7f0000000280)={0x0, 0x989680}, 0x1, 0x40, 0x1}) io_uring_enter(r2, 0x6e2, 0x3900, 0x1, 0x0, 0xe00) rt_sigsuspend(&(0x7f00000002c0), 0x8) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000a80)='/proc/meminfo\x00', 0x0, 0x0) preadv(r5, &(0x7f0000000100)=[{&(0x7f0000000000)=""/221, 0x34b}], 0x1, 0x1c0, 0x0) 4.570743008s ago: executing program 2 (id=3274): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) socket$kcm(0x10, 0x2, 0x4) socket$netlink(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0xfc}}, 0x0) socket(0xa, 0x3, 0x87) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n'], 0x54}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 4.542015308s ago: executing program 6 (id=3275): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) msgsnd(0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) syz_open_dev$sndctrl(0x0, 0x8, 0x800) preadv2(r2, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x100000}], 0xc4, 0x0, 0x0, 0x9) r3 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x4008000, &(0x7f0000000280)={0xa, 0x4e1f, 0x80000, @loopback, 0x7}, 0x1c) sendto$inet6(r3, &(0x7f00000009c0), 0x0, 0xc001, 0x0, 0x0) setsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet6_udp_int(r3, 0x11, 0x1, &(0x7f0000000080), 0x4) 4.342763551s ago: executing program 2 (id=3276): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c0000001000010827bd70000000000000000000", @ANYRES32=r2, @ANYBLOB="00000000000000001c002b80080003"], 0x3c}}, 0x0) 4.232863672s ago: executing program 6 (id=3277): openat$dir(0xffffffffffffff9c, 0x0, 0x2, 0x40) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10) io_uring_setup(0x4edd, 0x0) r4 = socket$caif_stream(0x25, 0x1, 0x5) recvmmsg(r4, &(0x7f0000006980)=[{{&(0x7f0000000240)=@nfc_llcp, 0x80, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)=""/224, 0xe0}, 0x7}, {{0x0, 0x0, &(0x7f0000000900)=[{0x0}, {0x0}, {&(0x7f0000000640)=""/72, 0x48}, {&(0x7f00000006c0)=""/47, 0x2f}, {&(0x7f0000000700)=""/207, 0xcf}], 0x5}, 0x9cd0}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000d80)=""/228, 0xe4}, 0x2}, {{0x0, 0x0, &(0x7f0000001000)=[{0x0}], 0x1}, 0x1}, {{0x0, 0x0, 0x0}, 0x80}, {{&(0x7f0000003840)=@llc, 0x80, 0x0, 0x0, &(0x7f0000004d00)=""/164, 0xa4}, 0x18}, {{&(0x7f0000004dc0)=@llc, 0x80, &(0x7f0000006340)=[{0x0}, {&(0x7f0000004f00)=""/226, 0xe2}, {&(0x7f0000005000)=""/147, 0x93}, {&(0x7f00000050c0)=""/183, 0xb7}, {0x0}, {&(0x7f0000005340)=""/4096, 0x1000}], 0x6}, 0x2}, {{0x0, 0x0, 0x0}, 0x5}, {{&(0x7f00000067c0)=@ethernet={0x0, @local}, 0x80, 0x0, 0x0, &(0x7f0000006900)=""/117, 0x75}, 0x3}], 0x9, 0x2, 0x0) 4.196805533s ago: executing program 2 (id=3278): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x20943, 0x0) writev(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_dev$dri(0x0, 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x400001) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f0000000340)={r5, 0x0, 0x0, 0x0, 0x1, [0x0], [0x9c, 0x7], [0x0, 0x1080, 0x2], [0x0, 0x0, 0x1, 0xfffffffffffff001]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f0000000080)={r6}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000300)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800faa62e58b633151ac12275ba584db6a334fb000000000000"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x18) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r9 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0x129340, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r9, 0xc0184800, &(0x7f0000000100)={0x7fff, r8}) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000240), 0x200800, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, &(0x7f0000000040)=0x1) 4.159158594s ago: executing program 4 (id=3279): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_init(0x8, 0x80000) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0x20ff, 0x5, 0x89, 0xd615, 0x9, 0x7fffffff, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x13}}}, 0xa0) sendfile(r1, r1, &(0x7f0000000080), 0x7f03) 3.571908291s ago: executing program 1 (id=3280): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c000000020603000000000000800000000000000500"], 0x5c}}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000740)=ANY=[@ANYBLOB="44000000090605000000000000000000010000050900020073797a30000006000500010007000000080009400000000114000880100007800a001100b4"], 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) 3.021695329s ago: executing program 6 (id=3281): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)={0x5c, 0x2, 0x6, 0x5, 0xa, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6}, @IPSET_ATTR_PORT_TO={0x6}]}]}, 0x5c}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_io_uring_setup(0x109, &(0x7f0000000140)={0x0, 0x114df, 0x0, 0x2, 0x89}, &(0x7f00000003c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x29c780}) io_uring_enter(r4, 0x3516, 0xaddf, 0x2, 0x0, 0x1517f) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002440)=ANY=[@ANYBLOB="34000000090605000a00000000000000000000000900020073797a300000000005000100"], 0x34}}, 0x0) chdir(&(0x7f0000000080)='./cgroup\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x100) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x284182, 0x0) r8 = syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0xfad6}, &(0x7f0000000240), &(0x7f0000000280)) fcntl$lock(r8, 0x5, &(0x7f0000000000)={0x2, 0x4, 0x2, 0x10}) 2.795741542s ago: executing program 2 (id=3282): r0 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0xfffffffffffffe7d, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0xb, 'McE7'}]}}, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000007c0)=@newtaction={0x70, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8}, @TCA_SAMPLE_PARMS={0x18}, @TCA_SAMPLE_RATE={0x8}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x20774, 0x8000, 0x40, 0x0, 0x3, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x3, 0x0, 0x4, 0x6, 0x2, 0x0, 0x7fffffff], 0x80a0000}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f0000000140)=@ethtool_gfeatures}) ioctl$KVM_RUN(r2, 0xae80, 0x0) semctl$SETVAL(0x0, 0x1, 0x10, &(0x7f0000000000)=0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) 2.795199992s ago: executing program 4 (id=3283): socketpair(0x2a, 0x2, 0x1, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000003c0)=0x14) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x14) 2.597552364s ago: executing program 1 (id=3284): r0 = eventfd2(0x76, 0x1) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000180)={0x10000000}) write$eventfd(r0, &(0x7f0000000140)=0x8, 0x8) 2.304972319s ago: executing program 8 (id=3285): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x4008000, &(0x7f0000000280)={0xa, 0x4e1f, 0x80000, @loopback, 0x7}, 0x1c) sendto$inet6(r3, &(0x7f00000009c0)="c7cfcaaa22e10542fca5c0195350f15147657e0bfc59d383a47190db88690e6fedc3040ab5809ae02a54cd429cc3338c5afa0c9dce3f91950d1f567f358ac21154159130e88cbb6c43197813b2f23f3e442f80877490b393408142ebcfea6821f543e5ee9e27032e2b75d78f1b79f5a6bb6f0645e267770ef7e8f3a92148091217450ce8581e54223eeb6486205a209bf1fe854d211c03f8c3140fc3979d824082990d119473d20e94f253c9621fac339560ae46cb24b88bf2d01559bb658e343257b90f233b81bc5c398be3bbdd", 0xce, 0xc001, 0x0, 0x0) setsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet6_udp_int(r3, 0x11, 0x1, &(0x7f0000000080), 0x4) 2.070828922s ago: executing program 1 (id=3286): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) socket$kcm(0x10, 0x2, 0x4) socket$netlink(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0xfc}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n'], 0x54}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.070086312s ago: executing program 1 (id=3287): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) msgsnd(0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) syz_open_dev$sndctrl(0x0, 0x8, 0x800) preadv2(r2, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x100000}], 0xc4, 0x0, 0x0, 0x9) r3 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x4008000, &(0x7f0000000280)={0xa, 0x4e1f, 0x80000, @loopback, 0x7}, 0x1c) sendto$inet6(r3, &(0x7f00000009c0), 0x0, 0xc001, 0x0, 0x0) setsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet6_udp_int(r3, 0x11, 0x1, &(0x7f0000000080), 0x4) 1.757375246s ago: executing program 6 (id=3288): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000019100)={[&(0x7f0000000200)=' ']}) 1.756649316s ago: executing program 1 (id=3289): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) chdir(0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0x10, 0x2, 0x10) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = syz_io_uring_setup(0x5c2, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x3, 0x348}, &(0x7f0000000480)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000004c0)=@IORING_OP_TIMEOUT={0xb, 0x18, 0x0, 0x0, 0x4, &(0x7f0000000280)={0x0, 0x989680}, 0x1, 0x40, 0x1}) io_uring_enter(r2, 0x6e2, 0x3900, 0x1, 0x0, 0xe00) rt_sigsuspend(&(0x7f00000002c0), 0x8) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000a80)='/proc/meminfo\x00', 0x0, 0x0) preadv(r5, &(0x7f0000000100)=[{&(0x7f0000000000)=""/221, 0x34b}], 0x1, 0x1c0, 0x0) 1.715189466s ago: executing program 4 (id=3290): bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="000008000000810000", @ANYRES32=0x1, @ANYRES32, @ANYBLOB='\x00'/14], 0x50) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x4, @random="bb7fb37b9489", 'bond0\x00'}}, 0x1e) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prlimit64(0x0, 0x7, &(0x7f0000001040)={0x3, 0x10}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) 1.287212602s ago: executing program 2 (id=3291): openat$dir(0xffffffffffffff9c, 0x0, 0x2, 0x40) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10) io_uring_setup(0x4edd, 0x0) r4 = socket$caif_stream(0x25, 0x1, 0x5) recvmmsg(r4, &(0x7f0000006980)=[{{&(0x7f0000000240)=@nfc_llcp, 0x80, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)=""/224, 0xe0}, 0x7}, {{0x0, 0x0, &(0x7f0000000900)=[{0x0}, {0x0}, {&(0x7f0000000640)=""/72, 0x48}, {&(0x7f00000006c0)=""/47, 0x2f}, {&(0x7f0000000700)=""/207, 0xcf}], 0x5}, 0x9cd0}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000d80)=""/228, 0xe4}, 0x2}, {{0x0, 0x0, &(0x7f0000001000)=[{0x0}], 0x1}, 0x1}, {{0x0, 0x0, 0x0}, 0x80}, {{&(0x7f0000003840)=@llc, 0x80, 0x0, 0x0, &(0x7f0000004d00)=""/164, 0xa4}, 0x18}, {{&(0x7f0000004dc0)=@llc, 0x80, &(0x7f0000006340)=[{0x0}, {&(0x7f0000004f00)=""/226, 0xe2}, {&(0x7f0000005000)=""/147, 0x93}, {&(0x7f00000050c0)=""/183, 0xb7}, {0x0}, {&(0x7f0000005340)=""/4096, 0x1000}], 0x6}, 0x2}, {{0x0, 0x0, 0x0}, 0x5}, {{&(0x7f00000067c0)=@ethernet={0x0, @local}, 0x80, 0x0, 0x0, &(0x7f0000006900)=""/117, 0x75}, 0x3}], 0x9, 0x2, 0x0) 1.274413513s ago: executing program 6 (id=3292): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) syz_io_uring_setup(0x834, &(0x7f0000000180)={0x0, 0x679a, 0x400, 0x6, 0x3cc}, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r5 = socket$inet_sctp(0x2, 0x1, 0x84) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r5, 0x80, &(0x7f00000000c0)=@nl=@proc={0x10, 0x0, 0x25dfdbfe, 0x4090000}}) socket$inet6(0xa, 0x800000000000002, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) r7 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') read$char_usb(r7, &(0x7f0000000240)=""/36, 0x24) setsockopt$inet6_IPV6_RTHDRDSTOPTS(0xffffffffffffffff, 0x29, 0x37, &(0x7f0000000080)=ANY=[], 0x8) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x40) ptrace(0x10, r8) ptrace$setsig(0x4203, r8, 0x2, &(0x7f0000000040)={0x15, 0xa, 0x1e0000}) fsetxattr$security_capability(r5, &(0x7f0000000040), &(0x7f0000000200)=@v2={0x2000000, [{0x8, 0x1}, {0x7, 0x80}]}, 0x14, 0x2) setsockopt$sock_timeval(r2, 0x1, 0x42, &(0x7f0000000200)={0x0, 0xea60}, 0x10) getsockopt$sock_timeval(r2, 0x1, 0x14, 0x0, &(0x7f00000000c0)) socket(0x1, 0x803, 0x5bd) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0x3}]}, 0x3c}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xc4, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@private0, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0xfffffffffffffffc}, {0x0, 0xacb0, 0x80000000000000}, 0x400}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xc4}}, 0x4c050) 167.434848ms ago: executing program 4 (id=3293): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x170}}, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) connect$rose(r1, &(0x7f00000001c0)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, 0x0, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}, 0x40) 95.136399ms ago: executing program 2 (id=3294): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_init(0x8, 0x80000) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0x20ff, 0x5, 0x89, 0xd615, 0x9, 0x7fffffff, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x13}}}, 0xa0) sendfile(r1, r1, &(0x7f0000000080), 0x7f03) 16.52514ms ago: executing program 1 (id=3295): r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000200)=""/55, 0x37) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0xc, &(0x7f0000000900)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @void, @value}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x1e, 0x4, 0x0) socket(0x1e, 0x4, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) dup(r1) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x453, 0x20, 0x70bd2b, 0x25dfdbfb, '\x00'}, 0x14}, 0x1, 0x0, 0x0, 0x4008140}, 0x880) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000006c0)={0x0, 0x0, 0x42, {0x0, 0x1}, {0x47, 0xfffe}, @cond=[{0x84, 0x3ff, 0x4404, 0x4, 0x1, 0xd}, {0x0, 0xa0, 0x1, 0x5, 0x800, 0xff01}]}) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x12d8) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x8, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) getdents64(r0, 0xfffffffffffffffe, 0x29) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1038, 0x12b6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000d40), 0x2, 0x0) ioctl$FITRIM(r4, 0xc0185879, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, &(0x7f0000000240)={0x14, &(0x7f0000000880)={0x40, 0x9, 0x28, {0x28, 0xf, "89b81875976ef7a158973dbdb2b94a34cf8d3d2a8d1c2a6007477812017cf3ee3095a28de547"}}, 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000280)={0x2c, &(0x7f0000000100)={0x40, 0xa, 0xb5, {0xb5, 0x22, "cac6988edb48fb4751f6c6b498b0fd17252a61b34cd81ee6ec7f9a0303cbc33d87146694540db9f3d76b52f797032c17c0b457421d49f69d74dd2f77e4c56a42fea21abd340fcf92230e7cd89240a02ca76924b6c683cb5b4866b0219bf6b730c77e664c22752fdc80a2ab821f408ec95389e40a6a0b4fe3b93b21596ebdfc300688c1ddc58f0300767886ce9f40be54149c40ad352583d37f45412af3833347f1056f684426e0ec70cc45fe71740d915657a9"}}, &(0x7f0000000a40)={0x0, 0x3, 0x8a, @string={0x8a, 0x3, "d5065830fbb09fd4fedfd873867d733accd14c2289013893cea7aa441255fc8077b77c8a9e786f6ecc5276786405d25cb242d255a9303d5c2ad830eacd1d425bcaf2ac159f17cce0141ec5e14f0eac6b58731f4b07b647d0e7d8e316bb1991307cb6a237553fd5b6d3e97f4fad73484a158428d88d71a918a39edc38c0b96625c736e6e6c839b99b"}}, &(0x7f0000000080)={0x0, 0xf, 0x12, {0x5, 0xf, 0x12, 0x2, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x1, 0x4, 0x3, 0x3}]}}, &(0x7f00000001c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7, 0x2, 0xfe, 0x3, "779c9a9d", "5bc8cf47"}}, &(0x7f0000000200)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x81, 0x8, 0x9, 0x5, 0x15, 0x7, 0x10}}}, &(0x7f0000000780)={0x84, &(0x7f00000002c0)={0x20, 0x9, 0xa7, "9df592292ce4095676f647cd88b467b822d963381d8c389a1165e8198e2576189ae23ce93e50401d2f90cfd30c8944d079271e35c1cebeb0a611ab7963a44b6daaa48d0560bb61095bbfdb805c1aafc1b388c4f2e929ac5c981f182785fc73f6608c0a20aeffd51ec5c43777617269480ee0b8f42e6195c0683fc42c7799e80a28561c2ebde6b272eaa3e56410a78a67093dfb256a990ed5aaec231e322b2786106e0bd1e9dc92"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0xef}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f00000000c0)=ANY=[@ANYBLOB="9d9bc2c8720f0fa37d200004000000200120007af15cd91c05c6357cb70ca451f008da3f840a09b5c01b65f963615f8ff68d2a820ee1c2787cac43e64459"], &(0x7f00000004c0)={0x40, 0x7, 0x2, 0x4}, &(0x7f0000000500)={0x40, 0x9, 0x1, 0xb}, &(0x7f0000000540)={0x40, 0xb, 0x2, "9f87"}, &(0x7f0000000580)={0x40, 0xf, 0x2, 0xc}, &(0x7f00000005c0)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}}, &(0x7f0000000600)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000640)={0x40, 0x19, 0x2, "1b07"}, &(0x7f0000000680)={0x40, 0x1a, 0x2, 0xb72d}, &(0x7f00000006c0)={0x40, 0x1c, 0x1, 0x6}, &(0x7f0000000700)={0x40, 0x1e, 0x1}, 0x0}) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r5, 0x65, 0x2, &(0x7f0000000840)=0x100, 0x4) 0s ago: executing program 6 (id=3296): ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200], 0x1}}}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000000)={'ipvlan1\x00', {0x2, 0x0, @broadcast=0xac141436}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000440)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-generic\x00'}, 0x58) r6 = accept$alg(r5, 0x0, 0x0) r7 = dup(r6) r8 = open(&(0x7f0000000000)='./file1\x00', 0x10f0c2, 0x0) ftruncate(r8, 0x200004) sendfile(r7, r8, 0x0, 0x80001d00c0d1) ioctl$VIDIOC_QBUF(r0, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "8000"}, 0x0, 0x2, {}, 0x20800}) kernel console output (not intermixed with test programs): uid=0 gid=0 ses=4294967295 subj=unconfined pid=11942 comm="syz.6.2005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 864.911806][ T26] audit: type=1326 audit(1747462843.848:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11942 comm="syz.6.2005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 868.146695][T11969] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2012'. [ 871.115786][T12013] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2024'. [ 872.574614][T12039] block nbd2: shutting down sockets [ 875.516801][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 875.524819][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 875.570405][T12071] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2039'. [ 876.379267][ T26] audit: type=1326 audit(1747462855.678:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12076 comm="syz.5.2044" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f41c98ba969 code=0x0 [ 877.149926][ T26] audit: type=1326 audit(1747462856.438:391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12103 comm="syz.3.2053" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b1e063969 code=0x7ffc0000 [ 877.981013][ T4222] af_packet: tpacket_rcv: packet too big, clamped from 80 to 4294967272. macoff=96 [ 878.376776][T12116] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2054'. [ 879.142022][ T26] audit: type=1326 audit(1747462856.508:392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12103 comm="syz.3.2053" exe="/root/syz-executor" sig=0 arch=c000003e syscall=206 compat=0 ip=0x7f9b1e063969 code=0x7ffc0000 [ 879.165195][ T26] audit: type=1326 audit(1747462856.508:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12103 comm="syz.3.2053" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b1e063969 code=0x7ffc0000 [ 879.188826][ T26] audit: type=1326 audit(1747462857.248:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12103 comm="syz.3.2053" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f9b1e063969 code=0x7ffc0000 [ 881.171822][T12145] overlayfs: failed to clone upperpath [ 883.262370][ T13] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 884.202338][ T13] usb 7-1: Using ep0 maxpacket: 8 [ 884.482322][ T13] usb 7-1: unable to get BOS descriptor or descriptor too short [ 884.863874][T12182] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 884.872948][T12182] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 884.882945][T12182] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 884.892227][T12182] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 884.911607][T12182] device geneve2 entered promiscuous mode [ 885.212489][ T13] usb 7-1: config 8 interface 0 altsetting 7 bulk endpoint 0x3 has invalid maxpacket 8 [ 885.233360][T12185] autofs4:pid:12185:autofs_fill_super: called with bogus options [ 885.242523][ T13] usb 7-1: config 8 interface 0 has no altsetting 0 [ 885.412658][ T13] usb 7-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 885.436034][ T13] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 885.528868][T12189] overlayfs: failed to clone upperpath [ 886.162457][ T13] usb 7-1: Product: syz [ 886.240385][ T13] usb 7-1: Manufacturer: syz [ 886.249552][ T13] usb 7-1: SerialNumber: syz [ 886.287946][ T13] usb 7-1: can't set config #8, error -71 [ 886.685472][ T13] usb 7-1: USB disconnect, device number 10 [ 888.235835][T12211] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2085'. [ 890.957945][T12219] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 894.090529][ T9] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 898.043807][ T263] block nbd6: Attempted send on invalid socket [ 898.050203][ T263] blk_update_request: I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 898.064969][T12297] SQUASHFS error: Failed to read block 0x0: -5 [ 898.071216][T12297] unable to read squashfs_super_block [ 900.429562][T12340] autofs4:pid:12340:autofs_fill_super: called with bogus options [ 902.972439][T12362] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2128'. [ 904.768484][T12374] overlayfs: failed to clone upperpath [ 907.512371][T12398] autofs4:pid:12398:autofs_fill_super: called with bogus options [ 908.384771][T12409] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2142'. [ 909.294936][T12410] overlayfs: unrecognized mount option "verity=on" or missing value [ 912.201585][T12444] hub 8-0:1.0: USB hub found [ 912.201725][T12444] hub 8-0:1.0: 1 port detected [ 912.651679][T12450] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2154'. [ 913.215177][T12461] tmpfs: Unknown parameter 'mp' [ 914.662997][T12470] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 918.851867][T12523] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2171'. [ 919.445744][T12536] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2180'. [ 919.490354][T12536] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2180'. [ 919.512398][T12536] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2180'. [ 919.592431][ T4292] Bluetooth: hci5: command 0x0405 tx timeout [ 923.188080][ T26] audit: type=1326 audit(1747462902.478:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12557 comm="syz.6.2188" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68fc2f4969 code=0x7fc00000 [ 924.319181][T12584] device wireguard0 entered promiscuous mode [ 925.467710][T12593] netlink: 'syz.5.2201': attribute type 10 has an invalid length. [ 925.544029][T12593] team0: Device hsr_slave_0 failed to register rx_handler [ 926.269853][T12607] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2203'. [ 927.921433][T10255] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 928.363185][T12624] tmpfs: Bad value for 'mpol' [ 929.496962][ T13] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 929.962382][ T13] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 930.712375][ T13] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 930.721515][ T13] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 931.533194][ T13] usb 2-1: config 0 interface 0 has no altsetting 0 [ 931.752327][ T13] usb 2-1: unable to read config index 1 descriptor/start: -71 [ 931.759931][ T13] usb 2-1: can't read configurations, error -71 [ 933.213438][T12683] tmpfs: Bad value for 'mpol' [ 936.966132][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 936.972708][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 940.818669][T12735] tmpfs: Bad value for 'mpol' [ 941.790771][T12748] CIFS: Unable to determine destination address [ 948.089338][T12784] tmpfs: Bad value for 'mpol' [ 949.505266][T12802] CIFS: Unable to determine destination address [ 949.913213][ T26] audit: type=1326 audit(1747462929.198:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12800 comm="syz.6.2260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 950.180385][ T26] audit: type=1326 audit(1747462929.268:397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12800 comm="syz.6.2260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 950.215282][T12805] xt_socket: unknown flags 0x8 [ 950.234007][ T26] audit: type=1326 audit(1747462929.428:398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12800 comm="syz.6.2260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 950.262665][T12805] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2261'. [ 950.288389][ T26] audit: type=1326 audit(1747462929.428:399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12800 comm="syz.6.2260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 950.323322][T12811] IPVS: length: 135 != 24 [ 950.459583][ T26] audit: type=1326 audit(1747462929.428:400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12800 comm="syz.6.2260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 951.037224][ T26] audit: type=1326 audit(1747462929.428:401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12800 comm="syz.6.2260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 951.742232][ T26] audit: type=1326 audit(1747462929.428:402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12800 comm="syz.6.2260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 951.772756][T12825] tmpfs: Bad value for 'mpol' [ 951.824699][ T26] audit: type=1326 audit(1747462929.428:403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12800 comm="syz.6.2260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 951.848368][ T26] audit: type=1326 audit(1747462929.428:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12800 comm="syz.6.2260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 952.016024][T12832] xt_ecn: cannot match TCP bits for non-tcp packets [ 952.172668][ T26] audit: type=1326 audit(1747462929.428:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12800 comm="syz.6.2260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f68fc2f4969 code=0x7ffc0000 [ 952.899153][ T150] block nbd6: Attempted send on invalid socket [ 952.908159][ T150] blk_update_request: I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 952.922182][T12840] SQUASHFS error: Failed to read block 0x0: -5 [ 952.933154][T12840] unable to read squashfs_super_block [ 953.452733][T12853] xt_socket: unknown flags 0x8 [ 953.470732][T12853] netlink: 56 bytes leftover after parsing attributes in process `syz.6.2276'. [ 953.513909][T12853] IPVS: length: 135 != 24 [ 954.152490][T10255] wlan1: Trigger new scan to find an IBSS to join [ 955.239725][T12843] bridge0: port 2(bridge_slave_1) entered disabled state [ 955.247083][T12843] bridge0: port 1(bridge_slave_0) entered disabled state [ 956.209624][T12843] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 956.335017][T12843] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 957.042756][T12843] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 957.051799][T12843] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 957.061555][T12843] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 957.071263][T12843] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 957.127024][ T4982] Bluetooth: hci2: command 0x0409 tx timeout [ 957.813704][T12878] overlayfs: bad index found (index=index/00fb210001d7a1c58b2d764c84b57e846543c61ef1ca38de8c140a000000000000, ftype=2000, origin ftype=8000). [ 959.192295][ T23] Bluetooth: hci2: command 0x041b tx timeout [ 959.981555][T10255] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 961.749694][T10255] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 961.842618][T12864] chnl_net:caif_netlink_parms(): no params data found [ 961.998259][T10255] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 962.962505][ T21] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 963.212511][ T21] usb 3-1: Using ep0 maxpacket: 16 [ 963.273175][T10255] bond1: (slave vlan2): Releasing active interface [ 963.332848][T12916] xt_socket: unknown flags 0x8 [ 963.337947][ T21] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 963.349252][T10255] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 963.364346][ T21] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 963.365833][T12916] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2293'. [ 963.374789][ T21] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 963.392635][ T21] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 963.401074][T12864] bridge0: port 1(bridge_slave_0) entered blocking state [ 963.416743][ T21] usb 3-1: config 0 descriptor?? [ 963.421995][T12864] bridge0: port 1(bridge_slave_0) entered disabled state [ 963.431077][T12864] device bridge_slave_0 entered promiscuous mode [ 963.443948][T12916] IPVS: length: 135 != 24 [ 963.451584][T12864] bridge0: port 2(bridge_slave_1) entered blocking state [ 963.499939][T12864] bridge0: port 2(bridge_slave_1) entered disabled state [ 963.515634][T12864] device bridge_slave_1 entered promiscuous mode [ 963.596366][T12864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 963.617981][T12864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 963.676908][ T4982] Bluetooth: hci2: command 0x040f tx timeout [ 964.297242][ T21] corsair 0003:1B1C:1B02.000A: hidraw0: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.2-1/input0 [ 964.356380][ T21] corsair 0003:1B1C:1B02.000A: Failed to get K90 initial state (error -71). [ 964.374669][T12864] team0: Port device team_slave_0 added [ 964.429033][T12864] team0: Port device team_slave_1 added [ 964.432406][ T21] usb 3-1: USB disconnect, device number 24 [ 964.569947][T12864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 964.582737][T12864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 964.601738][T12929] fido_id[12929]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 964.670524][T12864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 964.773677][T12864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 964.790895][T12864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 964.843958][T12864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 966.163445][ T21] Bluetooth: hci2: command 0x0419 tx timeout [ 966.491419][T12864] device hsr_slave_0 entered promiscuous mode [ 966.509218][T12864] device hsr_slave_1 entered promiscuous mode [ 966.525637][T12864] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 966.533475][T12864] Cannot create hsr debugfs directory [ 968.363576][T12864] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 968.441331][T12864] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 968.488145][T12864] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 969.195266][T12864] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 969.566562][T12864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 970.031680][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 970.063102][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 970.107349][T12864] 8021q: adding VLAN 0 to HW filter on device team0 [ 970.187730][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 970.207405][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 970.262826][ T5320] bridge0: port 1(bridge_slave_0) entered blocking state [ 970.269969][ T5320] bridge0: port 1(bridge_slave_0) entered forwarding state [ 970.303315][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 970.356611][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 970.373516][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 970.402890][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 970.409997][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 970.496063][T10255] device hsr_slave_0 left promiscuous mode [ 970.512722][T10255] device hsr_slave_1 left promiscuous mode [ 970.529073][T10255] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 970.556988][T10255] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 970.593315][T10255] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 970.615811][T10255] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 970.811685][T10255] device veth1_macvtap left promiscuous mode [ 970.821377][T10255] device veth0_macvtap left promiscuous mode [ 970.846921][T10255] device veth1_vlan left promiscuous mode [ 970.874329][T10255] device veth0_vlan left promiscuous mode [ 971.081581][T10255] bond1 (unregistering): Released all slaves [ 971.261493][T10255] team0 (unregistering): Port device team_slave_1 removed [ 971.278822][T10255] team0 (unregistering): Port device team_slave_0 removed [ 971.294919][T10255] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 971.331685][T10255] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 971.427312][T10255] bond0 (unregistering): Released all slaves [ 971.533227][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 971.559618][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 971.612736][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 971.635968][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 971.653009][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 971.672264][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 971.691926][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 971.713658][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 971.726961][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 971.755852][T12864] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 971.822933][T12864] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 972.172092][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 972.226944][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 975.651499][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 975.662501][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 975.684858][T12864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 976.329070][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 976.357738][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 976.447713][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 976.464003][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 976.478104][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 976.486783][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 976.507064][T12864] device veth0_vlan entered promiscuous mode [ 976.584760][T12864] device veth1_vlan entered promiscuous mode [ 976.616550][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 976.659797][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 976.708042][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 976.766360][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 976.964392][T12864] device veth0_macvtap entered promiscuous mode [ 977.312552][T12864] device veth1_macvtap entered promiscuous mode [ 977.590758][T12864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 977.839718][T12864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 977.910931][T12864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 978.152972][T12864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 978.194309][T12864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 978.202926][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 978.224316][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 978.265623][T12864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 978.332193][T12864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 978.538477][T12864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 978.577859][T12864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 978.656399][T12864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 979.183327][T12864] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 979.327328][T12864] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 979.336159][T12864] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 979.344923][T12864] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 979.357661][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 979.369136][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 980.455277][ T5350] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 980.488420][ T5350] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 980.521856][ T5350] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 980.522702][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 980.562736][ T5350] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 980.593168][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 984.810252][ T4219] Bluetooth: hci2: command 0x0405 tx timeout [ 985.407606][T13198] block nbd7: shutting down sockets [ 986.753989][T13173] chnl_net:caif_netlink_parms(): no params data found [ 987.033370][ T4219] Bluetooth: hci4: command 0x0409 tx timeout [ 988.106788][ T4219] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 988.217132][ T4219] hid-generic 0000:0000:0000.000B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 988.336722][T13173] bridge0: port 1(bridge_slave_0) entered blocking state [ 988.392840][T13173] bridge0: port 1(bridge_slave_0) entered disabled state [ 988.422449][T13173] device bridge_slave_0 entered promiscuous mode [ 988.482682][T13173] bridge0: port 2(bridge_slave_1) entered blocking state [ 988.489778][T13173] bridge0: port 2(bridge_slave_1) entered disabled state [ 988.757676][T13253] blk_update_request: I/O error, dev loop15, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 988.770141][T13253] F2FS-fs (loop15): Unable to read 1th superblock [ 988.780000][T13253] blk_update_request: I/O error, dev loop15, sector 8 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 988.791896][T13253] F2FS-fs (loop15): Unable to read 2th superblock [ 988.903714][T13173] device bridge_slave_1 entered promiscuous mode [ 989.637042][ T4217] Bluetooth: hci4: command 0x041b tx timeout [ 989.952804][T13173] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 990.105101][T13173] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 990.251736][T13173] team0: Port device team_slave_0 added [ 990.295482][T13173] team0: Port device team_slave_1 added [ 990.449262][T13173] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 990.491356][T13173] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 990.681946][T13173] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 990.783105][T13173] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 990.795246][T13173] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 990.969226][T13173] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 991.971911][T13173] device hsr_slave_0 entered promiscuous mode [ 992.085940][ T13] Bluetooth: hci4: command 0x040f tx timeout [ 992.121911][T13173] device hsr_slave_1 entered promiscuous mode [ 992.356212][T13173] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 992.376359][T13173] Cannot create hsr debugfs directory [ 992.962819][T13293] cgroup2: Unknown parameter 'pids_localevents' [ 994.820398][ T4219] Bluetooth: hci4: command 0x0419 tx timeout [ 995.140436][T12971] bond0: (slave syz_tun): Releasing backup interface [ 996.689048][T13173] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 996.783883][T13173] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 997.093037][T13173] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 997.267530][T13173] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 997.974193][T13173] 8021q: adding VLAN 0 to HW filter on device bond0 [ 998.017296][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 998.043297][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 998.067658][T13173] 8021q: adding VLAN 0 to HW filter on device team0 [ 998.099076][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 998.112065][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 998.131206][T10255] bridge0: port 1(bridge_slave_0) entered blocking state [ 998.138353][T10255] bridge0: port 1(bridge_slave_0) entered forwarding state [ 998.212872][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 998.248287][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 998.267575][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 998.304338][ T4228] bridge0: port 2(bridge_slave_1) entered blocking state [ 998.311524][ T4228] bridge0: port 2(bridge_slave_1) entered forwarding state [ 998.339276][T13341] block nbd7: shutting down sockets [ 998.347567][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 998.396995][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 998.397027][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 998.412090][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 998.458730][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 998.481244][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 998.499826][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 998.519654][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 998.553068][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 998.587730][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 998.607301][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 998.628932][T13173] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 998.736464][T13173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 998.793201][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 999.062915][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1001.308951][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1001.361348][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1001.437826][T13173] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1001.736326][T13394] block nbd6: shutting down sockets [ 1002.729257][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1002.746939][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1004.404222][T13173] device veth0_vlan entered promiscuous mode [ 1004.421324][T13173] device veth1_vlan entered promiscuous mode [ 1004.433663][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1004.446942][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1004.633807][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1004.677611][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1004.929551][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1004.992795][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1005.052040][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1005.108282][T13173] device veth0_macvtap entered promiscuous mode [ 1005.131060][T13173] device veth1_macvtap entered promiscuous mode [ 1005.185127][T13173] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1005.293852][T13173] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1005.305093][T13173] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1005.454052][T13173] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1005.509502][T13173] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1005.520113][T13173] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1005.531527][T13173] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1005.541123][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1005.580124][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1005.643312][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1005.662721][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1005.709302][T13173] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1005.750386][T13173] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1005.781178][T13173] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1005.810942][T13173] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1005.842218][T13173] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1005.877712][T13173] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1005.912310][T13173] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1005.934274][ T5346] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1005.955939][ T5346] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1006.018526][T13173] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1006.057705][T13173] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1006.081232][T13173] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1006.116334][T13173] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1008.772360][ T5346] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1008.780656][ T5346] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1009.085430][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1009.117736][ T5350] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1009.140769][ T5350] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1009.165643][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1012.652302][ T4273] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 1013.822207][ T4273] usb 8-1: Using ep0 maxpacket: 16 [ 1014.232474][ T4273] usb 8-1: config 0 has an invalid descriptor of length 186, skipping remainder of the config [ 1014.287409][ T4273] usb 8-1: too many endpoints for config 0 interface 0 altsetting 0: 156, using maximum allowed: 30 [ 1014.347445][ T4273] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 156 [ 1015.562310][ T4273] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1015.571422][ T4273] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.386242][ T4273] usb 8-1: Product: syz [ 1016.392629][ T4273] usb 8-1: config 0 descriptor?? [ 1017.138155][ T4273] usb 8-1: can't set config #0, error -71 [ 1017.179757][ T4273] usb 8-1: USB disconnect, device number 2 [ 1019.579905][T13589] netlink: 'syz.8.2445': attribute type 1 has an invalid length. [ 1023.427341][T13624] Bluetooth: hci0: invalid length 0, exp 2 for type 1 [ 1025.035923][T13644] hub 8-0:1.0: USB hub found [ 1025.040803][T13644] hub 8-0:1.0: 1 port detected [ 1025.292051][T13632] device syzkaller0 entered promiscuous mode [ 1025.645847][T13655] mkiss: ax0: crc mode is auto. [ 1027.482224][ T21] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 1028.026685][ T21] usb 9-1: Using ep0 maxpacket: 16 [ 1028.371003][T13691] hub 8-0:1.0: USB hub found [ 1028.377180][T13691] hub 8-0:1.0: 1 port detected [ 1029.075888][ T21] usb 9-1: config 0 has an invalid descriptor of length 186, skipping remainder of the config [ 1029.113575][ T21] usb 9-1: too many endpoints for config 0 interface 0 altsetting 0: 156, using maximum allowed: 30 [ 1030.273203][ T21] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 156 [ 1030.342401][ T21] usb 9-1: string descriptor 0 read error: -71 [ 1030.349069][ T21] usb 9-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1030.369035][ T21] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1030.409438][ T21] usb 9-1: config 0 descriptor?? [ 1030.442361][ T21] usb 9-1: can't set config #0, error -71 [ 1030.458574][ T21] usb 9-1: USB disconnect, device number 2 [ 1030.673759][T13713] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1031.963833][T13738] hub 8-0:1.0: USB hub found [ 1031.968695][T13738] hub 8-0:1.0: 1 port detected [ 1032.228052][T13747] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1032.237184][T13747] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1035.713610][T13788] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1035.897052][T13805] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1035.906073][T13805] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1036.444252][T13799] block nbd1: shutting down sockets [ 1041.343076][T13847] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1041.560230][T13855] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1041.569310][T13855] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1042.159174][ T4188] block nbd2: Receive control failed (result -32) [ 1042.300300][T13857] block nbd2: shutting down sockets [ 1042.992216][ T23] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1044.182267][ T23] usb 3-1: Using ep0 maxpacket: 8 [ 1047.162351][ T23] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1047.170208][ T23] usb 3-1: can't read configurations, error -71 [ 1047.572456][T13913] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1048.269181][ T4188] block nbd2: Receive control failed (result -32) [ 1048.303134][T12925] block nbd2: shutting down sockets [ 1048.369818][T13935] xt_recent: hitcount (262144) is larger than allowed maximum (255) [ 1049.002209][ T21] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 1049.842453][ T21] usb 9-1: Using ep0 maxpacket: 8 [ 1049.992344][ T21] usb 9-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1050.011608][ T21] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1050.205530][ T21] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1050.233027][ T21] pvrusb2: ********** [ 1050.247612][T13973] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2543'. [ 1050.248964][ T21] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1050.268548][ T21] pvrusb2: Important functionality might not be entirely working. [ 1050.276671][ T21] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1050.288984][ T21] pvrusb2: ********** [ 1050.432914][ T2426] pvrusb2: Invalid write control endpoint [ 1050.706103][ T2426] pvrusb2: Invalid write control endpoint [ 1050.719214][ T2426] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1050.768084][ T2426] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1050.968286][T13982] hub 8-0:1.0: USB hub found [ 1050.973289][T13982] hub 8-0:1.0: 1 port detected [ 1051.126878][ T2426] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1051.171576][ T2426] pvrusb2: Device being rendered inoperable [ 1051.198218][ T2426] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1051.229933][ T2426] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_g) [ 1051.272512][T13950] udc-core: couldn't find an available UDC or it's busy [ 1051.280057][T13950] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1051.350500][T13950] udc-core: couldn't find an available UDC or it's busy [ 1051.358690][ T2426] pvrusb2: Attached sub-driver cx25840 [ 1051.378266][ T2426] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1051.382211][T13950] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1051.406878][T13950] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2538'. [ 1051.559002][ T2426] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1051.585830][T12620] usb 9-1: USB disconnect, device number 3 [ 1051.629471][T14005] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 1052.097165][T13990] block nbd7: shutting down sockets [ 1056.162583][ T4188] block nbd8: Receive control failed (result -32) [ 1056.174251][T14069] block nbd8: shutting down sockets [ 1056.334350][T14093] mkiss: ax0: crc mode is auto. [ 1056.349658][T14088] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2565'. [ 1056.612267][ T4273] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 1056.862436][ T4273] usb 3-1: Using ep0 maxpacket: 8 [ 1056.982472][ T4273] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1057.006537][ T4273] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1057.074785][ T4273] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1057.097669][ T4273] pvrusb2: ********** [ 1057.109722][ T4273] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1057.283077][ T4273] pvrusb2: Important functionality might not be entirely working. [ 1057.290957][ T4273] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1057.302588][ T4273] pvrusb2: ********** [ 1057.343493][ T2426] pvrusb2: Invalid write control endpoint [ 1058.099776][T14085] udc-core: couldn't find an available UDC or it's busy [ 1058.263963][T14085] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1058.330364][T14085] udc-core: couldn't find an available UDC or it's busy [ 1058.340556][T14085] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1058.666987][T14085] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2566'. [ 1058.749938][ T23] usb 3-1: USB disconnect, device number 27 [ 1058.773469][ T2426] pvrusb2: Invalid write control endpoint [ 1058.787658][ T2426] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1058.816268][ T2426] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1058.831596][ T2426] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1058.842409][ T2426] pvrusb2: Device being rendered inoperable [ 1058.848473][ T2426] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1058.861493][ T2426] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_h) [ 1058.897329][ T2426] pvrusb2: Attached sub-driver cx25840 [ 1058.904345][ T2426] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1058.934859][ T2426] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1059.536819][T14175] Invalid ELF header magic: != ELF [ 1059.835877][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 1059.844961][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 1059.971888][ T4188] block nbd1: Receive control failed (result -32) [ 1060.000268][T14152] block nbd1: shutting down sockets [ 1060.082239][ T26] kauditd_printk_skb: 1 callbacks suppressed [ 1060.082254][ T26] audit: type=1326 audit(1747463039.368:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14178 comm="syz.7.2583" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f948a704969 code=0x7ffc0000 [ 1060.354560][T14189] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2585'. [ 1060.413425][ T26] audit: type=1326 audit(1747463039.418:408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14178 comm="syz.7.2583" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f948a704969 code=0x7ffc0000 [ 1060.443403][T14186] xt_hashlimit: size too large, truncated to 1048576 [ 1060.452501][ T26] audit: type=1326 audit(1747463039.428:409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14178 comm="syz.7.2583" exe="/root/syz-executor" sig=0 arch=c000003e syscall=198 compat=0 ip=0x7f948a704969 code=0x7ffc0000 [ 1060.576516][T14189] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2585'. [ 1061.393105][ T26] audit: type=1326 audit(1747463039.428:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14178 comm="syz.7.2583" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f948a704969 code=0x7ffc0000 [ 1061.622271][ T26] audit: type=1326 audit(1747463039.428:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14178 comm="syz.7.2583" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f948a7032d0 code=0x7ffc0000 [ 1061.707219][T14200] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2588'. [ 1062.416436][ T26] audit: type=1326 audit(1747463039.428:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14178 comm="syz.7.2583" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f948a704969 code=0x7ffc0000 [ 1062.659430][ T26] audit: type=1326 audit(1747463039.428:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14178 comm="syz.7.2583" exe="/root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f948a704969 code=0x7ffc0000 [ 1062.681869][ C0] vkms_vblank_simulate: vblank timer overrun [ 1063.186785][ T26] audit: type=1326 audit(1747463039.428:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14178 comm="syz.7.2583" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f948a704969 code=0x7ffc0000 [ 1063.211293][ T26] audit: type=1326 audit(1747463039.428:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14178 comm="syz.7.2583" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f948a704969 code=0x7ffc0000 [ 1063.243184][ T26] audit: type=1326 audit(1747463039.428:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14178 comm="syz.7.2583" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f948a704969 code=0x7ffc0000 [ 1065.649524][ T4188] block nbd1: Receive control failed (result -32) [ 1065.672633][T14232] block nbd1: shutting down sockets [ 1069.974064][T14282] hub 8-0:1.0: USB hub found [ 1069.978914][T14282] hub 8-0:1.0: 1 port detected [ 1075.192561][ T4188] block nbd2: Receive control failed (result -32) [ 1075.199671][T14313] block nbd2: shutting down sockets [ 1075.707101][T14338] overlayfs: missing 'workdir' [ 1076.018602][T14342] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2624'. [ 1076.028044][T14342] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2624'. [ 1077.305712][ T4220] Bluetooth: hci2: command 0x0406 tx timeout [ 1077.732196][ T4220] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 1078.592203][ T4220] usb 3-1: Using ep0 maxpacket: 16 [ 1078.827188][ T4220] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1078.842515][ T4220] usb 3-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 1078.851721][ T4220] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1078.873526][ T4220] usb 3-1: config 0 descriptor?? [ 1079.369444][ T4220] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input24 [ 1079.392553][ T3533] bcm5974 3-1:0.0: could not read from device [ 1079.432843][ T4220] bcm5974 3-1:0.0: could not read from device [ 1079.492294][ T3533] bcm5974 3-1:0.0: could not read from device [ 1079.541879][ T4220] input: failed to attach handler mousedev to device input24, error: -5 [ 1079.592451][ T3533] bcm5974 3-1:0.0: could not read from device [ 1079.612393][ T3533] bcm5974 3-1:0.0: could not read from device [ 1079.623347][ T4220] usb 3-1: USB disconnect, device number 28 [ 1079.745408][T14364] chnl_net:caif_netlink_parms(): no params data found [ 1079.901664][T14364] bridge0: port 1(bridge_slave_0) entered blocking state [ 1079.909222][T14364] bridge0: port 1(bridge_slave_0) entered disabled state [ 1079.918121][T14364] device bridge_slave_0 entered promiscuous mode [ 1079.929950][T14364] bridge0: port 2(bridge_slave_1) entered blocking state [ 1079.937570][T14364] bridge0: port 2(bridge_slave_1) entered disabled state [ 1079.947547][T14364] device bridge_slave_1 entered promiscuous mode [ 1080.038080][T14364] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1080.123067][T14364] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1080.275771][ T4184] block nbd1: Receive control failed (result -32) [ 1080.282972][T14382] block nbd1: shutting down sockets [ 1080.388198][T14364] team0: Port device team_slave_0 added [ 1080.402377][ T4220] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 1080.626234][T14364] team0: Port device team_slave_1 added [ 1080.632587][ T4982] Bluetooth: hci5: command 0x0409 tx timeout [ 1081.446146][ T4220] usb 3-1: Using ep0 maxpacket: 8 [ 1081.458174][T14364] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1081.465968][T14364] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1081.511189][T14364] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1081.543348][T14364] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1081.560420][T14364] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1081.588531][ T4220] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1081.615514][T14364] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1081.628003][ T4220] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1081.668144][ T4228] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.699912][T14408] mkiss: ax0: crc mode is auto. [ 1081.705736][ T4220] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1081.751751][ T4220] pvrusb2: ********** [ 1081.763054][ T4220] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1081.800047][ T4220] pvrusb2: Important functionality might not be entirely working. [ 1081.817701][ T4220] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1081.841589][ T4220] pvrusb2: ********** [ 1081.870007][ T4228] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.902456][ T2426] pvrusb2: Invalid write control endpoint [ 1081.927252][T14364] device hsr_slave_0 entered promiscuous mode [ 1081.943631][T14364] device hsr_slave_1 entered promiscuous mode [ 1081.963594][T14364] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1081.978268][T14364] Cannot create hsr debugfs directory [ 1081.986594][ T2426] pvrusb2: Invalid write control endpoint [ 1082.003897][ T2426] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1082.015755][ T4228] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1082.037113][ T2426] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1082.172942][ T2426] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1082.184784][T14389] udc-core: couldn't find an available UDC or it's busy [ 1082.206625][T14389] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1082.215209][ T2426] pvrusb2: Device being rendered inoperable [ 1083.053031][T14389] udc-core: couldn't find an available UDC or it's busy [ 1083.071016][ T4222] Bluetooth: hci5: command 0x041b tx timeout [ 1083.102790][T14389] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1083.125145][ T2426] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1083.130509][T14389] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2634'. [ 1083.150301][ T2426] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_h) [ 1083.166446][ T21] usb 3-1: USB disconnect, device number 29 [ 1083.167309][ T4228] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1083.214160][ T2426] pvrusb2: Attached sub-driver cx25840 [ 1083.219729][ T2426] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1083.287616][ T2426] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1083.531680][T14364] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1083.573768][T14364] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1083.590051][T14364] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1083.612028][T14364] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1083.787305][T14364] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1083.834813][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1083.849157][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1083.883361][T14364] 8021q: adding VLAN 0 to HW filter on device team0 [ 1083.905445][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1083.920732][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1083.942995][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 1083.950177][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1083.976396][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1084.013203][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1084.027240][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1084.049686][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 1084.056886][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1084.091542][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1084.110725][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1084.188817][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1084.221470][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1084.232007][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1084.284148][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1084.323312][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1084.357214][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1084.373896][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1084.626157][T14467] overlayfs: failed to resolve './file0': -2 [ 1084.760770][T14464] netlink: 56 bytes leftover after parsing attributes in process `syz.8.2650'. [ 1085.197904][ T4222] Bluetooth: hci5: command 0x040f tx timeout [ 1085.343751][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1085.364789][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1085.373815][T14468] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2652'. [ 1085.548611][T14364] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1086.067504][T14482] xt_socket: unknown flags 0x8 [ 1086.132706][T14483] IPVS: length: 135 != 24 [ 1086.196559][ T4228] device hsr_slave_0 left promiscuous mode [ 1086.211295][ T4228] device hsr_slave_1 left promiscuous mode [ 1086.234958][ T4228] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1086.256435][ T4228] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1086.291427][ T4228] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1086.319008][ T4228] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1086.505112][ T4228] device bridge_slave_1 left promiscuous mode [ 1086.521083][ T4228] bridge0: port 2(bridge_slave_1) entered disabled state [ 1086.567345][ T4228] device bridge_slave_0 left promiscuous mode [ 1086.574844][ T4228] bridge0: port 1(bridge_slave_0) entered disabled state [ 1086.610079][ T4228] device veth1_macvtap left promiscuous mode [ 1086.620458][ T4228] device veth0_macvtap left promiscuous mode [ 1086.634898][ T4228] device veth1_vlan left promiscuous mode [ 1086.653543][ T4228] device veth0_vlan left promiscuous mode [ 1087.051232][ T4228] team0 (unregistering): Port device team_slave_1 removed [ 1087.071293][ T4228] team0 (unregistering): Port device team_slave_0 removed [ 1087.105816][ T4228] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1087.125073][ T4228] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1087.222806][ T4228] bond0 (unregistering): Released all slaves [ 1087.362234][T12620] Bluetooth: hci5: command 0x0419 tx timeout [ 1087.572958][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1087.581914][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1087.627737][T14364] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1088.435526][T14543] xt_socket: unknown flags 0x8 [ 1088.464284][T14543] IPVS: length: 135 != 24 [ 1089.263220][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1089.285856][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1089.428654][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1089.443971][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1089.463191][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1089.477942][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1089.496745][T14576] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1089.527053][T14364] device veth0_vlan entered promiscuous mode [ 1089.584333][T14364] device veth1_vlan entered promiscuous mode [ 1089.688645][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1089.709577][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1089.737806][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1089.768089][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1089.842833][T14585] mkiss: ax0: crc mode is auto. [ 1089.845788][T14364] device veth0_macvtap entered promiscuous mode [ 1089.910149][T14364] device veth1_macvtap entered promiscuous mode [ 1089.996553][T14364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1090.042795][T14364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1090.073444][T14364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1090.130384][T14364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1090.259352][T14364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1091.112570][T14364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1091.151301][T14364] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1091.201108][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1091.218371][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1091.235718][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1091.260055][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1091.309550][T14364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1091.353987][T14364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1091.384821][T14364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1091.418701][T14364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1091.448043][T14364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1091.483326][T14364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1091.526246][T14364] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1091.552347][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1091.568584][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1091.615584][T14364] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1091.635264][T14364] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1091.654923][T14364] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1091.674290][T14364] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1091.883038][ T4463] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1091.911258][ T4463] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1091.950769][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1092.014010][T14201] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1092.029908][T14613] netlink: 3 bytes leftover after parsing attributes in process `syz.6.2680'. [ 1092.039844][T14201] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1092.969897][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1093.333542][T14630] netlink: 20 bytes leftover after parsing attributes in process `syz.9.2619'. [ 1093.444947][T14633] erofs: (device nullb0): erofs_read_superblock: cannot find valid erofs superblock [ 1093.468423][T14633] usb usb8: usbfs: process 14633 (syz.1.2684) did not claim interface 0 before use [ 1094.502586][T14644] mkiss: ax0: crc mode is auto. [ 1095.497737][T14646] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1095.853149][T14663] xt_socket: unknown flags 0x8 [ 1095.867006][T14663] IPVS: length: 135 != 24 [ 1096.072203][ T4273] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1096.332253][ T4273] usb 3-1: Using ep0 maxpacket: 8 [ 1096.462266][ T4273] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1096.491424][ T4273] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1096.608245][ T4273] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1096.635789][ T4273] pvrusb2: ********** [ 1096.656047][ T4273] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1096.704300][ T4273] pvrusb2: Important functionality might not be entirely working. [ 1096.740736][ T4273] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1096.793280][ T4273] pvrusb2: ********** [ 1096.852576][ T2426] pvrusb2: Invalid write control endpoint [ 1096.973804][ T2426] pvrusb2: Invalid write control endpoint [ 1096.981896][ T2426] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1097.022465][ T2426] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1097.056840][T14657] udc-core: couldn't find an available UDC or it's busy [ 1097.067673][ T2426] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1097.092305][T14657] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1097.112652][T14657] udc-core: couldn't find an available UDC or it's busy [ 1097.114690][ T2426] pvrusb2: Device being rendered inoperable [ 1097.148433][T14657] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1097.152324][ T2426] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1097.194502][T14657] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2690'. [ 1097.216047][ T2426] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_h) [ 1097.240280][ T21] usb 3-1: USB disconnect, device number 30 [ 1097.270495][ T2426] pvrusb2: Attached sub-driver cx25840 [ 1097.300498][ T2426] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1097.346859][ T2426] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1099.663473][T14721] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1101.073877][T14746] fuse: Bad value for 'rootmode' [ 1101.104254][T14738] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1101.692178][ T4273] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 1102.002581][ T4273] usb 3-1: Using ep0 maxpacket: 8 [ 1102.305614][ T4273] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1102.339088][ T4273] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1102.472671][T14782] xt_socket: unknown flags 0x8 [ 1102.497126][T14775] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1102.636888][T14782] netlink: 56 bytes leftover after parsing attributes in process `syz.8.2721'. [ 1102.652155][ T4273] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1102.659222][ T4273] pvrusb2: ********** [ 1102.664610][T14782] IPVS: length: 135 != 24 [ 1102.674178][ T4273] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1103.388044][T14795] udc-core: couldn't find an available UDC or it's busy [ 1103.441112][ T4273] pvrusb2: Important functionality might not be entirely working. [ 1103.449153][ T4273] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1103.460544][ T4273] pvrusb2: ********** [ 1103.536935][T14795] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1103.557947][ T2426] pvrusb2: Invalid write control endpoint [ 1103.587354][T14793] udc-core: couldn't find an available UDC or it's busy [ 1103.602334][T14793] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1103.625262][T14793] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2712'. [ 1103.724441][ T2426] pvrusb2: Invalid write control endpoint [ 1103.732328][ T2426] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1103.882754][ T4273] usb 3-1: USB disconnect, device number 31 [ 1103.896160][ T2426] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1103.909783][ T2426] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1104.189743][ T2426] pvrusb2: Device being rendered inoperable [ 1104.209987][ T2426] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1104.235070][ T2426] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_h) [ 1104.273682][ T2426] pvrusb2: Attached sub-driver cx25840 [ 1104.296588][ T2426] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1104.406201][ T2426] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1104.854682][T14823] tipc: Started in network mode [ 1104.860495][T14823] tipc: Node identity 6a62d2ff3c47, cluster identity 4711 [ 1104.870041][T14823] tipc: Enabled bearer , priority 0 [ 1105.015219][T14826] fuse: Bad value for 'rootmode' [ 1105.262245][T14828] device syzkaller0 entered promiscuous mode [ 1105.395764][T14821] tipc: Resetting bearer [ 1105.483815][T14821] tipc: Disabling bearer [ 1106.697380][T14853] xt_socket: unknown flags 0x8 [ 1106.742271][T14853] netlink: 56 bytes leftover after parsing attributes in process `syz.6.2734'. [ 1106.885918][T14862] IPVS: length: 135 != 24 [ 1107.640643][T14865] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1108.582610][ T4222] Bluetooth: hci4: command 0x0406 tx timeout [ 1108.927458][T14890] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2743'. [ 1110.662999][T14915] fuse: Bad value for 'rootmode' [ 1110.763063][T14918] xt_socket: unknown flags 0x8 [ 1110.780600][T14918] netlink: 56 bytes leftover after parsing attributes in process `syz.6.2750'. [ 1110.806129][T14918] IPVS: length: 135 != 24 [ 1112.568134][T14950] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1112.638729][T14951] netlink: 'syz.1.2757': attribute type 1 has an invalid length. [ 1112.663771][T14952] mkiss: ax0: crc mode is auto. [ 1113.418281][T14973] xt_socket: unknown flags 0x8 [ 1113.437881][T14973] netlink: 56 bytes leftover after parsing attributes in process `syz.9.2761'. [ 1113.603251][T14978] IPVS: length: 135 != 24 [ 1115.600351][T15002] fuse: Bad value for 'rootmode' [ 1116.566934][T15020] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1117.550553][T15036] mkiss: ax0: crc mode is auto. [ 1117.648163][T15034] ALSA: mixer_oss: invalid OSS volume 'MONITO' [ 1119.934392][T15090] fuse: Bad value for 'rootmode' [ 1121.284191][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 1121.294048][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 1122.379668][T15139] mkiss: ax0: crc mode is auto. [ 1122.709387][T15149] xt_socket: unknown flags 0x8 [ 1122.754041][T15149] netlink: 56 bytes leftover after parsing attributes in process `syz.8.2797'. [ 1122.812416][T15152] IPVS: length: 135 != 24 [ 1123.545876][T15161] overlayfs: failed to resolve './file1': -2 [ 1126.962700][T15194] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1128.145188][T15205] xt_socket: unknown flags 0x8 [ 1128.171484][T15203] netlink: 56 bytes leftover after parsing attributes in process `syz.8.2810'. [ 1128.233415][T15205] IPVS: length: 135 != 24 [ 1128.761631][T15192] chnl_net:caif_netlink_parms(): no params data found [ 1128.968488][T12620] Bluetooth: hci2: command 0x0409 tx timeout [ 1130.043328][T15192] bridge0: port 1(bridge_slave_0) entered blocking state [ 1130.903400][T15192] bridge0: port 1(bridge_slave_0) entered disabled state [ 1130.911769][T15192] device bridge_slave_0 entered promiscuous mode [ 1130.921695][T15192] bridge0: port 2(bridge_slave_1) entered blocking state [ 1130.929179][T15192] bridge0: port 2(bridge_slave_1) entered disabled state [ 1130.937847][T15192] device bridge_slave_1 entered promiscuous mode [ 1131.104599][ T13] Bluetooth: hci2: command 0x041b tx timeout [ 1131.179519][T15192] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1131.242965][T15192] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1132.732655][T15192] team0: Port device team_slave_0 added [ 1133.112213][ T13] Bluetooth: hci2: command 0x040f tx timeout [ 1133.770241][T15192] team0: Port device team_slave_1 added [ 1134.115074][T15272] Failed to get privilege flags for destination (handle=0x2:0x7) [ 1135.034572][T15192] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1135.073877][T15192] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1135.104621][T15192] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1135.158967][T15192] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1135.191043][T15192] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1135.222401][ T13] Bluetooth: hci2: command 0x0419 tx timeout [ 1135.363745][T15192] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1136.141577][T15272] netlink: 'syz.9.2824': attribute type 1 has an invalid length. [ 1137.036254][T15192] device hsr_slave_0 entered promiscuous mode [ 1137.064603][T15192] device hsr_slave_1 entered promiscuous mode [ 1137.092263][T15192] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1137.109645][T15192] Cannot create hsr debugfs directory [ 1137.595056][T15303] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2833'. [ 1137.722419][T15304] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2832'. [ 1138.588686][T15192] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1138.670321][T15192] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1139.755717][T15192] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1139.766405][T15192] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1140.162279][ T2237] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 1140.422404][ T2237] usb 3-1: Using ep0 maxpacket: 8 [ 1140.552776][ T2237] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1140.601493][ T2237] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1140.775781][ T2237] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1140.822223][ T2237] pvrusb2: ********** [ 1140.828100][T15192] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1140.832813][ T2237] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1140.839151][T15192] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1140.953954][ T2237] pvrusb2: Important functionality might not be entirely working. [ 1140.961809][ T2237] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1141.022263][ T2237] pvrusb2: ********** [ 1141.073951][ T2426] pvrusb2: Invalid write control endpoint [ 1141.130356][T15192] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1141.160081][T15192] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1141.189147][ T2426] pvrusb2: Invalid write control endpoint [ 1141.196834][ T2426] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1141.210826][T15356] netlink: 3 bytes leftover after parsing attributes in process `syz.8.2843'. [ 1141.230060][ T2426] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1141.255637][ T2426] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1141.288212][ T2426] pvrusb2: Device being rendered inoperable [ 1141.301347][T15332] pvrusb2: Attempted to execute control transfer when device not ok [ 1141.316742][ T2426] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1141.324765][T15332] udc-core: couldn't find an available UDC or it's busy [ 1141.331742][T15332] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1141.342700][ T2426] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_h) [ 1141.351511][ T2426] pvrusb2: Attached sub-driver cx25840 [ 1141.394856][ T2426] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1141.407968][T15332] udc-core: couldn't find an available UDC or it's busy [ 1141.432150][T15332] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1141.439954][ T2426] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1141.462396][T15332] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2839'. [ 1141.489426][ T4219] usb 3-1: USB disconnect, device number 32 [ 1142.361056][T15368] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2844'. [ 1142.373708][T15371] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2845'. [ 1145.078326][T15192] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1145.215099][T15192] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1145.392492][T15192] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1145.423053][T15192] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1145.514667][ T5320] device hsr_slave_0 left promiscuous mode [ 1145.527983][ T5320] device hsr_slave_1 left promiscuous mode [ 1145.546081][ T5320] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1145.559749][ T5320] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1145.598806][ T5320] device bridge_slave_1 left promiscuous mode [ 1145.616115][ T5320] bridge0: port 2(bridge_slave_1) entered disabled state [ 1146.486028][ T5320] device bridge_slave_0 left promiscuous mode [ 1146.517413][ T5320] bridge0: port 1(bridge_slave_0) entered disabled state [ 1148.004285][T15425] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 1148.165828][ T5320] team0 (unregistering): Port device team_slave_1 removed [ 1148.182026][ T5320] team0 (unregistering): Port device team_slave_0 removed [ 1148.291025][T15429] 9pnet: Insufficient options for proto=fd [ 1148.335293][ T5320] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1148.391019][ T5320] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1149.069441][ T5320] bond0 (unregistering): Released all slaves [ 1149.153204][T15421] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2856'. [ 1149.164388][T15432] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2859'. [ 1150.817624][T15441] netlink: 524 bytes leftover after parsing attributes in process `syz.8.2861'. [ 1151.235610][T15192] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1151.347621][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1151.392866][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1151.424917][T15192] 8021q: adding VLAN 0 to HW filter on device team0 [ 1151.485237][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1151.605210][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1151.733062][ T4786] bridge0: port 1(bridge_slave_0) entered blocking state [ 1151.733101][ T4786] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1151.972756][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1152.042277][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1152.553694][ T4786] bridge0: port 2(bridge_slave_1) entered blocking state [ 1152.560818][ T4786] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1152.721301][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1153.404809][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1153.478242][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1153.582302][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1153.609496][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1153.618985][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1153.633116][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1154.372922][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1154.381711][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1154.406687][T15487] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2870'. [ 1155.306260][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1155.333293][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1155.342018][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1155.353794][T15192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1155.875783][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1155.891485][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1156.219961][T15192] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1157.021862][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1157.058097][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1157.233641][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1157.253647][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1157.288476][T15192] device veth0_vlan entered promiscuous mode [ 1157.313615][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1157.339373][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1157.400412][T15192] device veth1_vlan entered promiscuous mode [ 1157.410764][T15534] sctp: failed to load transform for md5: -2 [ 1158.136747][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1158.153061][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1158.186371][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1158.205591][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1158.238488][T15192] device veth0_macvtap entered promiscuous mode [ 1158.265961][T15192] device veth1_macvtap entered promiscuous mode [ 1158.352295][T15192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1158.392090][T15192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1158.432133][T15192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1158.462242][T15192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1158.485555][T15192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1158.517030][T15192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1158.547470][T15192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1158.592540][T15192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1158.643727][T15192] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1158.712192][T15192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1158.773854][T15192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1158.923084][T15192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1158.940190][T15192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1158.950433][T15192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1158.965542][T15192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1159.252232][T15192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1159.277730][T15192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1159.648496][T15192] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1159.733013][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1159.741326][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1159.916464][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1160.043709][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1160.129525][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1160.138524][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1160.147566][T15562] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1160.187893][T15192] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1160.219250][T15192] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1160.230024][T15192] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1160.241480][T15192] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1162.432891][T15602] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 1162.707511][ T4228] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1164.176787][ T4228] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1164.915277][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1164.983197][ T4228] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1164.991342][ T4228] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1165.915282][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1165.953137][T15626] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1169.242368][T15671] 9pnet: Insufficient options for proto=fd [ 1170.135829][T15667] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1171.528161][T15701] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2915'. [ 1175.819629][ T26] kauditd_printk_skb: 60 callbacks suppressed [ 1175.819645][ T26] audit: type=1326 audit(1747463155.108:477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15721 comm="syz.9.2922" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4d77b5969 code=0x7ffc0000 [ 1176.317626][T15732] xt_hashlimit: size too large, truncated to 1048576 [ 1176.398172][ T26] audit: type=1326 audit(1747463155.148:478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15721 comm="syz.9.2922" exe="/root/syz-executor" sig=0 arch=c000003e syscall=198 compat=0 ip=0x7fa4d77b5969 code=0x7ffc0000 [ 1176.421829][ T26] audit: type=1326 audit(1747463155.148:479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15721 comm="syz.9.2922" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4d77b5969 code=0x7ffc0000 [ 1176.462287][ T26] audit: type=1326 audit(1747463155.148:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15721 comm="syz.9.2922" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fa4d77b42d0 code=0x7ffc0000 [ 1176.642157][ T26] audit: type=1326 audit(1747463155.148:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15721 comm="syz.9.2922" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4d77b5969 code=0x7ffc0000 [ 1177.556535][T12865] block nbd2: Receive control failed (result -32) [ 1177.564019][T15742] block nbd2: shutting down sockets [ 1178.579832][ T26] audit: type=1326 audit(1747463155.148:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15721 comm="syz.9.2922" exe="/root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7fa4d77b5969 code=0x7ffc0000 [ 1178.660321][ T26] audit: type=1326 audit(1747463155.148:483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15721 comm="syz.9.2922" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4d77b5969 code=0x7ffc0000 [ 1179.592556][ T26] audit: type=1326 audit(1747463155.148:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15721 comm="syz.9.2922" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7fa4d77b5969 code=0x7ffc0000 [ 1179.615503][ T26] audit: type=1326 audit(1747463155.148:485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15721 comm="syz.9.2922" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4d77b5969 code=0x7ffc0000 [ 1179.638315][ T26] audit: type=1326 audit(1747463155.148:486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15721 comm="syz.9.2922" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa4d77b5969 code=0x7ffc0000 [ 1179.643609][T15763] xt_socket: unknown flags 0x8 [ 1179.660562][ C0] vkms_vblank_simulate: vblank timer overrun [ 1179.772533][T15753] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1179.842972][T15763] netlink: 56 bytes leftover after parsing attributes in process `syz.8.2930'. [ 1182.971249][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 1182.977785][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 1183.636452][T12865] block nbd6: Receive control failed (result -32) [ 1183.645531][T15812] block nbd6: shutting down sockets [ 1183.742350][T10591] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1183.982373][T10591] usb 3-1: Using ep0 maxpacket: 8 [ 1184.102371][T10591] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1184.127526][T10591] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1184.205458][T15836] xt_socket: unknown flags 0x8 [ 1184.215367][T10591] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1184.230584][T10591] pvrusb2: ********** [ 1184.246376][T10591] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1184.261048][T15836] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2945'. [ 1184.292966][T10591] pvrusb2: Important functionality might not be entirely working. [ 1184.324592][T10591] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1184.363600][T10591] pvrusb2: ********** [ 1184.381202][T15834] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1184.437758][ T2426] pvrusb2: Invalid write control endpoint [ 1184.590247][ T2426] pvrusb2: Invalid write control endpoint [ 1184.601267][ T2426] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1184.656790][ T2426] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1184.684137][ T2426] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1184.695159][T15819] udc-core: couldn't find an available UDC or it's busy [ 1184.712252][T15819] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1184.734476][T15819] udc-core: couldn't find an available UDC or it's busy [ 1184.759913][ T2426] pvrusb2: Device being rendered inoperable [ 1184.767673][T15819] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 1184.791206][T15814] pvrusb2: Attempted to execute control transfer when device not ok [ 1184.821190][T15819] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2941'. [ 1184.910724][T15851] Failed to get privilege flags for destination (handle=0x2:0x7) [ 1184.925272][T15851] netlink: 'syz.8.2947': attribute type 1 has an invalid length. [ 1184.993902][ T2426] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1185.746845][ T2426] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_i) [ 1186.484409][ T2426] pvrusb2: Attached sub-driver cx25840 [ 1187.732774][ T2426] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1187.862511][ T4273] usb 3-1: USB disconnect, device number 33 [ 1188.578491][ T2426] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1189.599704][T15888] xt_socket: unknown flags 0x8 [ 1189.614411][T15888] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2956'. [ 1189.732367][ T5320] device hsr_slave_0 left promiscuous mode [ 1189.779785][ T5320] device hsr_slave_1 left promiscuous mode [ 1189.798972][ T5320] device veth1_macvtap left promiscuous mode [ 1189.805474][ T5320] device veth0_macvtap left promiscuous mode [ 1189.811677][ T5320] device veth1_vlan left promiscuous mode [ 1189.818172][ T5320] device veth0_vlan left promiscuous mode [ 1190.032359][T10591] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 1190.213474][T12865] block nbd8: Receive control failed (result -32) [ 1190.220741][T15880] block nbd8: shutting down sockets [ 1190.323310][T10591] usb 2-1: Using ep0 maxpacket: 32 [ 1190.513327][T10591] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1190.613206][T10591] usb 2-1: config 253 has an invalid interface number: 202 but max is 0 [ 1190.621615][T10591] usb 2-1: config 253 has no interface number 0 [ 1190.812477][T10591] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 1190.825111][T10591] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1190.842374][T10591] usb 2-1: Product: syz [ 1190.851307][T10591] usb 2-1: Manufacturer: syz [ 1190.862461][T10591] usb 2-1: SerialNumber: syz [ 1191.087814][ T5320] bond0 (unregistering): Released all slaves [ 1191.119490][T15887] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1192.793886][ T2237] Bluetooth: hci1: command 0x0409 tx timeout [ 1193.062884][T10591] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1193.082223][ T4228] usb 2-1: Failed to submit usb control message: -71 [ 1193.429228][T10591] usb 2-1: USB disconnect, device number 38 [ 1193.494656][ T4228] usb 2-1: unable to send the bmi data to the device: -71 [ 1193.522147][ T4228] usb 2-1: unable to get target info from device [ 1193.528603][ T4228] usb 2-1: could not get target info (-71) [ 1193.535702][ T4228] usb 2-1: could not probe fw (-71) [ 1193.650175][T15929] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2964'. [ 1194.512635][T15929] bond0: (slave bond_slave_0): Releasing backup interface [ 1194.816601][T15941] overlayfs: failed to resolve './file0': -2 [ 1194.872287][ T2237] Bluetooth: hci1: command 0x041b tx timeout [ 1195.090216][T15957] xt_socket: unknown flags 0x8 [ 1195.122905][T15957] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2969'. [ 1195.214170][T15896] chnl_net:caif_netlink_parms(): no params data found [ 1197.289375][ T5441] Bluetooth: hci1: command 0x040f tx timeout [ 1197.315415][T15969] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1197.955212][T15896] bridge0: port 1(bridge_slave_0) entered blocking state [ 1198.355321][T15896] bridge0: port 1(bridge_slave_0) entered disabled state [ 1199.216853][T15896] device bridge_slave_0 entered promiscuous mode [ 1199.225709][T15896] bridge0: port 2(bridge_slave_1) entered blocking state [ 1199.232964][T15896] bridge0: port 2(bridge_slave_1) entered disabled state [ 1199.241499][T15896] device bridge_slave_1 entered promiscuous mode [ 1199.352324][ T2237] Bluetooth: hci1: command 0x0419 tx timeout [ 1200.511143][T16005] delete_channel: no stack [ 1200.536435][T15896] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1200.634996][T15896] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1200.744886][T16019] xt_socket: unknown flags 0x8 [ 1200.787057][T15896] team0: Port device team_slave_0 added [ 1200.796773][T16016] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2982'. [ 1200.989162][T15896] team0: Port device team_slave_1 added [ 1201.991775][T15896] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1202.059790][T15896] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1202.218482][T15896] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1202.737961][T16026] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1202.776915][T15896] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1202.827040][T15896] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1203.629866][T15896] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1203.732968][T15896] device hsr_slave_0 entered promiscuous mode [ 1203.793310][T15896] device hsr_slave_1 entered promiscuous mode [ 1203.914032][T15896] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1203.952702][T15896] Cannot create hsr debugfs directory [ 1204.034411][T16046] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2989'. [ 1205.074649][T16063] xt_socket: unknown flags 0x8 [ 1205.103234][T16063] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2994'. [ 1207.154924][T16099] netlink: 'syz.6.3003': attribute type 2 has an invalid length. [ 1208.812180][ T4982] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 1209.412184][ T4982] usb 2-1: Using ep0 maxpacket: 8 [ 1209.742649][ T4982] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1209.793908][ T4982] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1209.834726][ T4982] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1209.891917][ T4982] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1209.956554][ T4982] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1209.976839][ T4982] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1210.477977][ T4982] usb 2-1: GET_CAPABILITIES returned 0 [ 1210.485548][ T4982] usbtmc 2-1:16.0: can't read capabilities [ 1211.362264][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1211.375931][T16142] usbtmc 2-1:16.0: Unable to send data, error -71 [ 1211.572575][ T4273] usb 2-1: USB disconnect, device number 39 [ 1211.600931][T16141] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1212.937603][T16159] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1213.075654][T16141] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1213.315247][T16141] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1213.705940][T16141] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1214.090492][T16141] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.103321][T16141] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.115682][T16141] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.128611][T16141] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.362541][T15896] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1214.502589][T15896] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1214.708169][T15896] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1215.739420][T15896] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1216.359612][ T5320] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1218.644190][T16213] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1218.753577][ T5320] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1219.583980][ T5320] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1219.959140][ T5320] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1221.525889][T15896] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1221.640321][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1221.653423][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1221.685396][T15896] 8021q: adding VLAN 0 to HW filter on device team0 [ 1221.740113][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1221.753300][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1221.762097][ T4982] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1221.800426][T10255] bridge0: port 1(bridge_slave_0) entered blocking state [ 1221.807754][T10255] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1221.939536][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1222.004235][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1222.031290][T10255] bridge0: port 2(bridge_slave_1) entered blocking state [ 1222.038459][T10255] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1222.048794][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1222.103428][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1222.116707][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1222.132776][ T4982] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1222.144396][ T4982] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1222.160397][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1222.166388][ T4982] usb 3-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 1222.178589][ T4982] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1222.302102][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1222.386346][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1222.505000][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1222.612337][ T4982] usb 3-1: config 0 descriptor?? [ 1222.615921][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1222.657359][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1222.676856][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1222.688823][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1222.705371][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1222.768774][T15896] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1223.525085][ T4982] hid-generic 0003:1038:12B6.000C: item fetching failed at offset 6/7 [ 1223.546795][ T4982] hid-generic: probe of 0003:1038:12B6.000C failed with error -22 [ 1223.620508][T16314] loop6: detected capacity change from 0 to 524287999 [ 1223.708323][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1223.719618][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1223.797725][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1223.808692][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1223.846792][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1223.857789][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1223.883586][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1223.894570][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1223.997730][T16316] loop_set_status: loop6 ( 6tPΪŔA8*V^3c) has still dirty pages (nrpages=1) [ 1224.039702][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1224.045097][ C1] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1224.058146][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1224.072740][ C1] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1224.072796][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1224.083813][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1224.099978][ T4222] usb 3-1: USB disconnect, device number 34 [ 1224.164986][T15896] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1224.172941][ C1] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1224.184102][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1224.195927][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1224.206965][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1224.214936][T16314] ldm_validate_partition_table(): Disk read failed. [ 1224.250209][ C1] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1224.261358][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1224.313079][ C1] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 1224.324204][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1224.347119][T16324] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1224.392584][T16314] Dev loop6: unable to read RDB block 0 [ 1224.414072][T16314] loop6: unable to read partition table [ 1224.426504][T16314] loop_reread_partitions: partition scan of loop6 ( 6tPΪŔA8*V^3c) failed (rc=-5) [ 1225.245578][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1226.200725][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1226.612033][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1226.743763][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1226.858130][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1226.868882][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1227.092676][T15896] device veth0_vlan entered promiscuous mode [ 1227.269345][ T5320] device hsr_slave_0 left promiscuous mode [ 1227.278103][ T5320] device hsr_slave_1 left promiscuous mode [ 1227.291825][ T5320] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1227.310192][ T5320] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1227.331357][ T5320] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1227.371812][ T5320] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1227.410621][ T5320] device bridge_slave_1 left promiscuous mode [ 1227.422302][ T5320] bridge0: port 2(bridge_slave_1) entered disabled state [ 1227.471751][ T5320] device bridge_slave_0 left promiscuous mode [ 1227.488822][ T5320] bridge0: port 1(bridge_slave_0) entered disabled state [ 1227.513630][ T4219] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 1227.522408][ T5320] device veth1_macvtap left promiscuous mode [ 1227.528540][ T5320] device veth0_macvtap left promiscuous mode [ 1227.541020][ T5320] device veth1_vlan left promiscuous mode [ 1227.550610][ T5320] device veth0_vlan left promiscuous mode [ 1228.382940][ T4219] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1228.439947][ T4219] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1228.505413][ T4219] usb 7-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 1228.640244][ T4219] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1228.672969][ T5320] team0 (unregistering): Port device team_slave_1 removed [ 1228.713316][ T4219] usb 7-1: config 0 descriptor?? [ 1228.720388][ T5320] team0 (unregistering): Port device team_slave_0 removed [ 1228.779633][ T5320] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1228.846489][ T5320] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1229.034018][ T5320] bond0 (unregistering): Released all slaves [ 1229.192469][T16374] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1229.246956][ T4219] hid-generic 0003:1038:12B6.000D: item fetching failed at offset 6/7 [ 1229.274373][T15896] device veth1_vlan entered promiscuous mode [ 1229.352746][ T4219] hid-generic: probe of 0003:1038:12B6.000D failed with error -22 [ 1230.218882][T10591] usb 7-1: USB disconnect, device number 11 [ 1231.180083][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1231.408161][ T5350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1231.683280][T15896] device veth0_macvtap entered promiscuous mode [ 1231.963056][T15896] device veth1_macvtap entered promiscuous mode [ 1233.078800][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1233.251245][T16462] netlink: 524 bytes leftover after parsing attributes in process `syz.1.3076'. [ 1233.450632][T15896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1233.940878][T15896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1234.257269][T15896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1234.268298][T15896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1234.278310][T15896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1234.288899][T15896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1234.298893][T15896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1234.309472][T15896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1234.321055][T15896] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1234.435885][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1234.476382][T10255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1234.512485][T15896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1234.537617][T15896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1234.592479][T15896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1234.651510][T15896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1234.707759][T15896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1234.770443][T15896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1234.782825][T15896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1235.013133][T15896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1235.157093][T15896] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1235.179051][T16474] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1235.198569][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1235.226329][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1235.258261][T15896] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1235.293945][T15896] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1235.325080][T15896] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1235.452062][T15896] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1237.154906][T14201] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1237.168043][T14201] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1237.244421][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1237.283916][T14201] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1237.420784][T14201] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1237.859908][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1238.862343][T16517] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 1239.586748][T16522] netlink: 524 bytes leftover after parsing attributes in process `syz.6.3088'. [ 1239.975282][T16530] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 1242.836620][T16576] overlayfs: missing 'lowerdir' [ 1243.936903][T16591] netlink: 524 bytes leftover after parsing attributes in process `syz.1.3100'. [ 1244.560129][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 1244.566597][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 1244.652813][ T1331] Bluetooth: hci3: command 0x0409 tx timeout [ 1245.481137][T16559] chnl_net:caif_netlink_parms(): no params data found [ 1246.361229][T16610] fuse: Bad value for 'rootmode' [ 1246.660552][T16617] capability: warning: `syz.8.3106' uses 32-bit capabilities (legacy support in use) [ 1246.722823][ T4222] Bluetooth: hci3: command 0x041b tx timeout [ 1247.903121][T16559] bridge0: port 1(bridge_slave_0) entered blocking state [ 1247.910349][T16559] bridge0: port 1(bridge_slave_0) entered disabled state [ 1247.994121][T16559] device bridge_slave_0 entered promiscuous mode [ 1248.058820][T16631] ptrace attach of "./syz-executor exec"[15896] was attempted by "\x09   %-5鎢D|VTy\x22͚KN/)/HM&CsnVkת{Jv1%_)$n:,\x5c]n+]2yrrL˕-6^%D\x5c~zw'Mc\x22o٫`ˤ=sN8|?ޔBr9ɳbF{i$] [ 1248.053460][T16559] bridge0: port 2(bridge_slave_1) entered blocking state [ 1248.150616][ C1] vkms_vblank_simulate: vblank timer overrun [ 1249.263973][ T4273] Bluetooth: hci3: command 0x040f tx timeout [ 1249.282136][T16559] bridge0: port 2(bridge_slave_1) entered disabled state [ 1249.357210][T16559] device bridge_slave_1 entered promiscuous mode [ 1249.586359][T16559] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1249.664698][T16559] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1250.713527][T16559] team0: Port device team_slave_0 added [ 1250.750251][T16559] team0: Port device team_slave_1 added [ 1251.160053][T16676] netlink: 830 bytes leftover after parsing attributes in process `syz.4.3119'. [ 1251.272203][ T4219] Bluetooth: hci3: command 0x0419 tx timeout [ 1251.352275][ T4273] Bluetooth: hci2: command 0x0406 tx timeout [ 1251.782763][T16559] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1251.789749][T16559] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1251.855817][T16559] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1251.879877][T16667] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1251.912922][T16559] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1252.072200][T16559] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1252.098189][ C1] vkms_vblank_simulate: vblank timer overrun [ 1252.403418][T16687] fuse: Bad value for 'rootmode' [ 1252.658618][T16559] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1253.065956][T16559] device hsr_slave_0 entered promiscuous mode [ 1253.093461][T16559] device hsr_slave_1 entered promiscuous mode [ 1253.100304][T16559] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1253.108612][T16559] Cannot create hsr debugfs directory [ 1254.476565][T16725] kernel read not supported for file /eth0 (pid: 16725 comm: syz.6.3129) [ 1254.516185][ T26] kauditd_printk_skb: 60 callbacks suppressed [ 1254.516199][ T26] audit: type=1800 audit(1747463233.808:547): pid=16725 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3129" name="eth0" dev="mqueue" ino=47496 res=0 errno=0 [ 1255.455265][T16725] netlink: 44 bytes leftover after parsing attributes in process `syz.6.3129'. [ 1257.016011][T16753] syz.1.3133 (16753): /proc/16753/oom_adj is deprecated, please use /proc/16753/oom_score_adj instead. [ 1257.365164][T16742] ubi31: attaching mtd0 [ 1257.385395][T16742] ubi31: scanning is finished [ 1257.718169][T16559] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1258.174138][T16559] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1258.206390][T16742] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 1258.401820][T16559] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1260.062319][T16769] 9pnet: Insufficient options for proto=fd [ 1260.808322][T16559] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1261.996599][T16559] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1262.055255][T16559] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1262.114465][T16559] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1262.165749][T16559] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1264.189910][T16559] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1264.209596][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1264.229988][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1265.371056][T16559] 8021q: adding VLAN 0 to HW filter on device team0 [ 1265.512982][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1265.573678][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1265.659435][ T4228] bridge0: port 1(bridge_slave_0) entered blocking state [ 1265.666674][ T4228] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1266.503931][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1266.553813][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1266.621876][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1266.727342][ T4228] bridge0: port 2(bridge_slave_1) entered blocking state [ 1266.734604][ T4228] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1266.790667][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1267.015947][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1267.778901][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1267.876987][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1267.891644][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1267.901193][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1267.914840][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1267.925923][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1267.935723][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1267.944851][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1267.961594][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1267.994725][T16853] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3159'. [ 1268.358945][T16853] team0: Port device team_slave_0 removed [ 1268.910556][ T26] audit: type=1326 audit(1747463248.198:548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16882 comm="syz.4.3162" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fccbaa30969 code=0x0 [ 1269.259302][T16559] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1269.711165][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1269.729059][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1270.064675][T16904] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 1270.153726][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1270.165005][ T5320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1270.519730][T16559] device veth0_vlan entered promiscuous mode [ 1270.636581][T16559] device veth1_vlan entered promiscuous mode [ 1271.450429][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1271.511300][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1271.572911][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1271.681067][T16559] device veth0_macvtap entered promiscuous mode [ 1272.854860][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1272.875571][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1272.967982][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1273.057103][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1273.073307][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1273.111538][T16559] device veth1_macvtap entered promiscuous mode [ 1273.220865][T16559] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1273.467557][T16559] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1273.482756][T16559] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1273.499536][T16559] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1273.752416][T16559] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1274.088465][T16559] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.142103][T16559] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1274.160655][T16559] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.195301][T16559] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1274.238138][T16559] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.272732][T16559] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1274.318868][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1274.363151][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1274.385699][T16559] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1274.407610][T16559] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.432750][T16977] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3183'. [ 1274.451833][T16559] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1274.482105][T16559] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.514493][T16559] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1274.550683][T16559] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.577072][T16559] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1274.602101][T16559] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.635444][T16559] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1274.662051][T16559] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.687986][T16559] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1274.710321][T16981] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1274.768726][T16981] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1274.815013][T16981] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1274.947561][T16990] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3185'. [ 1275.158351][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1275.253816][T14201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1275.868764][T16559] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1275.879278][T16559] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1275.888680][T16559] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1275.897772][T16559] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1280.844507][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1281.095644][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1281.569602][ T4786] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1281.634503][ T4786] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1281.669995][ T4786] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1281.730152][ T4228] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1282.017488][ T26] audit: type=1326 audit(1747463261.308:549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17032 comm="syz.4.3196" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fccbaa30969 code=0x7ffc0000 [ 1282.148627][ T26] audit: type=1326 audit(1747463261.368:550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17032 comm="syz.4.3196" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fccbaa30969 code=0x7ffc0000 [ 1282.318870][ T26] audit: type=1326 audit(1747463261.378:551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17032 comm="syz.4.3196" exe="/root/syz-executor" sig=0 arch=c000003e syscall=256 compat=0 ip=0x7fccbaa30969 code=0x7ffc0000 [ 1282.341295][ C0] vkms_vblank_simulate: vblank timer overrun [ 1282.350352][ T26] audit: type=1326 audit(1747463261.388:552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17032 comm="syz.4.3196" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fccbaa30969 code=0x7ffc0000 [ 1282.442641][ T26] audit: type=1326 audit(1747463261.388:553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17032 comm="syz.4.3196" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fccbaa30969 code=0x7ffc0000 [ 1283.179369][T17057] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 1284.457409][T17081] overlayfs: failed to resolve './file1': -2 [ 1289.915292][T17145] nftables ruleset with unbound set [ 1292.052305][T12620] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1292.553427][T12620] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1292.574652][T12620] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1292.682513][T12620] usb 3-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 1292.691639][T12620] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1292.701918][T12620] usb 3-1: config 0 descriptor?? [ 1293.136881][T17225] 9pnet: Insufficient options for proto=fd [ 1293.292983][T17233] nfs: Unknown parameter '' [ 1293.324856][T12620] hid-generic 0003:1038:12B6.000E: item fetching failed at offset 6/7 [ 1293.349047][T12620] hid-generic: probe of 0003:1038:12B6.000E failed with error -22 [ 1295.592192][ T5441] usb 3-1: USB disconnect, device number 35 [ 1296.077757][T17251] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3239'. [ 1296.089378][T17251] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3239'. [ 1298.223812][T17280] binder: 17279:17280 ioctl c0306201 0 returned -14 [ 1299.512754][ T23] Bluetooth: hci3: command 0x0405 tx timeout [ 1305.045338][T17356] overlayfs: failed to resolve './file1': -2 [ 1305.596633][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 1305.604109][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 1306.959404][T17391] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3276'. [ 1308.439870][T17406] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3280'. [ 1308.699986][T17412] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3281'. [ 1308.720459][T17412] overlayfs: missing 'lowerdir' [ 1311.438398][T17464] ================================================================== [ 1311.447016][T17464] BUG: KASAN: use-after-free in rose_get_neigh+0x17e/0x550 [ 1311.454259][T17464] Read of size 1 at addr ffff888061e0d430 by task syz.4.3293/17464 [ 1311.462178][T17464] [ 1311.464530][T17464] CPU: 0 PID: 17464 Comm: syz.4.3293 Not tainted 5.15.182-syzkaller #0 [ 1311.472785][T17464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 1311.482871][T17464] Call Trace: [ 1311.486170][T17464] [ 1311.489115][T17464] dump_stack_lvl+0x168/0x230 [ 1311.493850][T17464] ? show_regs_print_info+0x20/0x20 [ 1311.499076][T17464] ? load_image+0x3b0/0x3b0 [ 1311.503686][T17464] ? _raw_spin_lock_irqsave+0xb0/0xf0 [ 1311.509100][T17464] print_address_description+0x60/0x2d0 [ 1311.514680][T17464] ? rose_get_neigh+0x17e/0x550 [ 1311.519554][T17464] kasan_report+0xdf/0x130 [ 1311.524001][T17464] ? rose_get_neigh+0x17e/0x550 [ 1311.528883][T17464] rose_get_neigh+0x17e/0x550 [ 1311.533599][T17464] rose_connect+0x412/0x1370 [ 1311.538231][T17464] ? rose_bind+0xa00/0xa00 [ 1311.542672][T17464] ? lockdep_hardirqs_on+0x94/0x140 [ 1311.547903][T17464] ? asm_sysvec_call_function_single+0x16/0x20 [ 1311.554085][T17464] ? rose_bind+0xa00/0xa00 [ 1311.560455][T17464] ? rose_bind+0xa00/0xa00 [ 1311.564906][T17464] __sys_connect+0x389/0x410 [ 1311.569523][T17464] ? __sys_connect_file+0x170/0x170 [ 1311.574763][T17464] ? vtime_user_exit+0x2dc/0x400 [ 1311.579740][T17464] __x64_sys_connect+0x76/0x80 [ 1311.584772][T17464] do_syscall_64+0x4c/0xa0 [ 1311.589212][T17464] ? clear_bhb_loop+0x15/0x70 [ 1311.593904][T17464] ? clear_bhb_loop+0x15/0x70 [ 1311.598603][T17464] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 1311.604525][T17464] RIP: 0033:0x7fccbaa30969 [ 1311.608958][T17464] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1311.628675][T17464] RSP: 002b:00007fccb8877038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1311.637101][T17464] RAX: ffffffffffffffda RBX: 00007fccbac58080 RCX: 00007fccbaa30969 [ 1311.645091][T17464] RDX: 0000000000000040 RSI: 00002000000001c0 RDI: 0000000000000006 [ 1311.653099][T17464] RBP: 00007fccbaab2ab1 R08: 0000000000000000 R09: 0000000000000000 [ 1311.661067][T17464] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1311.669031][T17464] R13: 0000000000000000 R14: 00007fccbac58080 R15: 00007ffdc99a20b8 [ 1311.677046][T17464] [ 1311.680075][T17464] [ 1311.682386][T17464] Allocated by task 1331: [ 1311.686698][T17464] __kasan_kmalloc+0xb5/0xf0 [ 1311.691284][T17464] __alloc_skb+0x22c/0x750 [ 1311.695692][T17464] ndisc_alloc_skb+0xa6/0x420 [ 1311.700367][T17464] ndisc_send_ns+0x29e/0x840 [ 1311.704950][T17464] addrconf_dad_work+0xa47/0x1520 [ 1311.709997][T17464] process_one_work+0x863/0x1000 [ 1311.714927][T17464] worker_thread+0xaa8/0x12a0 [ 1311.719601][T17464] kthread+0x436/0x520 [ 1311.723656][T17464] ret_from_fork+0x1f/0x30 [ 1311.728058][T17464] [ 1311.730367][T17464] Last potentially related work creation: [ 1311.736062][T17464] kasan_save_stack+0x35/0x60 [ 1311.740731][T17464] kasan_record_aux_stack+0xb8/0x100 [ 1311.746102][T17464] insert_work+0x54/0x3d0 [ 1311.750431][T17464] __queue_work+0x9c5/0xd50 [ 1311.754925][T17464] call_timer_fn+0x16c/0x530 [ 1311.759644][T17464] __run_timers+0x550/0x7c0 [ 1311.764140][T17464] run_timer_softirq+0x63/0xf0 [ 1311.768991][T17464] handle_softirqs+0x328/0x820 [ 1311.773748][T17464] __irq_exit_rcu+0x12f/0x220 [ 1311.778534][T17464] irq_exit_rcu+0x5/0x20 [ 1311.782766][T17464] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 1311.788396][T17464] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 1311.794366][T17464] [ 1311.796680][T17464] Second to last potentially related work creation: [ 1311.803250][T17464] kasan_save_stack+0x35/0x60 [ 1311.808027][T17464] kasan_record_aux_stack+0xb8/0x100 [ 1311.813403][T17464] insert_work+0x54/0x3d0 [ 1311.817823][T17464] __queue_work+0x9c5/0xd50 [ 1311.822319][T17464] call_timer_fn+0x16c/0x530 [ 1311.826920][T17464] __run_timers+0x550/0x7c0 [ 1311.831428][T17464] run_timer_softirq+0x63/0xf0 [ 1311.836195][T17464] handle_softirqs+0x328/0x820 [ 1311.840952][T17464] __irq_exit_rcu+0x12f/0x220 [ 1311.845636][T17464] irq_exit_rcu+0x5/0x20 [ 1311.849881][T17464] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 1311.855513][T17464] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 1311.861486][T17464] [ 1311.863799][T17464] The buggy address belongs to the object at ffff888061e0d400 [ 1311.863799][T17464] which belongs to the cache kmalloc-512 of size 512 [ 1311.877843][T17464] The buggy address is located 48 bytes inside of [ 1311.877843][T17464] 512-byte region [ffff888061e0d400, ffff888061e0d600) [ 1311.891093][T17464] The buggy address belongs to the page: [ 1311.896724][T17464] page:ffffea0001878300 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888061e0c400 pfn:0x61e0c [ 1311.908168][T17464] head:ffffea0001878300 order:2 compound_mapcount:0 compound_pincount:0 [ 1311.916478][T17464] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 1311.924461][T17464] raw: 00fff00000010200 ffffea00008b8908 ffffea00017ce108 ffff888016841c80 [ 1311.933035][T17464] raw: ffff888061e0c400 0000000000100003 00000001ffffffff 0000000000000000 [ 1311.941601][T17464] page dumped because: kasan: bad access detected [ 1311.948010][T17464] page_owner tracks the page as allocated [ 1311.953707][T17464] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4174, ts 74694071531, free_ts 30581966578 [ 1311.972794][T17464] get_page_from_freelist+0x1b77/0x1c60 [ 1311.978338][T17464] __alloc_pages+0x1e1/0x470 [ 1311.982925][T17464] new_slab+0xc0/0x4b0 [ 1311.987002][T17464] ___slab_alloc+0x81e/0xdf0 [ 1311.991579][T17464] __kmalloc+0x1cd/0x330 [ 1311.995814][T17464] fib6_info_alloc+0x2e/0xe0 [ 1312.000405][T17464] ip6_route_info_create+0x44f/0x1210 [ 1312.005769][T17464] addrconf_f6i_alloc+0x1b9/0x3f0 [ 1312.010791][T17464] ipv6_add_addr+0x438/0xde0 [ 1312.015390][T17464] addrconf_add_linklocal+0x280/0x6b0 [ 1312.020760][T17464] addrconf_addr_gen+0x4ee/0x620 [ 1312.025694][T17464] addrconf_init_auto_addrs+0x785/0xb50 [ 1312.031234][T17464] addrconf_notify+0xa6b/0xf00 [ 1312.035998][T17464] raw_notifier_call_chain+0xcb/0x160 [ 1312.041360][T17464] __dev_notify_flags+0x178/0x2d0 [ 1312.046374][T17464] dev_change_flags+0xe3/0x1a0 [ 1312.051132][T17464] page last free stack trace: [ 1312.055803][T17464] free_unref_page_prepare+0x637/0x6c0 [ 1312.061255][T17464] free_unref_page+0x94/0x280 [ 1312.065933][T17464] free_contig_range+0x96/0xf0 [ 1312.070707][T17464] destroy_args+0xef/0x8b0 [ 1312.075147][T17464] debug_vm_pgtable+0x318/0x370 [ 1312.080073][T17464] do_one_initcall+0x1ee/0x680 [ 1312.084846][T17464] do_initcall_level+0x137/0x1f0 [ 1312.089874][T17464] do_initcalls+0x4b/0x90 [ 1312.094216][T17464] kernel_init_freeable+0x3ce/0x560 [ 1312.099410][T17464] kernel_init+0x19/0x1b0 [ 1312.103748][T17464] ret_from_fork+0x1f/0x30 [ 1312.108156][T17464] [ 1312.110468][T17464] Memory state around the buggy address: [ 1312.116083][T17464] ffff888061e0d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1312.124131][T17464] ffff888061e0d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1312.132200][T17464] >ffff888061e0d400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1312.140263][T17464] ^ [ 1312.145879][T17464] ffff888061e0d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1312.154174][T17464] ffff888061e0d500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1312.162229][T17464] ================================================================== [ 1312.170270][T17464] Disabling lock debugging due to kernel taint [ 1312.176590][T17464] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1312.183807][T17464] CPU: 0 PID: 17464 Comm: syz.4.3293 Tainted: G B 5.15.182-syzkaller #0 [ 1312.193424][T17464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 1312.203467][T17464] Call Trace: [ 1312.206738][T17464] [ 1312.209654][T17464] dump_stack_lvl+0x168/0x230 [ 1312.214325][T17464] ? show_regs_print_info+0x20/0x20 [ 1312.219513][T17464] ? load_image+0x3b0/0x3b0 [ 1312.224005][T17464] panic+0x2c9/0x7f0 [ 1312.227904][T17464] ? bpf_jit_dump+0xd0/0xd0 [ 1312.232398][T17464] ? _raw_spin_unlock_irqrestore+0xa5/0x100 [ 1312.238284][T17464] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 1312.244168][T17464] ? _raw_spin_unlock+0x40/0x40 [ 1312.249012][T17464] ? rose_get_neigh+0x17e/0x550 [ 1312.253855][T17464] check_panic_on_warn+0x80/0xa0 [ 1312.258786][T17464] ? rose_get_neigh+0x17e/0x550 [ 1312.263645][T17464] end_report+0x6d/0xf0 [ 1312.267790][T17464] kasan_report+0x102/0x130 [ 1312.272280][T17464] ? rose_get_neigh+0x17e/0x550 [ 1312.277140][T17464] rose_get_neigh+0x17e/0x550 [ 1312.281850][T17464] rose_connect+0x412/0x1370 [ 1312.286444][T17464] ? rose_bind+0xa00/0xa00 [ 1312.290851][T17464] ? lockdep_hardirqs_on+0x94/0x140 [ 1312.296057][T17464] ? asm_sysvec_call_function_single+0x16/0x20 [ 1312.302203][T17464] ? rose_bind+0xa00/0xa00 [ 1312.306609][T17464] ? rose_bind+0xa00/0xa00 [ 1312.311014][T17464] __sys_connect+0x389/0x410 [ 1312.315596][T17464] ? __sys_connect_file+0x170/0x170 [ 1312.320788][T17464] ? vtime_user_exit+0x2dc/0x400 [ 1312.325808][T17464] __x64_sys_connect+0x76/0x80 [ 1312.330560][T17464] do_syscall_64+0x4c/0xa0 [ 1312.334975][T17464] ? clear_bhb_loop+0x15/0x70 [ 1312.339643][T17464] ? clear_bhb_loop+0x15/0x70 [ 1312.344306][T17464] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 1312.350190][T17464] RIP: 0033:0x7fccbaa30969 [ 1312.354679][T17464] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1312.374269][T17464] RSP: 002b:00007fccb8877038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1312.382671][T17464] RAX: ffffffffffffffda RBX: 00007fccbac58080 RCX: 00007fccbaa30969 [ 1312.390653][T17464] RDX: 0000000000000040 RSI: 00002000000001c0 RDI: 0000000000000006 [ 1312.398632][T17464] RBP: 00007fccbaab2ab1 R08: 0000000000000000 R09: 0000000000000000 [ 1312.406588][T17464] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1312.414544][T17464] R13: 0000000000000000 R14: 00007fccbac58080 R15: 00007ffdc99a20b8 [ 1312.422506][T17464] [ 1312.425797][T17464] Kernel Offset: disabled [ 1312.430119][T17464] Rebooting in 86400 seconds..