last executing test programs: 2.913699797s ago: executing program 0 (id=56): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000000080)={0x3}, 0x1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00'}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x24044040) 2.793122851s ago: executing program 0 (id=57): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000004800)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffffc700, 0x3, 0x6, 0xf16, 0x3}, 0x3f82}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0040000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 2.601947546s ago: executing program 0 (id=60): socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) openat$cuse(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000300)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') r3 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) bind$packet(r3, &(0x7f0000000000)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @link_local}, 0x14) preadv(r2, &(0x7f0000000000)=[{&(0x7f0000000480)=""/187, 0xbb}], 0x1, 0x25, 0x25) 2.511861199s ago: executing program 0 (id=61): ioprio_set$pid(0x1, 0x0, 0x6000) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000200)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x7, 0x7fff0000}]}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0), 0xa602, 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000000c0)=0x1) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000280)={0x5, 0x3, 0x0, 0x0, 0x1b, "fe94b89fc43c3328eae0cae1f5eba329e6f216"}) splice(r1, 0x0, r0, 0x0, 0x7fffe000, 0x1) 2.361034373s ago: executing program 0 (id=63): r0 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f00000000c0), 0x4) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="020000000400000018004700"], 0x17) epoll_create1(0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb0fc5260caceb9fa, 0x4000010, r2, 0x13e67000) ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f0000000380)={&(0x7f0000001880)=[{0x3, 0x0, 0x0, 0x0}], 0x1}) epoll_create1(0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000002340)={0x0, 0x0, 0x0, 0x0, 0xffffff00, r1}, 0x38) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r1}, &(0x7f0000000000), &(0x7f0000000040)='%pI4 \x00'}, 0x20) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0xffffff02}, 0x1, 0x0, 0x0, 0x24004001}, 0x8081) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x3c}}, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001000030404feffffff00000000", @ANYRES32=r5, @ANYBLOB="1fff01000000000008001d0004000000"], 0x28}, 0x1, 0x0, 0x0, 0x24048804}, 0x0) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_usb_control_io$cdc_ncm(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$uac3(r7, 0x0, &(0x7f0000001040)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\b\x00\x00\x00\x00A'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000012000000140012800b0001006272696467650000040002800800", @ANYBLOB], 0x3c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) 2.188529518s ago: executing program 2 (id=64): syz_open_dev$ttys(0xc, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$media(&(0x7f0000000380), 0x10, 0x101000) syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b1, 0x10, 0x2, 0x46}, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$fault_inject(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/fail_make_request/times\x00', 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05000000620000004300000001"], 0x50) syz_open_dev$video4linux(&(0x7f0000000180), 0xffffffff, 0x40000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x1000, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) syz_open_procfs(0x0, &(0x7f0000000300)='oom_adj\x00') socket(0x200000000000011, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140), 0x106, 0x2}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x5, &(0x7f0000000300), 0x111, 0xa}}, 0x20) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 2.155576899s ago: executing program 3 (id=65): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000000080)={0x3}, 0x1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00'}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x24044040) 1.981151984s ago: executing program 3 (id=66): r0 = eventfd(0x26) readv(r0, &(0x7f00000003c0)=[{0x0}, {&(0x7f00000001c0)=""/233, 0xe9}], 0x2) 1.955870084s ago: executing program 2 (id=67): r0 = syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x39c4, 0x2, 0x4, 0xfffffffe}, &(0x7f0000000240), &(0x7f0000000280), 0x0) io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000500)='n', 0x1) 1.868857337s ago: executing program 3 (id=68): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000004800)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffffc700, 0x3, 0x6, 0xf16, 0x3}, 0x3f82}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0040000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 1.77340508s ago: executing program 2 (id=69): r0 = gettid() socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x6, &(0x7f0000000300)=0x0) io_pgetevents(r1, 0x4, 0x4, &(0x7f0000000340)=[{}, {}, {}, {}], 0x0, 0x0) eventfd2(0x0, 0x80800) io_submit(r1, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) 1.647795384s ago: executing program 3 (id=70): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xfff7, 0xb}, {0xffff, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, &(0x7f0000000440)="bad386ddc7180869ab2b83b48ae15386fe9a03", 0x13, 0x24004095, &(0x7f00000001c0)={0x11, 0x88a8, r3, 0x1, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}}, 0x14) 1.478927388s ago: executing program 3 (id=71): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x9, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.237278255s ago: executing program 1 (id=73): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(0x0, 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x88802, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000900001c"], 0x4a) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0xe22, 0x2, @rand_addr, 0xed9f}, 0x1c) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r5 = fsopen(&(0x7f0000000040)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000080)='size\x00', &(0x7f00000000c0)='10M\x00', 0x0) r6 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0) pwritev(r6, &(0x7f0000002600)=[{&(0x7f0000002480)="a9", 0x1}, {0x0}], 0x2, 0x9, 0xfffff800) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) syz_emit_ethernet(0x9a, &(0x7f0000000240)=ANY=[@ANYBLOB="0180c200000000000000000086dd601b000000641100fe8000000000000000000000000000aaff020000000000f8000000000000000140000e22006490780200000000000000020000001983426a97e3503bbbc12ef01ae488918c1ea89a08a25f78de9f802d2628cc4bb6af91bfb69252b136c8f50eaee89ebe26e39726e261b1997fe90de784"], 0x0) 1.000104702s ago: executing program 1 (id=74): ptrace(0x10, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) ioctl$int_in(r0, 0x5452, &(0x7f00000002c0)=0x7) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = getpid() fcntl$setownex(r1, 0xf, &(0x7f0000000000)={0x2, r2}) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x9, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x1) 733.18479ms ago: executing program 2 (id=75): syz_open_dev$ttys(0xc, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$media(&(0x7f0000000380), 0x10, 0x101000) syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b1, 0x10, 0x2, 0x46}, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$fault_inject(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/fail_make_request/times\x00', 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05000000620000004300000001"], 0x50) syz_open_dev$video4linux(&(0x7f0000000180), 0xffffffff, 0x40000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x1000, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) syz_open_procfs(0x0, &(0x7f0000000300)='oom_adj\x00') socket(0x200000000000011, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140), 0x106, 0x2}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x5, &(0x7f0000000300), 0x111, 0xa}}, 0x20) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 671.196992ms ago: executing program 1 (id=76): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000000080)={0x3}, 0x1) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010029bd7000ffdbdf2500000000", @ANYRES32, @ANYBLOB="100804002010000024001280110001006272696467655f736c618c65000000000c000580050019"], 0x44}, 0x1, 0x0, 0x0, 0x404c1}, 0x40040d4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x24044040) 490.388567ms ago: executing program 1 (id=77): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x8c854}, 0x80) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e19, 0x0, @empty, 0x61}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x4e23, 0x2, @dev={0xfe, 0x80, '\x00', 0xd}}, 0x1c) 404.615439ms ago: executing program 2 (id=78): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000004800)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffffc700, 0x3, 0x6, 0xf16, 0x3}, 0x3f82}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0040000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 317.275232ms ago: executing program 1 (id=79): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xfff7, 0xb}, {0xffff, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, &(0x7f0000000440)="bad386ddc7180869ab2b83b48ae15386fe9a03", 0x13, 0x24004095, &(0x7f00000001c0)={0x11, 0x88a8, r3, 0x1, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}}, 0x14) 259.166023ms ago: executing program 0 (id=80): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000004800)=@newtfilter={0xb04, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0xad4, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffffc700, 0x3, 0x6, 0xf16, 0x3}, 0x3f82}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_BASIC_CLASSID={0x8, 0x1, {0x3, 0x9}}, @TCA_BASIC_ACT={0xa74, 0x3, [@m_sample={0xac, 0x4, 0x0, 0x0, {{0xb}, {0x4}, {0x7e, 0x6, "09dc9faff8587ce77b2e04278809409eaadb1549ce770e2466288316d42d53fae78e3bd0ab32dfac807ec6fb3c11d0374ad78010a29a03b9e26b0bdcfa11c3c8749e3a37f2c4b3c0a3bfc9f13eb5d2c49c1787626eb9fff35b4cd22ccc866b59d0b7875109149c5c198b6b92a240f93e6995eaeb03585fbfdd8d"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_mirred={0xb0, 0x1, 0x0, 0x0, {{0xb}, {0x84, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x8001, 0x400, 0x3, 0x2, 0xaa73}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x31b, 0x6, 0xb}, 0x2, r9}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfff, 0x8000, 0x3, 0x5b, 0x1}, 0x1}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x4, 0x4, 0xb, 0xdc}, 0x2, r4}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_nat={0xe4, 0x3, 0x0, 0x0, {{0x8}, {0xa4, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xb5, 0x5, 0xffffffffffffffff, 0x8, 0x8}, @multicast2, @broadcast, 0xffffffff, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x1d8, 0x7, 0x3, 0x7, 0x6}, @remote, @remote, 0xff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x4, 0x1, 0x2, 0x5, 0xfffffff8}, @empty, @rand_addr=0x64010100, 0xffffffff, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x8000, 0x1c, 0x6, 0x0, 0x2}, @remote, @dev={0xac, 0x14, 0x14, 0x36}, 0xff}}]}, {0x1c, 0x6, "223ba0d4e181ea1fda7b6ccf039098dd91edfb3f1564f358"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_simple={0x830, 0x12, 0x0, 0x0, {{0xb}, {0x4}, {0x804, 0x6, "5463094355cf421a310532e19f67fe85f74881073df7703af89b13455dad5bf983d4ab18e7fcfc2468e8f637e657b9e473e1450717a56d6dbd4edf20ca1c7f93fc88b59569a27f0a4886c5ede594a72074f66eab9ccfa24f177a0a80d172c32c33991e7f2d85fbfa62745f1a0e31e9a80a89d0e42c4dba5b56ca287722ca901d9a2ff15ac6c817fef957fb7326f3d10235aae5f13f701b69cd87209c9f2c7675767c5330a830841e37ac3b840e00a4e9d7252d865343324f00fc598cd7400526b4f397cc45aacc2ea51e92d061d902f3f3d0a4298a808920b04ec3fd3aa4252647bb29a375278e4c961664757fa49d1c7d4b479cdaf20b25d708f6248e696f941265912c26ea35e2b1efe45466ed224e45bd94c7a0f173a425bd413db64804ffa06f4124d0ef58b9e4ede8b0452dd0397740078179ca5e3778499009ccf551f989847f97843231e45616487a53d7c0e6315b9b51af1a7a531a57287da41ce9cdf92d0a03f8daeb98b7e861e21de3d759758fce6a4dc9859a8ab373399a9df98dfc3a1e5987f3742974005181543775c9599bb7117c0268ecdf7b411b4da15fa105c642c3822c6b5a7f327a794147aa0695e9db43e41ddc0ef640fce4ae84fa93fbdc1f4e5245da4f509b46d0f6c9daa28e45f508016900c9bd2b66d2cfaaec80b881c0f26f35988ffa0df94eaa083678016aa842f39a3720d5e3e62d6095e10a19be2f94b9109f6e66d6db213d37bee15e8de82579d0c6a644b5eddbfc374dde422d93fea595ef4e0c34552829d84016389298b2720c82360eb928e167585f82d4377745164c5380a100cc19dee6591d39658bba1b51160bb200b023e47fbf154a3a9ef121f134ab584c38c8e5a2a1e1167a3447fb6914e333ca2ebf8f78dc5a2e20a7b66749eded8381eb5a9053816d6e414236fff460327854211b9ed4ca71520e3021b3fc0db172a56826b0f5c1d4977472df92247b83d589b34ceb0573dd9fb36909c9e0173f83555b0a15982d041cccc04c9c0ca0301a7913689a86e675d2809fbbd01967fa21b89f8cc5a0ac222b9e7200638a9e66161aa9987b217dadf4559b517377b96fcd1167f42d057eb930474483d7ec60a06bbf62b362425e73d5f65a2dcf46ff6cc5d7864fb4ff2a40afe6561d7e2eb6a09cd0318fcc4efe87d162350dda0158194c732ea7860575ddcd1cd3513722712a8998255a834d7a6c82cb92b1a55033c8fa9755161106ce05d2de023ee295965968998aee11eaa24250589e04365322f8d11c7a73ec60b1549b36a22080c5816637138bb74fe24d0bf2eed8c66830d9b749c0ce74f35ebafccdee5fdf3b2d4f27089a230d4399c2ba01a1786ab97ebc336b376cd12fc25ee96c6e1db6d34e7aa2f3f68ff5a70f26293e3b26473f113614316bfb68a00f5040108a911cbe3905477663d3ed2e2541b1e86e61f52dcee51d989193eae025271297d0987f6e5086afafc9f5167927987a954f9597c8b13cb13bb190587c3ce5ecb8cafe5c97d00fbc982ba955f9a17fe3c16fd9c55217bdb0ad961edb9803c7fff27aa429a812212efc32a08e3c680f8e9bfdb08d62d791d70165b96391412fd9f96bf00b826bf7787de772524d5ee5103266dca7d4d2e3a38ebec1b3c65100dad5e90a1111b98931b1f9fde2cb4ce2868b127bb96cd4462367032d6a9ea9ff86707da9f3177f3c8cb8f9e4b3f4b37405376cdf81d070d9a774416309b0e57bd93536e973d4cd62f0fd99f6fb490c1d8d0a14248400c13cfd24de511f49297c956a8172263ca043ae685287993c6b81a24e40ab4518cbea77ecde8a83e2effad8265b4df419a951baa74cde7eef5403c6c600d9615f868f0a050bd30bafa62cb546569c32a469e2562a4f192adf63b2b86d5886ce75fecb317437b76ff6a5c3aa81346f3c50f17dd4cb562e99fd16b1bb548dcc18a16181ef3f6427cd93ba2240d6e0818779c377fc9763181ca5efb404cf5499c05181d8bc4f04372751789f94f788835bd68a728074bf4e8e02c5d9d13c0bf6e5126ad3d6a4e0a083e8412ab0a25f64b3dcdeffcfbb8d5db0b818158151022f4e444b4736230d10f5b9c2b847e439aac21667c94240ff3074f35227cc31d33a20c7f6c6330c780de35bfb61b8c4ac34a54a81277311af96a10196346f844247db5615578d6f37c77bf7f6674f90ae1fe67267f3f31210ebcd1da5aafc7a9ec60773d6dcbdf1131d0e414e3d7034e3b7adb0da29820194007b1ad5cf6af06d9edb43da7e13c225b7ba3a30a3c242fe7444077b4641944825e5943757ac18e32a9d0b350f16665e410ebf2429488ced0d3a68281131b8357aa1f52c34b7906c774a39b574b3ae27bc95598bdc6dcecdb13090613d70e7f95a30c8d15b6104d04ed673933b1f16929be791cac4cb4ce1349ef73498d009456fddecf8cfc5ad53ecc78a6db6003574f0eff2e7f20fed420eb2ba3bc4c51e96605d549fd3ebadc0e17f94f90a580002b2f7c6f32dfcb53ce54cd95128782d0a5bd8303e82edcb4066a17990a48f773e19344a011da5ed2d365e5a92a20f8654eabb2f6cfc9ebb702ff0574c0f683575199bb3997edf3264129ad5d5c7da57e80f671b5edc47845968b76eecd74d6052b44aa5976b3aec6293db7c8789e66649bef325bcd3f102ed448d10f2f2331f1ecc08d58e107d0766d843465df0b76344dd3162c2ebef49664f6dc1f732173c8c40294721e17b0e2c9e1bb31c0b9f02c8529cf80b4349c5559c272f5b92b2a79f6850d58c7cdc95740d9fc8f0680676452c98fd4286195918f9d5007923d834301203970e38a6a52fdb668a026a4e644d9096dfa7ecc16386025f3392f814c955bdb2d5f334ca73301cb709077a7e174f90b5bc9fc56a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x1}}}}]}]}}]}, 0xb04}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r6, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) 214.077754ms ago: executing program 3 (id=81): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x800, 0x4, 0x81, 0x4, 0x8, 0x0, 0x7, 0x12, 0x400, 0x80000004, 0xfffffffffffffffc, 0x7, 0x5, 0x6, 0x100000000001], 0x1000, 0x4fb40}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000000)=0x3) ioctl$KVM_RUN(r2, 0xae80, 0x0) 47.572909ms ago: executing program 2 (id=82): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(0x0, 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x88802, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000900001c"], 0x4a) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0xe22, 0x2, @rand_addr, 0xed9f}, 0x1c) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r5 = fsopen(&(0x7f0000000040)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000080)='size\x00', &(0x7f00000000c0)='10M\x00', 0x0) r6 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0) pwritev(r6, &(0x7f0000002600)=[{&(0x7f0000002480)="a9", 0x1}, {0x0}], 0x2, 0x9, 0xfffff800) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) syz_emit_ethernet(0x9a, &(0x7f0000000240)=ANY=[@ANYBLOB="0180c200000000000000000086dd601b000000641100fe8000000000000000000000000000aaff020000000000f8000000000000000140000e22006490780200000000000000020000001983426a97e3503bbbc12ef01ae488918c1ea89a08a25f78de9f802d2628cc4bb6af91bfb69252b136c8f50eaee89ebe26e39726e261b1997fe90de784"], 0x0) 0s ago: executing program 1 (id=83): r0 = gettid() socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x6, &(0x7f0000000300)=0x0) io_pgetevents(r1, 0x4, 0x4, &(0x7f0000000340)=[{}, {}, {}, {}], 0x0, 0x0) eventfd2(0x0, 0x80800) io_submit(r1, 0x0, &(0x7f0000000140)) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.99' (ED25519) to the list of known hosts. [ 74.620552][ T5767] cgroup: Unknown subsys name 'net' [ 74.754659][ T5767] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 76.488246][ T5767] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 78.624264][ T5781] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 78.633463][ T5781] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 78.641383][ T5781] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 78.679358][ T5781] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 78.688782][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 78.696240][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 78.718356][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 78.727819][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 78.735867][ T5788] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 78.748093][ T5788] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 78.757100][ T5788] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 78.765407][ T5788] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 78.808444][ T5785] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 78.819703][ T5086] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 78.828353][ T5788] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 78.837776][ T5788] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 78.845046][ T5086] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 78.853436][ T5788] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 78.861984][ T5086] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 78.869488][ T5788] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 78.879151][ T5788] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 78.902943][ T5781] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 78.917677][ T5781] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 78.925085][ T5781] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 79.230549][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 79.358150][ T5783] chnl_net:caif_netlink_parms(): no params data found [ 79.373958][ T5786] chnl_net:caif_netlink_parms(): no params data found [ 79.465394][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.473583][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.481533][ T5779] bridge_slave_0: entered allmulticast mode [ 79.489586][ T5779] bridge_slave_0: entered promiscuous mode [ 79.499855][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.506965][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.514293][ T5779] bridge_slave_1: entered allmulticast mode [ 79.522724][ T5779] bridge_slave_1: entered promiscuous mode [ 79.569073][ T5784] chnl_net:caif_netlink_parms(): no params data found [ 79.614552][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.628145][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.648932][ T5786] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.656133][ T5786] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.663585][ T5786] bridge_slave_0: entered allmulticast mode [ 79.671159][ T5786] bridge_slave_0: entered promiscuous mode [ 79.715275][ T5786] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.723022][ T5786] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.730361][ T5786] bridge_slave_1: entered allmulticast mode [ 79.737229][ T5786] bridge_slave_1: entered promiscuous mode [ 79.775597][ T5779] team0: Port device team_slave_0 added [ 79.785631][ T5783] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.792938][ T5783] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.800446][ T5783] bridge_slave_0: entered allmulticast mode [ 79.807228][ T5783] bridge_slave_0: entered promiscuous mode [ 79.834015][ T5786] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.848853][ T5779] team0: Port device team_slave_1 added [ 79.854878][ T5783] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.864786][ T5783] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.872026][ T5783] bridge_slave_1: entered allmulticast mode [ 79.879937][ T5783] bridge_slave_1: entered promiscuous mode [ 79.888500][ T5786] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.966716][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.973875][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.000096][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.036773][ T5786] team0: Port device team_slave_0 added [ 80.045729][ T5783] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.059515][ T5783] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.069400][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.076367][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.102625][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.115549][ T5786] team0: Port device team_slave_1 added [ 80.122448][ T5784] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.130182][ T5784] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.137409][ T5784] bridge_slave_0: entered allmulticast mode [ 80.144343][ T5784] bridge_slave_0: entered promiscuous mode [ 80.196235][ T5784] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.203867][ T5784] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.211453][ T5784] bridge_slave_1: entered allmulticast mode [ 80.219251][ T5784] bridge_slave_1: entered promiscuous mode [ 80.248590][ T5783] team0: Port device team_slave_0 added [ 80.265830][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.272987][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.299747][ T5786] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.312733][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.320469][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.346803][ T5786] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.362982][ T5784] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.373674][ T5783] team0: Port device team_slave_1 added [ 80.412023][ T5784] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.439120][ T5779] hsr_slave_0: entered promiscuous mode [ 80.445675][ T5779] hsr_slave_1: entered promiscuous mode [ 80.541034][ T5783] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.548101][ T5783] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.576070][ T5783] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.589989][ T5783] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.596967][ T5783] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.623548][ T5783] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.640475][ T5784] team0: Port device team_slave_0 added [ 80.652863][ T5786] hsr_slave_0: entered promiscuous mode [ 80.661243][ T5786] hsr_slave_1: entered promiscuous mode [ 80.668514][ T5786] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.676236][ T5786] Cannot create hsr debugfs directory [ 80.702698][ T5784] team0: Port device team_slave_1 added [ 80.778288][ T5785] Bluetooth: hci0: command tx timeout [ 80.792062][ T5783] hsr_slave_0: entered promiscuous mode [ 80.798849][ T5783] hsr_slave_1: entered promiscuous mode [ 80.804925][ T5783] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.813080][ T5783] Cannot create hsr debugfs directory [ 80.833195][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.840268][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.866495][ T5785] Bluetooth: hci2: command tx timeout [ 80.872258][ T5784] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.900433][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.907777][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.933944][ T5784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.944620][ T5785] Bluetooth: hci1: command tx timeout [ 81.017592][ T5785] Bluetooth: hci3: command tx timeout [ 81.102797][ T5784] hsr_slave_0: entered promiscuous mode [ 81.109639][ T5784] hsr_slave_1: entered promiscuous mode [ 81.115832][ T5784] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.123549][ T5784] Cannot create hsr debugfs directory [ 81.289589][ T5779] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 81.302433][ T5779] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 81.333284][ T5779] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 81.344671][ T5779] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 81.481392][ T5786] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 81.502657][ T5786] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 81.512920][ T5786] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 81.526952][ T5786] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 81.600885][ T5783] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 81.625967][ T5783] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 81.636736][ T5783] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 81.653760][ T5783] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 81.717326][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.782762][ T5784] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 81.793457][ T5784] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 81.807109][ T5784] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 81.822439][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.835179][ T5784] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 81.852642][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.860083][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.903792][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.910959][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.974937][ T5786] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.042975][ T5783] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.079938][ T5786] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.101915][ T5784] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.128528][ T2925] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.135667][ T2925] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.149671][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.156841][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.176656][ T5783] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.214898][ T2920] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.222148][ T2920] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.245856][ T5784] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.301951][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.309184][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.324654][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.331803][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.343549][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.350700][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.576373][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.756596][ T5779] veth0_vlan: entered promiscuous mode [ 82.810813][ T5779] veth1_vlan: entered promiscuous mode [ 82.858765][ T5785] Bluetooth: hci0: command tx timeout [ 82.937782][ T5785] Bluetooth: hci2: command tx timeout [ 82.975897][ T5779] veth0_macvtap: entered promiscuous mode [ 83.006249][ T5779] veth1_macvtap: entered promiscuous mode [ 83.018843][ T5785] Bluetooth: hci1: command tx timeout [ 83.052276][ T5786] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.064697][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.093478][ T5784] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.108516][ T5785] Bluetooth: hci3: command tx timeout [ 83.121458][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.169379][ T5779] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.180132][ T5779] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.189920][ T5779] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.199025][ T5779] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.216842][ T5783] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.271578][ T5786] veth0_vlan: entered promiscuous mode [ 83.342913][ T5786] veth1_vlan: entered promiscuous mode [ 83.355160][ T5784] veth0_vlan: entered promiscuous mode [ 83.405033][ T5783] veth0_vlan: entered promiscuous mode [ 83.426005][ T5784] veth1_vlan: entered promiscuous mode [ 83.431121][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.444832][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.484257][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.490203][ T5783] veth1_vlan: entered promiscuous mode [ 83.500778][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.570808][ T5786] veth0_macvtap: entered promiscuous mode [ 83.615353][ T5786] veth1_macvtap: entered promiscuous mode [ 83.627309][ T5783] veth0_macvtap: entered promiscuous mode [ 83.645686][ T5783] veth1_macvtap: entered promiscuous mode [ 83.687297][ T5784] veth0_macvtap: entered promiscuous mode [ 83.736093][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.755808][ T5785] Bluetooth: Unknown BR/EDR signaling command 0x0e [ 83.756946][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.763040][ T5785] Bluetooth: Wrong link type (-22) [ 83.775705][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.790853][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.801470][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.813378][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.833913][ T5786] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.843073][ T5786] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.854595][ T5786] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.863405][ T5786] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.886810][ T5784] veth1_macvtap: entered promiscuous mode [ 83.905982][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.917904][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.928406][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.939141][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.954324][ T5783] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.984076][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.994954][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.005055][ T5783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.016134][ T5783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.027897][ T5783] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.040159][ T5783] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.049402][ T5783] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.060608][ T5783] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.069984][ T5783] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.115329][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.126414][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.136907][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.149786][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.159858][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.170423][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.183624][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.233880][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.246800][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.256931][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.268593][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.278471][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.290531][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.319959][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.394868][ T2920] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.418592][ T5784] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.429790][ T5784] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.434467][ T2920] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.439748][ T5784] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.465805][ T5784] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.592643][ T2960] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.596902][ T5846] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 84.618859][ T2960] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.712285][ T2920] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.735418][ T2920] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.841192][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.883133][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.919599][ T2960] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.931968][ T2960] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.941773][ T5785] Bluetooth: hci0: command tx timeout [ 84.995075][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.003143][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.030575][ T5785] Bluetooth: hci2: command tx timeout [ 85.110247][ T5785] Bluetooth: hci1: command tx timeout [ 85.178361][ T5785] Bluetooth: hci3: command tx timeout [ 85.388150][ T5855] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7'. [ 86.070189][ T5818] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 86.311554][ T5818] usb 4-1: Using ep0 maxpacket: 32 [ 86.338673][ T5818] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 86.367620][ T5818] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 86.399887][ T5818] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 86.417698][ T5818] usb 4-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 86.428471][ T5818] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.452015][ T5818] usb 4-1: config 0 descriptor?? [ 87.018916][ T5785] Bluetooth: hci0: command tx timeout [ 87.038751][ T5870] kvm: pic: non byte write [ 87.105984][ T5785] Bluetooth: hci2: command tx timeout [ 87.110113][ T5818] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0001/input/input5 [ 87.181532][ T5785] Bluetooth: hci1: command tx timeout [ 87.245468][ T5818] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0001/input/input6 [ 87.265523][ T5785] Bluetooth: hci3: command tx timeout [ 87.431532][ T5818] kye 0003:0458:5011.0001: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0458:5011] on usb-dummy_hcd.3-1/input0 [ 87.505791][ T5878] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 87.538578][ T5878] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 87.717156][ T5882] syzkaller0: entered promiscuous mode [ 87.743407][ T5882] syzkaller0: entered allmulticast mode [ 87.953302][ T5882] tipc: Started in network mode [ 87.979123][ T5882] tipc: Node identity 9a19841de039, cluster identity 4711 [ 88.012482][ T5882] tipc: Enabled bearer , priority 0 [ 88.108370][ T5881] tipc: Resetting bearer [ 88.183270][ T5890] netlink: 60 bytes leftover after parsing attributes in process `syz.0.14'. [ 88.261586][ T5881] tipc: Disabling bearer [ 88.347198][ C0] kye 0003:0458:5011.0001: usb_submit_urb(ctrl) failed: -1 [ 88.378605][ T175] usb 4-1: USB disconnect, device number 2 [ 90.519677][ T5850] Set syz1 is full, maxelem 65536 reached [ 90.785712][ T5939] syz.2.24[5939]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 90.924799][ T5945] Zero length message leads to an empty skb [ 91.594490][ T5963] syzkaller0: entered promiscuous mode [ 91.601061][ T5963] syzkaller0: entered allmulticast mode [ 91.887534][ T28] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 91.953660][ T5976] netlink: 60 bytes leftover after parsing attributes in process `syz.1.39'. [ 92.059073][ T5979] nvme_fabrics: unknown parameter or missing value '#! 1R?&n%~[6=p͊yz\Uj@5NfWrs)q' in ctrl creation request [ 92.080503][ T789] cfg80211: failed to load regulatory.db [ 92.099025][ T5979] process 'syz.3.38' launched '/dev/fd/6' with NULL argv: empty string added [ 92.127480][ T28] usb 1-1: Using ep0 maxpacket: 16 [ 92.142023][ T28] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 92.171892][ T28] usb 1-1: config 0 interface 0 has no altsetting 0 [ 92.219508][ T28] usb 1-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 92.234354][ T28] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.242809][ T28] usb 1-1: Product: syz [ 92.247046][ T28] usb 1-1: Manufacturer: syz [ 92.253226][ T28] usb 1-1: SerialNumber: syz [ 92.261412][ T28] usb 1-1: config 0 descriptor?? [ 92.554955][ T5979] nvme nvme0: failed to connect socket: -111 [ 92.565840][ T28] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input7 [ 92.927862][ T28] rc_core: IR keymap rc-imon-pad not found [ 92.952034][ T28] Registered IR keymap rc-empty [ 92.959546][ T28] imon 1-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 92.972611][ T28] imon 1-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 93.019159][ T28] rc rc0: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 93.063487][ T28] input: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input8 [ 93.101512][ T5989] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 93.115285][ T28] imon 1-1:0.0: iMON device (15c2:0041, intf0) on usb<1:2> initialized [ 93.478032][ T5964] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 93.508599][ T5964] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 94.036485][ T6002] syzkaller0: entered promiscuous mode [ 94.043042][ T6002] syzkaller0: entered allmulticast mode [ 94.057705][ T8] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 94.268348][ T8] usb 3-1: Using ep0 maxpacket: 16 [ 94.312245][ T8] usb 3-1: config 1 has an invalid descriptor of length 240, skipping remainder of the config [ 94.325484][ T8] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 94.346427][ T8] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 94.363774][ T8] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.373319][ T8] usb 3-1: Product: syz [ 94.384693][ T8] usb 3-1: Manufacturer: syz [ 94.390568][ T8] usb 3-1: SerialNumber: syz [ 94.614627][ C1] imon 1-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 94.615132][ T5837] usb 1-1: USB disconnect, device number 2 [ 94.630967][ T6013] netlink: 60 bytes leftover after parsing attributes in process `syz.3.51'. [ 94.669873][ T8] usb 3-1: 0:2 : does not exist [ 94.737046][ T8] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 94.869319][ T8] usb 3-1: USB disconnect, device number 2 [ 95.004787][ T5780] udevd[5780]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 95.009595][ T5818] IPVS: starting estimator thread 0... [ 95.135862][ T6025] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 95.147648][ T6023] IPVS: using max 19 ests per chain, 45600 per kthread [ 95.386028][ T6032] syzkaller0: entered promiscuous mode [ 95.395322][ T6032] syzkaller0: entered allmulticast mode [ 95.498304][ T5818] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 95.727507][ T5818] usb 2-1: Using ep0 maxpacket: 16 [ 95.734635][ T5818] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 95.761994][ T5818] usb 2-1: config 0 interface 0 has no altsetting 0 [ 95.777233][ T5818] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 95.790026][ T5818] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.791366][ T6044] netlink: 12 bytes leftover after parsing attributes in process `syz.2.62'. [ 95.812719][ T6042] netlink: 8 bytes leftover after parsing attributes in process `syz.0.63'. [ 95.819231][ T5818] usb 2-1: config 0 descriptor?? [ 95.866948][ T6044] netlink: 40 bytes leftover after parsing attributes in process `syz.2.62'. [ 96.083513][ T6018] IPVS: rr: FWM 3 0x00000003 - no destination available [ 96.117674][ T5818] usbhid 2-1:0.0: can't add hid device: -71 [ 96.123757][ T5818] usbhid: probe of 2-1:0.0 failed with error -71 [ 96.138013][ T175] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 96.165488][ T5818] usb 2-1: USB disconnect, device number 2 [ 96.335362][ T6056] syzkaller0: entered promiscuous mode [ 96.349743][ T175] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 96.360434][ T6056] syzkaller0: entered allmulticast mode [ 96.364223][ T175] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.385018][ T175] usb 1-1: Product: syz [ 96.389330][ T175] usb 1-1: Manufacturer: syz [ 96.394101][ T175] usb 1-1: SerialNumber: syz [ 96.402633][ T175] usb 1-1: config 0 descriptor?? [ 96.840388][ T175] usb 1-1: Firmware: major: 0, minor: 65, hardware type: ATUSB (0) [ 97.092836][ T175] usb 1-1: failed to fetch extended address, random address set [ 97.207883][ T175] usb 1-1: USB disconnect, device number 3 [ 97.868640][ T6085] syzkaller0: entered promiscuous mode [ 97.884430][ T6085] syzkaller0: entered allmulticast mode [ 98.048618][ T6090] syzkaller0: entered promiscuous mode [ 98.054187][ T6090] syzkaller0: entered allmulticast mode [ 98.098269][ T6090] [ 98.100673][ T6090] ============================================ [ 98.106860][ T6090] WARNING: possible recursive locking detected [ 98.113057][ T6090] syzkaller #0 Not tainted [ 98.117510][ T6090] -------------------------------------------- [ 98.123701][ T6090] syz.0.80/6090 is trying to acquire lock: [ 98.129539][ T6090] ffff88802a558108 (&sch->root_lock_key#47){+...}-{2:2}, at: __dev_queue_xmit+0xb01/0x3640 [ 98.139840][ T6090] [ 98.139840][ T6090] but task is already holding lock: [ 98.147232][ T6090] ffff88802a558108 (&sch->root_lock_key#47){+...}-{2:2}, at: __dev_queue_xmit+0xb01/0x3640 [ 98.157368][ T6090] [ 98.157368][ T6090] other info that might help us debug this: [ 98.165525][ T6090] Possible unsafe locking scenario: [ 98.165525][ T6090] [ 98.173266][ T6090] CPU0 [ 98.176550][ T6090] ---- [ 98.179835][ T6090] lock(&sch->root_lock_key#47); [ 98.184887][ T6090] lock(&sch->root_lock_key#47); [ 98.189923][ T6090] [ 98.189923][ T6090] *** DEADLOCK *** [ 98.189923][ T6090] [ 98.198070][ T6090] May be due to missing lock nesting notation [ 98.198070][ T6090] [ 98.206395][ T6090] 3 locks held by syz.0.80/6090: [ 98.211346][ T6090] #0: ffffffff8d131e00 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x275/0x3640 [ 98.222088][ T6090] #1: ffff88802a558108 (&sch->root_lock_key#47){+...}-{2:2}, at: __dev_queue_xmit+0xb01/0x3640 [ 98.232900][ T6090] #2: ffffffff8d131e00 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x275/0x3640 [ 98.242888][ T6090] [ 98.242888][ T6090] stack backtrace: [ 98.248811][ T6090] CPU: 0 PID: 6090 Comm: syz.0.80 Not tainted syzkaller #0 [ 98.256017][ T6090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 98.266097][ T6090] Call Trace: [ 98.269388][ T6090] [ 98.272331][ T6090] dump_stack_lvl+0x18c/0x250 [ 98.277720][ T6090] ? show_regs_print_info+0x20/0x20 [ 98.283043][ T6090] ? print_deadlock_bug+0x435/0x5d0 [ 98.288269][ T6090] __lock_acquire+0x6809/0x7d80 [ 98.293138][ T6090] ? lockdep_lock+0x230/0x230 [ 98.297825][ T6090] ? verify_lock_unused+0x140/0x140 [ 98.303035][ T6090] ? add_lock_to_list+0x191/0x280 [ 98.308089][ T6090] ? verify_lock_unused+0x140/0x140 [ 98.313296][ T6090] ? __lock_acquire+0x357f/0x7d80 [ 98.318336][ T6090] lock_acquire+0x19e/0x420 [ 98.322854][ T6090] ? __dev_queue_xmit+0xb01/0x3640 [ 98.328002][ T6090] ? read_lock_is_recursive+0x20/0x20 [ 98.333382][ T6090] ? rcu_lockdep_current_cpu_online+0x37/0x120 [ 98.339625][ T6090] ? rcu_read_lock_bh_held+0x7a/0x100 [ 98.345007][ T6090] ? rcu_read_lock_held+0x40/0x40 [ 98.350044][ T6090] _raw_spin_lock+0x2e/0x40 [ 98.354648][ T6090] ? __dev_queue_xmit+0xb01/0x3640 [ 98.359778][ T6090] __dev_queue_xmit+0xb01/0x3640 [ 98.364735][ T6090] ? __dev_queue_xmit+0x275/0x3640 [ 98.371219][ T6090] ? __lock_acquire+0x7d80/0x7d80 [ 98.376285][ T6090] ? lock_chain_count+0x20/0x20 [ 98.381177][ T6090] ? __kernel_text_address+0xd/0x30 [ 98.386457][ T6090] ? netdev_core_pick_tx+0x370/0x370 [ 98.391966][ T6090] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 98.398005][ T6090] ? lockdep_hardirqs_on+0x98/0x150 [ 98.403235][ T6090] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 98.409327][ T6090] ? _raw_spin_unlock+0x40/0x40 [ 98.414284][ T6090] ? stack_trace_save+0xaa/0x100 [ 98.419250][ T6090] ? stack_trace_snprint+0xf0/0xf0 [ 98.424377][ T6090] ? tcf_action_inc_overlimit_qstats+0x120/0x120 [ 98.430728][ T6090] sch_frag_xmit_hook+0x2a8/0x11d0 [ 98.435859][ T6090] ? kasan_set_track+0x4e/0x70 [ 98.440716][ T6090] ? __kasan_slab_alloc+0x6c/0x80 [ 98.445758][ T6090] ? slab_post_alloc_hook+0x6a/0x4d0 [ 98.451072][ T6090] ? skb_clone+0x1eb/0x370 [ 98.455507][ T6090] ? tcf_mirred_act+0x589/0x1350 [ 98.460640][ T6090] ? tcf_action_exec+0x1a9/0x5d0 [ 98.465598][ T6090] ? basic_classify+0x1b2/0x2d0 [ 98.470475][ T6090] ? tcf_classify+0x421/0xfc0 [ 98.475166][ T6090] ? qfq_enqueue+0x320/0x12e0 [ 98.479859][ T6090] ? dev_qdisc_enqueue+0x48/0x220 [ 98.484898][ T6090] ? __dev_queue_xmit+0xcd4/0x3640 [ 98.490114][ T6090] ? packet_sendmsg+0x38d9/0x4a30 [ 98.495163][ T6090] ? ____sys_sendmsg+0x61b/0x980 [ 98.500127][ T6090] ? ___sys_sendmsg+0x2a6/0x360 [ 98.504997][ T6090] ? __se_sys_sendmsg+0x1d0/0x2c0 [ 98.511167][ T6090] ? mq_dump_class_stats+0x450/0x450 [ 98.516477][ T6090] ? __copy_skb_header+0xa3/0x4a0 [ 98.521513][ T6090] ? __asan_memcpy+0x40/0x70 [ 98.526137][ T6090] ? __skb_clone+0x5c/0x6c0 [ 98.530794][ T6090] ? __skb_clone+0x446/0x6c0 [ 98.535417][ T6090] ? skb_clone+0x21f/0x370 [ 98.539844][ T6090] ? tcf_mirred_act+0x570/0x1350 [ 98.544815][ T6090] tcf_mirred_act+0xbd6/0x1350 [ 98.549602][ T6090] tcf_action_exec+0x1a9/0x5d0 [ 98.554383][ T6090] basic_classify+0x1b2/0x2d0 [ 98.559087][ T6090] tcf_classify+0x421/0xfc0 [ 98.563623][ T6090] qfq_enqueue+0x320/0x12e0 [ 98.568139][ T6090] ? sch_tree_lock+0x1b0/0x1b0 [ 98.572934][ T6090] ? do_raw_spin_lock+0x11f/0x2b0 [ 98.578079][ T6090] ? __rwlock_init+0x150/0x150 [ 98.583474][ T6090] dev_qdisc_enqueue+0x48/0x220 [ 98.588346][ T6090] ? __dev_queue_xmit+0xb88/0x3640 [ 98.593475][ T6090] __dev_queue_xmit+0xcd4/0x3640 [ 98.598448][ T6090] ? __dev_queue_xmit+0x275/0x3640 [ 98.603581][ T6090] ? skb_partial_csum_set+0xf2/0x350 [ 98.608977][ T6090] ? netdev_core_pick_tx+0x370/0x370 [ 98.614622][ T6090] ? virtio_net_hdr_to_skb+0xcd8/0x1470 [ 98.620280][ T6090] ? packet_extra_vlan_len_allowed+0x200/0x200 [ 98.626463][ T6090] ? packet_xmit+0x66/0x340 [ 98.630981][ T6090] packet_sendmsg+0x38d9/0x4a30 [ 98.635853][ T6090] ? aa_sk_perm+0x970/0x970 [ 98.640381][ T6090] ? __might_sleep+0xe0/0xe0 [ 98.644991][ T6090] ? verify_lock_unused+0x140/0x140 [ 98.650223][ T6090] ? lockdep_hardirqs_on+0x98/0x150 [ 98.655476][ T6090] ? aa_sk_perm+0x83c/0x970 [ 98.660014][ T6090] ? packet_getsockopt+0xad0/0xad0 [ 98.665147][ T6090] ? tomoyo_warn_oom+0xbe/0xf0 [ 98.669933][ T6090] ? aa_sock_msg_perm+0x94/0x150 [ 98.674888][ T6090] ? apparmor_socket_sendmsg+0x8e/0x330 [ 98.680448][ T6090] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 98.685771][ T6090] ? security_socket_sendmsg+0x80/0xa0 [ 98.691285][ T6090] ? packet_getsockopt+0xad0/0xad0 [ 98.696421][ T6090] ____sys_sendmsg+0x61b/0x980 [ 98.701235][ T6090] ? __asan_memset+0x22/0x40 [ 98.705879][ T6090] ? __sys_sendmsg_sock+0x30/0x30 [ 98.710960][ T6090] ? __import_iovec+0x5f2/0x850 [ 98.715847][ T6090] ? import_iovec+0x73/0xa0 [ 98.720368][ T6090] ___sys_sendmsg+0x2a6/0x360 [ 98.725081][ T6090] ? __sys_sendmsg+0x2b0/0x2b0 [ 98.729895][ T6090] __se_sys_sendmsg+0x1d0/0x2c0 [ 98.734862][ T6090] ? __x64_sys_sendmsg+0x80/0x80 [ 98.739818][ T6090] ? lockdep_hardirqs_on+0x98/0x150 [ 98.745216][ T6090] do_syscall_64+0x55/0xb0 [ 98.749643][ T6090] ? clear_bhb_loop+0x40/0x90 [ 98.754413][ T6090] ? clear_bhb_loop+0x40/0x90 [ 98.759124][ T6090] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 98.765033][ T6090] RIP: 0033:0x7f56b119e0d9 [ 98.769463][ T6090] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.789733][ T6090] RSP: 002b:00007f56b20db028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 98.798174][ T6090] RAX: ffffffffffffffda RBX: 00007f56b1425fa0 RCX: 00007f56b119e0d9 [ 98.806158][ T6090] RDX: 0000000000004005 RSI: 0000200000000280 RDI: 0000000000000009 [ 98.814400][ T6090] RBP: 00007f56b1235024 R08: 0000000000000000 R09: 0000000000000000 [ 98.822391][ T6090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.830402][ T6090] R13: 00007f56b1426038 R14: 00007f56b1425fa0 R15: 00007ffe81592b78 [ 98.838395][ T6090]