last executing test programs: 5m17.491979683s ago: executing program 32 (id=271): openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x23d, &(0x7f0000000200)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r0, 0x2def, 0x0, 0x0, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="00006003ffffffffffffaaaaaaaaaa020800480000200000e000dc2f"], 0x32) syz_usb_connect(0x1, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000009a65d0860040800dee20102030109021b05000000000009040000f678eaf50009058402"], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) 2m57.030171805s ago: executing program 1 (id=829): r0 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_QUERYMENU(r0, 0xc02c5625, &(0x7f0000000040)={0x98f907, 0x2, @name="f4e06b0a1e730e142a5c1e8623218cb8167a99b19faf6797ae55586411baebc8"}) (fail_nth: 3) 2m56.768466864s ago: executing program 1 (id=831): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000340)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x0, &(0x7f0000000280), &(0x7f0000c57000), 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f00002e3000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2}) 2m56.745280676s ago: executing program 1 (id=832): r0 = socket(0x10, 0x3, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000001c0)={r1, 0x1, 0x6, @broadcast}, 0x10) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r6, {0x3, 0x3}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_INDEV={0x14, 0x2, 'ip6erspan0\x00'}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) userfaultfd(0x80000) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r2], 0x40}}, 0x0) ioctl$PPPIOCSMRU1(r2, 0x40047452, &(0x7f0000000000)=0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/exec\x00') ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={r7, 0x0, {0x2a00, 0x80010000, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1d, 0x14, "fee8a2ab78fcffffffffffffff2000b8785d960000000000000000000000000f0000000000010000861c5d5200000000000000000200", "2809e897bdb2128bfc82525edd665240f45f819e01982861ac0000000000000000001100", "90be8b1c751265406c7f306003d8a0f4bd00000041140002000000000700", [0x20]}}) r8 = openat$kvm(0xffffffffffffff9c, 0x0, 0x60b03, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(0xffffffffffffffff, 0x4068aea3, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) recvmmsg(r11, &(0x7f0000005c80), 0x400030f, 0x0, 0x0) listen(r11, 0xd3) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) 2m55.758068754s ago: executing program 0 (id=834): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x5c, 0x30, 0x1, 0x0, 0x0, {}, [{0x48, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xffffffff, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x804}, 0x0) openat$udambuf(0xffffff9c, &(0x7f00000001c0), 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x14, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) syz_usb_connect$uac1(0x6, 0x82, &(0x7f0000000000)=ANY=[], 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 2m38.946356742s ago: executing program 33 (id=832): r0 = socket(0x10, 0x3, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000001c0)={r1, 0x1, 0x6, @broadcast}, 0x10) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r6, {0x3, 0x3}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_INDEV={0x14, 0x2, 'ip6erspan0\x00'}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) userfaultfd(0x80000) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r2], 0x40}}, 0x0) ioctl$PPPIOCSMRU1(r2, 0x40047452, &(0x7f0000000000)=0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/exec\x00') ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={r7, 0x0, {0x2a00, 0x80010000, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1d, 0x14, "fee8a2ab78fcffffffffffffff2000b8785d960000000000000000000000000f0000000000010000861c5d5200000000000000000200", "2809e897bdb2128bfc82525edd665240f45f819e01982861ac0000000000000000001100", "90be8b1c751265406c7f306003d8a0f4bd00000041140002000000000700", [0x20]}}) r8 = openat$kvm(0xffffffffffffff9c, 0x0, 0x60b03, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(0xffffffffffffffff, 0x4068aea3, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) recvmmsg(r11, &(0x7f0000005c80), 0x400030f, 0x0, 0x0) listen(r11, 0xd3) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) 2m38.772716451s ago: executing program 34 (id=822): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000540)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000a80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2m38.598415151s ago: executing program 35 (id=834): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x5c, 0x30, 0x1, 0x0, 0x0, {}, [{0x48, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xffffffff, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x804}, 0x0) openat$udambuf(0xffffff9c, &(0x7f00000001c0), 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x14, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) syz_usb_connect$uac1(0x6, 0x82, &(0x7f0000000000)=ANY=[], 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 2m32.772651496s ago: executing program 36 (id=835): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) set_mempolicy(0x4000, &(0x7f0000000040)=0xfff, 0x5) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x141740, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f0000000080)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f00000000c0)={0x48, 0x5, r1}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 2m15.798008757s ago: executing program 37 (id=833): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000100)={@link_local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x3, 0x0, 0x0, 0x6, 0x0, @empty, @empty}, {{0x30, 0x4e24, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x200, 0x0, 0x0, {[@mss={0x2, 0x4, 0xa005}]}}}}}}}, 0x0) mmap(&(0x7f00002e2000/0x4000)=nil, 0x4000, 0x5, 0x11, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x9, 0x2) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r1 = socket(0x2, 0x80805, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000180)=0xc) getresgid(&(0x7f00000001c0), &(0x7f0000000240), &(0x7f0000000280)=0x0) setsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000002c0)={r2, r4, r5}, 0xc) ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000003940)={0x3, 0x5, 0x7, 0x80000}) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000003980), 0x12200, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000039c0)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) r6 = getpid() prlimit64(r6, 0x2, &(0x7f0000000080)={0x3ff, 0x5}, &(0x7f0000000300)) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000003a00)={{{@in=@remote, @in6=@empty}}, {{@in6=@loopback}, 0x0, @in=@remote}}, &(0x7f0000003b00)=0xe8) lstat(&(0x7f0000003b40)='./file0\x00', 0x0) syz_clone(0x40009000, &(0x7f0000003c00)="59fae213adceef61bab54c1403146913ea658b7fc697e9f82b63f69d98e35f62cba2c8319e85b48096f8ed919d66a5851d2d998c2f47a74955bba3770ad9c759a1416bead9906ec0381d", 0x4a, &(0x7f0000003c80), &(0x7f0000003cc0), &(0x7f0000003d00)) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000003d40)={{{@in6=@dev, @in6=@ipv4={""/10, ""/2, @loopback}}}, {{@in6=@private2}, 0x0, @in6=@local}}, &(0x7f0000003e40)=0xe8) getpgid(0xffffffffffffffff) r7 = socket(0xa, 0x2, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r8, 0x0, r8) sendmmsg$unix(r1, 0x0, 0x0, 0x20000000) sendmmsg$inet(r1, 0x0, 0x0, 0x4000000) r9 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0xc, &(0x7f0000000240)=@assoc_value, &(0x7f00000002c0)=0x8) 51.77444589s ago: executing program 8 (id=874): r0 = getpid() r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/zoneinfo\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f00000000c0)={0x2020}, 0x2020) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r2, 0x50009405, &(0x7f0000000180)) process_vm_readv(r0, &(0x7f00000009c0)=[{&(0x7f0000000740)=""/246, 0xf6}, {&(0x7f0000000840)=""/190, 0xbe}], 0x2, &(0x7f0000000cc0)=[{&(0x7f0000003b40)=""/4096, 0x1000}], 0x1, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) preadv(r3, &(0x7f00000002c0)=[{&(0x7f0000000040)=""/1, 0x1}], 0x1, 0xb, 0x0) 51.524975945s ago: executing program 8 (id=876): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004c000078ac1414000a010100441405", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB='\\'], 0x0) r0 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d25a98", 0x3, 0xfffffffffffffffe) io_uring_enter(0xffffffffffffffff, 0x11d0, 0xb012, 0x20, &(0x7f0000000180)={[0x80000000]}, 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="48000000100005040000", @ANYBLOB="ebffffffffffffff280012800b00010065"], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x0) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 50.629805832s ago: executing program 6 (id=836): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200), 0x2018081, &(0x7f0000000240)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r5 = creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r6 = fanotify_init(0xf00, 0x0) fanotify_mark(r6, 0x105, 0x40009975, r5, 0x0) 50.541926916s ago: executing program 8 (id=880): r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) timerfd_gettime(0xffffffffffffffff, 0x0) listen(r0, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/kexec_crash_size', 0x20082, 0x2f0) sendfile(r4, r4, 0x0, 0xa) prctl$PR_GET_TID_ADDRESS(0x18, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'wg2\x00'}) 49.587502483s ago: executing program 8 (id=885): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x109491, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r8, &(0x7f0000000800)={0x2020}, 0x2027) 49.292078206s ago: executing program 6 (id=887): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x109491, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r8, &(0x7f0000000800)={0x2020}, 0x2027) 47.641875959s ago: executing program 8 (id=890): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r4 = socket$inet6(0xa, 0x802, 0x88) sendto$inet6(r4, 0x0, 0x0, 0x6008800, &(0x7f0000000180)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c) sendto$inet6(r4, 0x0, 0x1080, 0x0, 0x0, 0x0) getsockopt$sock_timeval(r3, 0x1, 0x43, 0x0, &(0x7f0000000040)) 47.54458647s ago: executing program 6 (id=891): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, 0x0) 47.317477568s ago: executing program 8 (id=893): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$rds(0x15, 0x5, 0x0) r2 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r3 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, r2) pipe2$watch_queue(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r4, 0x1e) r6 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x39, 0x30, 0x64, 0x30, 0x66, 0x36, 0x52, 0x39, 0x36, 0x36, 0x30, 0x36, 0x66, 0x30, 0x64, 0x39]}, &(0x7f0000000180)={0x0, "de8d0d27ca969fa15f8b3b7bae39c1b3327d4332f8c149d2d65a347d67f6db7eb90dfdad3cdebaaf421412f812305c9da91699b5a02c1295596f0fd9ec78f2fd", 0x2c}, 0x48, r2) keyctl$KEYCTL_MOVE(0x1e, r6, r2, r3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001100)={0x5, 0x0, 0xdddd1000, 0x2000, &(0x7f00008b7000/0x2000)=nil}) r7 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f00000010c0)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e22, @multicast2}]}, &(0x7f0000000180)=0x10) getsockopt$bt_hci(r7, 0x84, 0x6d, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) keyctl$read(0x2, 0x0, &(0x7f00000000c0)=""/4096, 0x1f01) r8 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe7000/0x18000)=nil, &(0x7f00000011c0)=[@text16={0x10, &(0x7f0000001280)="66b8000001000f23d80f21f86635c00000a00f23f866b92a0900000f326766c7442400090000006766c7442402000000006766c744240600000000670f01142465c8b60302c1fe3f0f005f0e660f14682eba6100b800a0ef66b9c50a00000f32f2af", 0x62}], 0x1, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000001180)=ANY=[@ANYRES32=0x0, @ANYRES8=r4, @ANYRESOCT=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x66, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r9 = socket$inet6(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000011c0)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffff4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000001240)='neigh_update\x00', r5}, 0x12) sendto$inet6(r9, &(0x7f00000000c0)="900000001c001f4d154a817393278bff0a80a578020000000104740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r10 = getpid() sched_setscheduler(r10, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r11, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r12, &(0x7f0000000000), 0x400000000000041, 0x0) 46.926431955s ago: executing program 38 (id=893): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$rds(0x15, 0x5, 0x0) r2 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r3 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, r2) pipe2$watch_queue(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r4, 0x1e) r6 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x39, 0x30, 0x64, 0x30, 0x66, 0x36, 0x52, 0x39, 0x36, 0x36, 0x30, 0x36, 0x66, 0x30, 0x64, 0x39]}, &(0x7f0000000180)={0x0, "de8d0d27ca969fa15f8b3b7bae39c1b3327d4332f8c149d2d65a347d67f6db7eb90dfdad3cdebaaf421412f812305c9da91699b5a02c1295596f0fd9ec78f2fd", 0x2c}, 0x48, r2) keyctl$KEYCTL_MOVE(0x1e, r6, r2, r3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001100)={0x5, 0x0, 0xdddd1000, 0x2000, &(0x7f00008b7000/0x2000)=nil}) r7 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f00000010c0)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e22, @multicast2}]}, &(0x7f0000000180)=0x10) getsockopt$bt_hci(r7, 0x84, 0x6d, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) keyctl$read(0x2, 0x0, &(0x7f00000000c0)=""/4096, 0x1f01) r8 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe7000/0x18000)=nil, &(0x7f00000011c0)=[@text16={0x10, &(0x7f0000001280)="66b8000001000f23d80f21f86635c00000a00f23f866b92a0900000f326766c7442400090000006766c7442402000000006766c744240600000000670f01142465c8b60302c1fe3f0f005f0e660f14682eba6100b800a0ef66b9c50a00000f32f2af", 0x62}], 0x1, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000001180)=ANY=[@ANYRES32=0x0, @ANYRES8=r4, @ANYRESOCT=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x66, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r9 = socket$inet6(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000011c0)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffff4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000001240)='neigh_update\x00', r5}, 0x12) sendto$inet6(r9, &(0x7f00000000c0)="900000001c001f4d154a817393278bff0a80a578020000000104740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r10 = getpid() sched_setscheduler(r10, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r11, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r12, &(0x7f0000000000), 0x400000000000041, 0x0) 45.881516356s ago: executing program 6 (id=898): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) pipe2(&(0x7f0000000080), 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000640)=0x7a, 0x4) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000d5030000020000838500000071000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000001040)=@newsa={0xf0, 0x10, 0x713, 0xffffff80, 0x0, {{@in=@broadcast, @in6=@remote, 0x0, 0x80ff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast2, {}, {}, {}, 0x0, 0x0, 0xa, 0x2}}, 0xf0}, 0x1, 0xe}, 0x0) syz_usb_connect(0x4, 0x0, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xc) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000e40)={0x1, 0x0, [{0x0, 0xf3, &(0x7f00000008c0)=""/243}]}) ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f00000002c0)={0x1, r3}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf, @void, @value}, 0x94) unshare(0x64000600) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r5, 0x0, 0x0) recvmmsg(r4, &(0x7f0000000dc0), 0x0, 0x40000002, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000140)={0x0, 0x0}, 0x10) 44.664436303s ago: executing program 39 (id=898): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) pipe2(&(0x7f0000000080), 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000640)=0x7a, 0x4) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000d5030000020000838500000071000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000001040)=@newsa={0xf0, 0x10, 0x713, 0xffffff80, 0x0, {{@in=@broadcast, @in6=@remote, 0x0, 0x80ff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast2, {}, {}, {}, 0x0, 0x0, 0xa, 0x2}}, 0xf0}, 0x1, 0xe}, 0x0) syz_usb_connect(0x4, 0x0, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xc) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000e40)={0x1, 0x0, [{0x0, 0xf3, &(0x7f00000008c0)=""/243}]}) ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f00000002c0)={0x1, r3}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf, @void, @value}, 0x94) unshare(0x64000600) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r5, 0x0, 0x0) recvmmsg(r4, &(0x7f0000000dc0), 0x0, 0x40000002, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000140)={0x0, 0x0}, 0x10) 41.976899612s ago: executing program 4 (id=910): r0 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) mmap(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x0, 0x18050, r0, 0xdb2d3000) (async) syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) shmctl$IPC_RMID(0xffffffffffffffff, 0x0) 41.423039964s ago: executing program 4 (id=911): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000b40)=ANY=[@ANYBLOB], 0x14}}, 0x0) 41.352341128s ago: executing program 4 (id=912): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) syz_init_net_socket$ax25(0x3, 0x2, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) getpriority(0x2, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd70000000000004000000130317"], 0x328}}, 0x84) r4 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$PIO_UNIMAP(r4, 0x4b67, &(0x7f0000000040)={0x3ffffffffffffe96, &(0x7f0000000000)=[{0x2000, 0x5}]}) 41.177271649s ago: executing program 9 (id=913): socket$kcm(0x2, 0x200000000000001, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(0x0, r1) sendmsg$NFC_CMD_START_POLL(r1, 0x0, 0x0) sendmsg$NFC_CMD_ACTIVATE_TARGET(r1, 0x0, 0x0) sendmsg$NFC_CMD_DEP_LINK_UP(r0, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r2, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0xffffffffffffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) readlinkat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=""/199, 0xc7) setsockopt$packet_int(r6, 0x107, 0x14, &(0x7f0000000180)=0x2, 0x4) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000000)=0x3da, 0x4) sendto$packet(r6, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) r7 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r7, 0x800442d2, 0x0) 40.194725131s ago: executing program 9 (id=914): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x1, 0x0) vmsplice(r3, &(0x7f0000000400)=[{&(0x7f0000000840)="042a346f234276951da823c4934899ba2c4b8c16f25f228028a7a21c064dce490ebb1e6d1466e440a9a03e4b96e22443dfe863a1dfb1f04046eb8d31a1ff9aacbd3183b5e505b0f5adba040cdc84d9bb9d09f89ddf7833f7882ca983e50f23d11540f64d620351e3b913c7faff54051834f45d57", 0x74}], 0x1, 0x6) read$FUSE(r2, &(0x7f0000000dc0)={0x2020}, 0x2020) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, 0x0) write(r0, 0x0, 0x0) 40.193301244s ago: executing program 4 (id=915): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x109491, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r8, &(0x7f0000000800)={0x2020}, 0x2027) 39.458641779s ago: executing program 9 (id=917): mount$tmpfs(0x0, &(0x7f0000000540)='./file1\x00', &(0x7f0000000180), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x10000000) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, @aes128, 0x0, @desc2}) r0 = openat(0xffffffffffffff9c, 0x0, 0x641, 0x0) flock(r0, 0x2) syz_emit_ethernet(0x72, &(0x7f0000000080)={@broadcast, @remote, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "f7d8ff", 0x3c, 0x3c, 0x0, @local, @mcast2, {[@hopopts={0x0, 0x4, '\x00', [@hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @hao={0xc9, 0x10, @mcast2}]}], {0x0, 0x0, 0xc, 0x0, @gue={{0x1, 0x0, 0x1, 0x0, 0x0, @void}}}}}}}}, 0x0) syz_emit_ethernet(0x82, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x0) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140), 0x2) r2 = memfd_create(&(0x7f0000000940)='y\x105\xfb\xf7u\x83%\b\x00\x00\x00\x00\x00\x00\x00\xea_\xccZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x10\x00\x00\x00\x04\x879\xa24\xa9a\b\x00\xb2\xd3\xcbZJ\x7fa\xc4\x1acB\xaa\xc1\xfb Q\x96\xd9xJ2\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea\b\x00\x00\x00\x00\x00\x00\x00\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9V\x01A\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\a\x00\x01vRk\xaabB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\x80\x81\xa0\xa2-g\b\x99\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecn\x02\xc8\xc4\f\x04\x99\xf6\xfc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8L\xae\x1ff\xcf\xb3\xb65\x12\x89\x02\x82t\x0f\xb0\xe89\x16\fO\x19\x91\xfd\x10\x0e\xa7r\x12\xab\xd4\xd1d\xad\f\x11\xb3\xb3c\xe2\xfe\xcd\x9f7\xa1\x14\xfa\xe2\xdf\x7f\xf4NG\xe3\xeb\x18\xde|\xb3\xf5S\x9a\x04\xb4Lry\xa9\xd6\xfb\xbc\n+N\xf7\xf6\x87\x95\xd9+\xd2sc/\x06\xaa#K3,k\xf3(\xcc\xc7\xb47\xfa\xc3\x1c\x91!\xd3\xd2`-\xa2xrR\x1c\x81i\x87u|29Q\xdf\xed\x10\x9b\x930\xa8v\xa0\x88\xa4t\x17\xb2\xca9\x02\x03\xc9P\xcc\xe0\xb7\x9c\x82\xb4\x03\x83e\xee\x95\xccO\x1b\x83\f\n{\xf3\x12\x90\xcf\x10\xb5>\b3\x80\x8d\xb2%7\x10\xeee\xe4\xc3\xb2^\xad\xb6~\xa2\xbdE\xbf\x91\vqt\x81\xbd\x19\xde\x81\tw\xd4p\xd1\x8aNJ\xb3M\a\xc4\xfa\xb0,$\x81j\xb4Hs\x93>\x16U\xd0t\xe4\xca0T\xb7\xf7\x9d4\b\xd9\xdeps\xec\xa0\nJ\xa5\xfe\xda{(\xee\xb5\x11?\xc3I-\x8bc\xc9\xfb\a\xe5\xab\xf8v1\xdc\xc5\x8c\xebs1\x81\xca\x81l\xa12\xff<\xf5\x12\xcc+\xd4\xab\x84\x16\xa4+\x0e\xd4\x02\xe3\xaa1\xeam\x8ce\xb4r\x0eo&3wff\xe6\x91\x7f\xba\xad\x05\xdd\xc0+\"\xa5\x80\'#\xfd\x9dA&\xee \x18\xe5\x17\x1bd\xd0\xb9\x90\xde\xec\xe4M\xe5\x06\x03r\fc\x8c\x10\x99x\xec`e`\xc3F\xdf\xbc\xa8\xff\x05\xe6\xea\xc3u\xd7\t\x88<\"\xf7!\xd6\x0e\xbbE^\xcd\xb0\x15g\xe6\xf2?y1\x9f\xd3\x95\xc4E\xd0\xb4\x16`r\x14\xad\x02\x17\x9a\x86I]\x02f\xd3\xc9\xe1H\xd7c\xcaQ\x8cE7\xcc\xcf=\xf3\xf7\xb9\xf6s\x88\bZi\b*w\xc5;\x88\r\xab\xa1\t\xf1\x02)5\x00\x84', 0xb) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x0, 0x100}, 0x0) ftruncate(r2, 0xffff) fcntl$addseals(r2, 0x409, 0x7) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f00000002c0)={r2, 0x0, 0x0, 0x8000}) 39.388742191s ago: executing program 9 (id=918): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x109491, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r8, &(0x7f0000000800)={0x2020}, 0x2027) 39.191306605s ago: executing program 4 (id=919): openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x200002, 0x0) r0 = io_uring_setup(0x220, &(0x7f0000000040)={0x0, 0x64b0, 0x10000, 0x1, 0x2f4}) io_uring_enter(r0, 0x206d, 0xda21, 0x64, &(0x7f00000000c0)={[0x7fffffff]}, 0x8) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x10, r0, 0x3a968000) (async) r1 = socket$l2tp(0x2, 0x2, 0x73) recvmmsg(r1, &(0x7f0000001800)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000001700)=[{&(0x7f0000000180)=""/153, 0x99}, {&(0x7f0000000240)=""/26, 0x1a}, {&(0x7f0000000280)=""/68, 0x44}, {&(0x7f0000000300)=""/120, 0x78}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001380)=""/12, 0xc}, {&(0x7f00000013c0)=""/255, 0xff}, {&(0x7f00000014c0)=""/180, 0xb4}, {&(0x7f0000001580)=""/195, 0xc3}, {&(0x7f0000001680)=""/75, 0x4b}], 0xa, &(0x7f00000017c0)=""/27, 0x1b}, 0x1}], 0x1, 0x0, &(0x7f0000001840)={0x77359400}) (async, rerun: 64) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001880), 0x42000, 0x0) (rerun: 64) read$msr(r3, &(0x7f00000018c0)=""/207, 0xcf) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000001a40)={'syztnl0\x00', &(0x7f0000001a00)={'gretap0\x00', 0x0, 0x8000, 0x7800, 0x57cb9b67, 0xfffffffd, {{0x6, 0x4, 0x1, 0x21, 0x18, 0x64, 0x0, 0x81, 0x6, 0x0, @multicast1, @local, {[@end]}}}}}) sendmsg$TCPDIAG_GETSOCK(r3, &(0x7f0000001bc0)={&(0x7f00000019c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001b80)={&(0x7f0000001a80)={0xcc, 0x12, 0x800, 0x70bd28, 0x25dfdbfe, {0x5, 0x2, 0x9, 0x7f, {0x4e21, 0x4e22, [0x7f, 0xd7a, 0x4, 0xace], [0x8, 0x4, 0x1ff, 0x800], r4, [0x80000000]}, 0x5, 0x3}, [@INET_DIAG_REQ_BYTECODE={0x7e, 0x1, "f88e3c0c3d7258dace97dc2953be3bf76498ba6bd4213804f309e7a50554e957483e518809f8f700444e40f45e5f789f1b23be0b8b8f098e69b7124af73303a46d70d377a8853a5e4e7bbc8180aca3f2b7f766b9d48c462ff3f282d8a5fdb526661d26d4228618a4d23e09664565b5ee9d523cfef18821f24aeb"}]}, 0xcc}, 0x1, 0x0, 0x0, 0x800}, 0x40011) (async) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f0000001c00)={0x7, 0x3}) pipe(&(0x7f0000001c40)={0xffffffffffffffff}) (async) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r3, 0x5000943f, &(0x7f0000001c80)={{r1}, 0x0, 0x10, @unused=[0x4, 0x9, 0xd, 0x7], @devid}) (async) r6 = socket(0x2, 0x6, 0x6) (async, rerun: 32) lstat(&(0x7f0000002cc0)='./file0\x00', &(0x7f0000002d00)={0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 32) sendmsg$nl_generic(r2, &(0x7f0000003040)={&(0x7f0000002c80)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000003000)={&(0x7f0000002d80)={0x280, 0x1b, 0x300, 0x70bd28, 0x25dfdbfe, {0xc}, [@typed={0x14, 0x4b, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}}, @nested={0x1b6, 0x124, 0x0, 0x1, [@typed={0x8, 0x79, 0x0, 0x0, @u32=0x9}, @generic="128ba8f3ed9437ed167303ca1f677cca758cc093f3df2015e3edda3ec69e297bf8807d9fccee671c563e66964c61504ca030e2e1e777bc5394f7faf97a9a9675a02cc998a90748c10ca891e6dc62d5d4b0d3056f7dd79af54e1068de7feb71739c7b8f85771a6963ef17eb482e5949b46e61e351e9040664b0c2ba6994bcb59ce12a87bcfefd13ad0be6bb4abae8fc62adaf7f77d3aa2a50e193607ed8787a156c24fc36ee1b357bcff37eb1163dd4d3190dad2f43", @generic="ca3e104213acc7817cabdfb236d58ee68844e42f5a6dc1e2f229391a5971df71c97d47857f5f599a23a55c1efbe52a1da1ce8f700abd56c947d848689a16333995703d29c0c2e482b3fe89c4095a72c0407aecd9c99a241af00af041ad586959261b660db1c56dd1b3ccd4ffe47ce9190ce431287ebbfd89f4979ba05dd879f626e4a71ea896588350449e53b45e20428ef24575b5fc1b421892e3c1fe63dbd4083b9b8368b508d38ad73a239651fa200ef2e2a6e7e531d6288b19e1c1760bf284e162d797c7e964a3e5a598c5b94c1ea27e739a21", @typed={0x9, 0x5d, 0x0, 0x0, @str='+]:\xb0\x00'}, @nested={0x4, 0x60}, @nested={0x4, 0x115}, @nested={0x4, 0x11a}, @nested={0x4, 0xa9}, @nested={0x4, 0xba}]}, @typed={0x8, 0x61, 0x0, 0x0, @uid=r7}, @generic="896feaf490bb088dd497907d3012614b0b4907ad1e8aac0f425c83d753658d23666d0e7db4189a4e298fd889daeab0df288daf66684901af4fe0e98af68357bcaf7671216dd5863742509f71172d194bc5dc138511ec880246bf60cfdfb64611b22ecec186d0563551f1480c06bbebe57f7d5f4a6a2d03b766de0ee931a94410612956a52be6d029936230eb78ae39e713899486c6"]}, 0x280}, 0x1, 0x0, 0x0, 0x240088d1}, 0x14) (async, rerun: 64) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000003080), 0x462000, 0x0) (rerun: 64) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r5, 0x3ba0, &(0x7f00000030c0)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_GET_HW_INFO(r8, 0x3b8a, &(0x7f0000003200)={0x28, 0x0, r9, 0x86, &(0x7f0000003140)=""/134}) (async) getsockname$packet(r2, &(0x7f0000003240), &(0x7f0000003280)=0x14) (async, rerun: 64) r10 = open(&(0x7f00000032c0)='./file0\x00', 0x2240, 0x132) (async, rerun: 64) openat$mixer(0xffffffffffffff9c, &(0x7f0000003300), 0x10000, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000003340)) setsockopt$inet6_tcp_int(r6, 0x6, 0x19, &(0x7f0000003380)=0x3, 0x4) (async) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f00000033c0)=0x2) (async) ioctl$BTRFS_IOC_BALANCE_V2(r8, 0xc4009420, &(0x7f0000003400)={0x0, 0x7, {0xa8, @usage=0x1000, 0x0, 0x200, 0xff, 0x7f, 0x0, 0x60, 0xc, @usage=0x100, 0x40, 0x7, [0x1, 0x5, 0x1, 0x0, 0x3, 0x600000000000000]}, {0x1, @usage=0xb, 0x0, 0x7, 0xffffffffffffff00, 0x0, 0x6, 0x1, 0x0, @struct={0x21, 0x8}, 0x0, 0x5, [0xffffffffffffffa4, 0x4, 0xffffffffffff0000, 0x80000001, 0x4a, 0x8]}, {0xb14f1c0, @usage=0x1, 0x0, 0x6, 0x9, 0x5, 0x0, 0x1, 0x9, @struct={0x5, 0x33e5}, 0xd8, 0x40, [0x1, 0xb7a, 0x0, 0x4, 0x2, 0x6]}, {0xc7, 0xfda, 0x8}}) ioctl$BTRFS_IOC_DEV_REPLACE(r5, 0xca289435, &(0x7f0000003800)={0x2, 0x6, @start={r11, 0x1, "731204f5e0b95a9858a6065b398d42a9db7ccd37c0c4b99ec873205e28eb58c7994ca2be5b9fc85f15bc821a748e744fb2af7cae8fd9bc300b18e129c818006d9b080eb2db1bf95d27a11535b024ef833cba874e87311f54f9af643b8486d1106f82b7fa611742455c881042e2d212f618721e17ad76cceb7b33f9ba0317f10b06c50236b28732d95c9dc535f5203983491a33fa675e41b92a71145b63c66a3fb787026121cdfa846ca46f393f2cdc0609a5cd4f94f13e983d4ca830d7b7e4d774178e5c36542cb9305542f5ca08cbb3c89371380c9ee61226dc4996159fbc21d9c727f0afa598ab59e1aa2beced877d34de3dd8186a0172991d615daa7cd3152983f35b47fec8b5b36b86df5e8da181710671a35e5225f28894c0101857e7bc2d7823de575e3e16b3c4e659f40a8ab6ca8679c6e4480d6f2f66578f14da08d5a597a9a04b6bfba0b4bbab502b319d4c99dfc17a1702aa207b75306129741150cfd40f8f7e00c0f6a59c035f0dfa23bad2b0ffbd3d6694d0408316221f791e283f92b23269f5187f7c5b361951cd3461f6e53a96cc71d9332e4d8ec158f0680eaa43412923f1b68817b7234b271b9ea45fa35e9fe3741c6186533d39d0e912429fbc24184e8ebef896f60f129cec6fef4fa3de5b1c37eeece48f5a6561d576489ca8b4d4b63f8d0b7dd9eda3d5b11d852107c0355bbd058e01da9f7d50bfacf80034c941463de50e081990d6a82c2ff95dfcfbfe6747e845ef87f0fd40ae87011a2e27dfc4d5a5a628f1bf0ed2fb8a862ce86d5bc9b83c1ed89f5d92cf39aaadf2ece048c8a99163a152f24995885cf98f1c72201cb2c190ea19dec7269bad105f9ed4a233729a02c781d069ee6c1dedcd9d0bcf54389f8969c6fb2c4a65c2bd06746e5a5c05c5aa8cc39e8bb094c9d1d7bb41420c262624975d84fe31513ad069059816b1c5cf00d544833ee54874a5c93291c85b4346b0387cf3a7d2f82c0e27179ec0b626b978ea9795200ce2e02bb5bed3d28f1a7a392c90b012298ef776b451da91e24f104a8aaac450869b59c063cfa21b32f7f8b77d9134506940f1d50d2468e202554171327113dfa92cc5b69ece845e3284d5225ab149678d8c03a410ec5831529401199a317dbb050b6150958c67337eaae7cb837187d4ad8e1d634e54d91d01616395ff83cb4a8057b6de8b30c5f8b3c91b2b8003b09cc6699e857d8378ba1ee56874fc71f93d54c71d1e17d04133f4596423978791e8c0d6284a66f07b622e934f524d501fef37d51c8c44803b52a26a75f510e352b366b96a6e68815b8dae08c7dadf43adb030cf9ed4af2b7fb0185be64a7505a5acb2f7984479d8c110c91b39ec4c3cdb00a1f6b3febe26d4db264bf6fafc00b9b5992a0b1fbd68f13dc7a79af69562a901df5ef0ee5cefe8a602bc823f98186b1d41efa90404", "0de980106fa0dd5b6c08e550796cc34c561fb7c8c570aae4c8bc6f6572c3e6d3edf07d6c186ac3e654fd7c5247ef4775694181e6a8f597df917c53fef949601d720bb665a570155d86cb143f6b0f8934da06ef65709f011b092d4fb61355720b3598d7234411d958c8f562fc827881df01072a57fced6e39ebdcc9374d3eb006099a008d15569663e44b5d5433d34c441a6ab127f2abe3ef29e1820e7924c804fc34cd1648032de83bc2b2f98bdaa1783f6f99b1f3be0bd44bdde0fd7283cdb222b35eadcb456f9318d0e466e185a7164868a4a3b24768256664b3ba732d8031e0ecf582bd9b8c6a4a62fbe3dbfeaafe63edcb31541961db521a2e5af3f505996cd2bc57831b575165b5947336956d540a5499b88c6247af5498170c67172c7a721098a15f5a90b6c7a9e72423469575ee672aa9fcc97dec744b7431a421812ac4798c0b916c451d7beb3db7cd9b6593156bc333f6d9c17f9d77a12164d3f28c8a1c7822d6847eab48cee3ee8598b3a4900bbb32d58e7967e5cc9973e8daaad3740320c4887aa974444d2d5ec3b5722eb1f16683ff9d2b44f202aeaba90cf04da57e00b1abbdf56346dfc00e3f3e1c7ccd175f4e19f89ff351da472f7c0395c05da8e49523edfb5f9c69fcf8ceb3b7c20c87d7f5355d2e306a411a4a565ce7d5a998bbf2f3d137a0fb82f1f73aae80239b55e20665104ef223b4d06464378b58062ac8aa7502c991abf0eedd8672a51ef5521c325d28c80a48fefa0e4bf8a6366f4340e5f46863e9a50797d5333cf253c6680a94a2191029e1d3c8a48c15845c1d885ebf0ca6ca5d4a6439d1208cc883e647b92424fd8a870c25f0415bc762737d967b33d3d4352d8883c71a8e281f48ab41e43d9281684767b83356b16b6ca0950d78d39d9875cd65611fe16330501314f6eac8b91f593af0984b26a824d2e43a67560bf315fab11007411abb3241ca5495e37151acd9fe919696d463b14a5214a53ba45ff35168e8b3d6c9a8fee396c788ffe0839126e73c65a14a367fb9c05c0c14ec4ccbc1137bc7964e1da2a102405bc0ad9dd6c060817d916a1c03b27c57686c2a0993f88ab4d6ae5b3f06afcbc89fdcbc6880d6156f8cee60615325c8d15300e877ccbce1da2d64db93f30fef9e14e7f22d5d8ec94d59c10a03b46dd340bbebc7302e845a8cddb6a3a33713e84ae8bab2d96d811d7879bf2dc626263555a39e3c407b4eef3da19826d7c81b6cc7164f08961a848ac69f902f31baa2925944e34498223830f04edc579d46e15a08c0b6759c1b85ea19d992c303e45a148ca0017b35ff3dd5252d4f19c20eb8e850fe9a4de4b5949828b129a6edadbecce6ccb7baf5cf5722cd75841b6c1656da5ecfd81033d85a36358226bea452d1579ae84c885b2c066a3469c464ffa8ad6ab1c28f1489770fb4152a733f5b0ef04780"}, [0x2, 0x0, 0x2, 0x3, 0x0, 0x9, 0x8, 0x13, 0x6, 0x7ff, 0x4, 0x80000000, 0x9, 0x8000000, 0x6, 0x9, 0x3, 0x9, 0x48000000, 0x2, 0x4, 0x5, 0x6, 0xfffffffffffff3da, 0x2, 0x4, 0x5, 0x8000, 0x7, 0xe8, 0xfff, 0xf1, 0x8, 0xfffffffffffffff9, 0x9, 0x4, 0x31, 0x7, 0x3, 0x4, 0xebc, 0x7, 0xffffffff9f37cab2, 0x2c, 0x6, 0x4, 0xfa, 0x550, 0x1, 0x901, 0x7fffffffffffffff, 0x5, 0x2f69, 0x8, 0x1, 0x10001, 0xa, 0x2, 0x8000000000000000, 0x7fffffff, 0x4, 0x6, 0xffff, 0x1800000]}) (async) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r5, 0xc018937c, &(0x7f0000004240)={{0x1, 0x1, 0x18, r8, {0x5}}, './file0\x00'}) mount_setattr(r12, &(0x7f0000004280)='./file0\x00', 0x100, &(0x7f00000042c0)={0x100008, 0x4, 0x120000, {r10}}, 0x20) shmat(0x0, &(0x7f0000ffa000/0x3000)=nil, 0x6000) 38.396958915s ago: executing program 9 (id=922): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x109491, 0x0) mount$bind(0x0, &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x20000, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r8, &(0x7f0000000800)={0x2020}, 0x2027) 38.184959129s ago: executing program 4 (id=923): socket$kcm(0x2, 0x200000000000001, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(0x0, r1) sendmsg$NFC_CMD_START_POLL(r1, 0x0, 0x0) sendmsg$NFC_CMD_ACTIVATE_TARGET(r1, 0x0, 0x0) sendmsg$NFC_CMD_DEP_LINK_UP(r0, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r2, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0xffffffffffffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) readlinkat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=""/199, 0xc7) setsockopt$packet_int(r6, 0x107, 0x14, &(0x7f0000000180)=0x2, 0x4) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000000)=0x3da, 0x4) sendto$packet(r6, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) r7 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r7, 0x800442d2, 0x0) 37.60880808s ago: executing program 40 (id=923): socket$kcm(0x2, 0x200000000000001, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(0x0, r1) sendmsg$NFC_CMD_START_POLL(r1, 0x0, 0x0) sendmsg$NFC_CMD_ACTIVATE_TARGET(r1, 0x0, 0x0) sendmsg$NFC_CMD_DEP_LINK_UP(r0, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r2, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0xffffffffffffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) readlinkat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=""/199, 0xc7) setsockopt$packet_int(r6, 0x107, 0x14, &(0x7f0000000180)=0x2, 0x4) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000000)=0x3da, 0x4) sendto$packet(r6, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) r7 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r7, 0x800442d2, 0x0) 37.245262464s ago: executing program 9 (id=926): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$nvram(0xffffffffffffff9c, &(0x7f00000014c0), 0x40280, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_procfs(0x0, 0x0) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000000)={0x27}, 0x74) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r2}, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0xe, 0x2, &(0x7f00000000c0)=ANY=[@ANYBLOB="0701000000f809000500feff"], &(0x7f0000000480)='syzkaller\x00', 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @void, @value}, 0x94) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)=0x0) timer_settime(r7, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r8 = mq_open(0x0, 0x40, 0x1, 0x0) mq_timedreceive(r8, &(0x7f0000000000)=""/83, 0x9b0c4f391059f39b, 0x20000900, &(0x7f0000000100)={0x77359400}) ioctl$SNDCTL_DSP_POST(r5, 0x5008, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000640)=0x10) 36.660244665s ago: executing program 41 (id=926): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$nvram(0xffffffffffffff9c, &(0x7f00000014c0), 0x40280, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_procfs(0x0, 0x0) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000000)={0x27}, 0x74) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r2}, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0xe, 0x2, &(0x7f00000000c0)=ANY=[@ANYBLOB="0701000000f809000500feff"], &(0x7f0000000480)='syzkaller\x00', 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @void, @value}, 0x94) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)=0x0) timer_settime(r7, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r8 = mq_open(0x0, 0x40, 0x1, 0x0) mq_timedreceive(r8, &(0x7f0000000000)=""/83, 0x9b0c4f391059f39b, 0x20000900, &(0x7f0000000100)={0x77359400}) ioctl$SNDCTL_DSP_POST(r5, 0x5008, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000640)=0x10) 35.568801832s ago: executing program 7 (id=930): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() syslog(0x2, 0xfffffffffffffffc, 0x13) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mknod$loop(&(0x7f00000017c0)='./file0\x00', 0x2480, 0x1) mount(&(0x7f00000000c0)=@filename='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='ubifs\x00', 0x0, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f00000000c0), 0x2, 0x80240) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r3, 0xc1205531, &(0x7f0000000280)={0xc, 0xff, 0x7ff, 0xf, '\x00', '\x00', '\x00', 0x8000, 0x7bfa, 0x4, 0x7a, "160453080522535e0398ee2fdc80280f"}) r4 = socket$unix(0x1, 0x5, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r5, &(0x7f00000000c0)={0x1d, r6}, 0x10) sendmsg$can_bcm(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRESDEC=r6, @ANYRES64=r4, @ANYBLOB="3b8dff39f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x91) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000003c0)={0x0, 0x0}) syz_open_procfs$pagemap(r7, &(0x7f00000001c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) listen(r8, 0x7) 34.528745424s ago: executing program 7 (id=931): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = socket$rds(0x15, 0x5, 0x0) bind$rds(r2, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f00000001c0)=[@cswp={0x58, 0x114, 0x7, {{0x8, 0xc}, &(0x7f0000000100)=0x5, &(0x7f0000000480)=0x80000001, 0x774e, 0x2, 0x5, 0x9, 0x6a, 0x7f}}], 0x58, 0x24040000}, 0x8001) r3 = syz_open_dev$loop(&(0x7f0000000080), 0x48fd, 0x122c42) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x25dfdbfe, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x30000001, 0x2}, 0x3}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8847}]}, {0x2, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x15}, 0x80) r5 = openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000002540), 0x1, 0x0) lseek(r5, 0x8000000000000001, 0x0) fsetxattr(r3, &(0x7f0000000340)=@known='user.syz\x00', &(0x7f0000000380)='\x00', 0x1, 0x2) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x224032, 0x0) ioctl$LOOP_CHANGE_FD(r3, 0x4c03, 0xffffffffffffffff) ioctl$SIOCX25SFACILITIES(r0, 0x89e3, &(0x7f00000008c0)={0x24, 0x8, 0x7, 0x4000c, 0x4, 0x81}) 34.285184917s ago: executing program 7 (id=932): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000) fanotify_init(0x200, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x88, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x1f0, 0x0, 0x11, 0x148, 0x0, 0x0, 0x440, 0x2a8, 0x2a8, 0x440, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x250) pselect6(0x0, 0x0, &(0x7f0000000000)={0x1f}, 0x0, 0x0, 0x0) socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000080), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x16) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x4, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000708000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0xa, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa"], 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 33.340036881s ago: executing program 7 (id=933): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x109491, 0x0) mount$bind(0x0, &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x20000, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r8, &(0x7f0000000800)={0x2020}, 0x2027) 32.394785095s ago: executing program 7 (id=934): sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) modify_ldt$write(0x1, 0x0, 0x10) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x4d, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0, 0x3, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x48) syz_emit_ethernet(0x6a, &(0x7f00000004c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6000000000343c0120010000000000000000000000000002fe8000000000000000000000000000aa3303000000000000070800000000000000000708633f959cf2310e0ab9000000000000006d9ad7767b553df592ec23ae0179a405a292e00054d29e1b902d4c49fd34ad794b875de4e2ea9fb8040c3c45f731ad8a6544048ed6b8725dfd627d02d5eee8ef7da3a8cbddde4fe14c97204a252dfbb0f1e34e6bb79c81a33f696b4fa886db711616c2754db22b97dcec220f3209781acaa743b4d69f91d6e866d350025c97436bd277e2e2de3a0a9e9628df5e1aba811e631aba67a067b78f4075cf5b8f861766ee75", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket(0x10, 0x3, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, 0x0, 0x0) sendmmsg$sock(r3, 0x0, 0x0, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000006c0)=@bridge_getlink={0x20, 0x12, 0xdba2e9e4846a7f93, 0x70bd2d, 0x25dfdbff, {0x7, 0x0, 0x0, 0x0, 0x75800, 0x1}}, 0x20}}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff}, 0x10) socket(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x58}}, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x800) memfd_create(&(0x7f0000000800)='\\\xd4~.\xf7\xc2\xd4\xd7\xa0\x17\x00\xfa\x9c\x05\x83G\x98\xebW\xaa\xef\xf2\xe7W5\xa7\xa7\xce\x02\x10\x88n\xf0\b<0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) ioctl$SIOCAX25GETINFOOLD(0xffffffffffffffff, 0x89e8, &(0x7f0000000000)) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) getpriority(0x2, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd70000000000004000000130317"], 0x328}}, 0x84) r4 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$PIO_UNIMAP(r4, 0x4b67, &(0x7f0000000040)={0x3ffffffffffffe96, &(0x7f0000000000)=[{0x2000, 0x5}]}) 31.232628507s ago: executing program 42 (id=935): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) ioctl$SIOCAX25GETINFOOLD(0xffffffffffffffff, 0x89e8, &(0x7f0000000000)) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) getpriority(0x2, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd70000000000004000000130317"], 0x328}}, 0x84) r4 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$PIO_UNIMAP(r4, 0x4b67, &(0x7f0000000040)={0x3ffffffffffffe96, &(0x7f0000000000)=[{0x2000, 0x5}]}) 24.34542839s ago: executing program 1 (id=894): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x109491, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r8, &(0x7f0000000800)={0x2020}, 0x2027) 23.181648521s ago: executing program 1 (id=942): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r8, &(0x7f0000000800)={0x2020}, 0x2027) 22.750552231s ago: executing program 1 (id=943): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@delqdisc={0x2c, 0x25, 0x100, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff2, 0x10}, {0xfff3, 0x8}, {0xd, 0x5}}, [@TCA_RATE={0x6, 0x5, {0x5, 0xc}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x804}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) getpid() r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00007fd000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) madvise(&(0x7f00003c1000/0x1000)=nil, 0xdfc3efff, 0x15) ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, &(0x7f00000005c0)=@get={0x1, 0x0, 0xffff}) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000080)={0xf0f071, 0x19}) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x8, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000080)={0x7, 0x2, 0x0, "3235f56789a7963ccf7f399c6d684f3af0c0091e0f188b528c8d32db45028b4c", 0x3032344d}) ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc0f8565c, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x60800, 0x0) r3 = dup(r2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x10, 0xffffffffffffffff, 0x3000) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) waitid(0x1, r4, 0x0, 0x1, 0xfffffffffffffffd) ptrace$getregs(0xe, r4, 0x8ee0000000000, &(0x7f0000000280)=""/150) sendmsg$kcm(r3, &(0x7f0000000340)={&(0x7f0000000180)=@ieee802154={0x24, @short={0x2, 0xffff, 0xaaa3}}, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000000600)=[{0x88, 0x6, 0x4, "0d786f0276684ff609798350d0d788b592ea8a90bf6bcfb3fd11a6bc91862aa324683ba9dbfae13a8da40f3f5ec76942eb6410596ef0f697c89f4af56dab61956056480331f34b675a91fae0bdab6995677e130308c8348be79a76b727223832d425bdf567ecdd320da51c6b1e87681da50431"}, {0xd0, 0x113, 0x800, "556d240c4b21430561300d5ced035a010b99daa34d7aeb9c091f7bc55ef375e504fc71ee2320975923dac6e8101920a1382368480dd7ed4d1375cef327f84476d419d6a72fb4b3b978dc1e0362723a4a7cee368229e0b9364fba2c32b50b7debe3b3c56932aec4282e9521772e80c0824e55b01ecc6537dc1d7f6f28962649d941a6a16c273532d795d635820f26de0572e86652337c9c12c237948e11226749bfea9a8b3908a940f31a65da1f66d0511f4f4b6d954fd61a4064fdeaa8"}, {0x108, 0x6, 0x4, "5734b08385efb6660a9119239e2d344028910bfe24454098f31b8a7578e5b6e1977f064dbd4bb60e187339d3fcedef3bef61414b9c91cb573279af0c65379d8bd092f1fd4975376ea2994aa6dacc1f28fc644809c116680eec8d1eee83d60080503fab46780bda41302f15b5f494079e80be478f95a3becb9331ab487ac950a1a07c732a847ac5e5a7cf0c381bd4cd29b079cf387c8a4de0a682e5b68cca7e2df31cf3042359799a2ff0248d7a719f132d6189f94154004577c8fd80fe947ebc4bf2dce6b402647a20db93594093bff30d2e5168ca58792151e5eea2b4236f75670d2f1e689456071a122e2130a5ef0053edde2aa6"}, {0xa0, 0x101, 0xc4, "54437f753eed23b06a1c2d17503b187196e1186ed87cafda170a892515968336310a8f4ef41dc84d85061406375085949590ac094ed1e0b23ddc747cd8e7d1767c05508bfb58349a1eddc065d327942398313bf2b621980303ef93a90cc06a9056f643ea7fc2d1a3530b31f28c9f340c38d922fea02e13730555d2aa5b81e4d18e6364fab32a26e93936dd62"}, {0xc0, 0x10d, 0x0, "833a15f418843c18d28ae0872b267fe44feb405d890407b61b371398b96216ce5e9f2b6113b19a09f9370728720a5b75a27e9a31468dd581cbcfc1c1d00eac47da4f3ab23a88f546786bea4d54cb3c93c39d401b70cb94dca5c5213a62d3731142eacdd89854de69172ee80f56592711b05df1a0cc2850bc728a0bc46c169c87c665570b89554c8213ae47cc632894b78121c27e5cbda1b2a9466ec699a0715c67883820914d0ee09179aefa"}, {0xc0, 0x108, 0xffffffff, "0111db7af0f80b9fc6525eef2207b0c87fc8d31cb72aa91c2b2a1d268ec0dd4de8fc9c551a882a17b5ed2dc98316a96d36b31285966db4ae4786add851bf9a97704512d900f5c60b5ca099459b1400e13955144066e233934f1d85bbcee4a4651437d3ea48428e8dd0dd0a2fe1600487075ae35a10c43d58ff8db4e156a7b8398ab87f96bd15c92708d429e3ac0fde77214743eb454ad491eeaa5b72ce0f561ef7f23b23cade181d3a4683f6a73b"}], 0x480}, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close_range(r6, r6, 0x0) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) 22.525414954s ago: executing program 43 (id=943): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@delqdisc={0x2c, 0x25, 0x100, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff2, 0x10}, {0xfff3, 0x8}, {0xd, 0x5}}, [@TCA_RATE={0x6, 0x5, {0x5, 0xc}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x804}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) getpid() r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00007fd000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) madvise(&(0x7f00003c1000/0x1000)=nil, 0xdfc3efff, 0x15) ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, &(0x7f00000005c0)=@get={0x1, 0x0, 0xffff}) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000080)={0xf0f071, 0x19}) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x8, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000080)={0x7, 0x2, 0x0, "3235f56789a7963ccf7f399c6d684f3af0c0091e0f188b528c8d32db45028b4c", 0x3032344d}) ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc0f8565c, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x60800, 0x0) r3 = dup(r2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x10, 0xffffffffffffffff, 0x3000) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) waitid(0x1, r4, 0x0, 0x1, 0xfffffffffffffffd) ptrace$getregs(0xe, r4, 0x8ee0000000000, &(0x7f0000000280)=""/150) sendmsg$kcm(r3, &(0x7f0000000340)={&(0x7f0000000180)=@ieee802154={0x24, @short={0x2, 0xffff, 0xaaa3}}, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000000600)=[{0x88, 0x6, 0x4, "0d786f0276684ff609798350d0d788b592ea8a90bf6bcfb3fd11a6bc91862aa324683ba9dbfae13a8da40f3f5ec76942eb6410596ef0f697c89f4af56dab61956056480331f34b675a91fae0bdab6995677e130308c8348be79a76b727223832d425bdf567ecdd320da51c6b1e87681da50431"}, {0xd0, 0x113, 0x800, "556d240c4b21430561300d5ced035a010b99daa34d7aeb9c091f7bc55ef375e504fc71ee2320975923dac6e8101920a1382368480dd7ed4d1375cef327f84476d419d6a72fb4b3b978dc1e0362723a4a7cee368229e0b9364fba2c32b50b7debe3b3c56932aec4282e9521772e80c0824e55b01ecc6537dc1d7f6f28962649d941a6a16c273532d795d635820f26de0572e86652337c9c12c237948e11226749bfea9a8b3908a940f31a65da1f66d0511f4f4b6d954fd61a4064fdeaa8"}, {0x108, 0x6, 0x4, "5734b08385efb6660a9119239e2d344028910bfe24454098f31b8a7578e5b6e1977f064dbd4bb60e187339d3fcedef3bef61414b9c91cb573279af0c65379d8bd092f1fd4975376ea2994aa6dacc1f28fc644809c116680eec8d1eee83d60080503fab46780bda41302f15b5f494079e80be478f95a3becb9331ab487ac950a1a07c732a847ac5e5a7cf0c381bd4cd29b079cf387c8a4de0a682e5b68cca7e2df31cf3042359799a2ff0248d7a719f132d6189f94154004577c8fd80fe947ebc4bf2dce6b402647a20db93594093bff30d2e5168ca58792151e5eea2b4236f75670d2f1e689456071a122e2130a5ef0053edde2aa6"}, {0xa0, 0x101, 0xc4, "54437f753eed23b06a1c2d17503b187196e1186ed87cafda170a892515968336310a8f4ef41dc84d85061406375085949590ac094ed1e0b23ddc747cd8e7d1767c05508bfb58349a1eddc065d327942398313bf2b621980303ef93a90cc06a9056f643ea7fc2d1a3530b31f28c9f340c38d922fea02e13730555d2aa5b81e4d18e6364fab32a26e93936dd62"}, {0xc0, 0x10d, 0x0, "833a15f418843c18d28ae0872b267fe44feb405d890407b61b371398b96216ce5e9f2b6113b19a09f9370728720a5b75a27e9a31468dd581cbcfc1c1d00eac47da4f3ab23a88f546786bea4d54cb3c93c39d401b70cb94dca5c5213a62d3731142eacdd89854de69172ee80f56592711b05df1a0cc2850bc728a0bc46c169c87c665570b89554c8213ae47cc632894b78121c27e5cbda1b2a9466ec699a0715c67883820914d0ee09179aefa"}, {0xc0, 0x108, 0xffffffff, "0111db7af0f80b9fc6525eef2207b0c87fc8d31cb72aa91c2b2a1d268ec0dd4de8fc9c551a882a17b5ed2dc98316a96d36b31285966db4ae4786add851bf9a97704512d900f5c60b5ca099459b1400e13955144066e233934f1d85bbcee4a4651437d3ea48428e8dd0dd0a2fe1600487075ae35a10c43d58ff8db4e156a7b8398ab87f96bd15c92708d429e3ac0fde77214743eb454ad491eeaa5b72ce0f561ef7f23b23cade181d3a4683f6a73b"}], 0x480}, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close_range(r6, r6, 0x0) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) 22.485229182s ago: executing program 0 (id=924): r0 = syz_open_dev$vim2m(&(0x7f0000000580), 0x3, 0x2) ioctl$vim2m_VIDIOC_QUERYCAP(r0, 0x80685600, &(0x7f00000005c0)) (fail_nth: 2) 22.227656663s ago: executing program 0 (id=945): syz_open_dev$tty1(0xc, 0x4, 0x3) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0xa, 0x3, 0x3a) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000800), r1) sendmsg$NLBL_MGMT_C_ADDDEF(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES16=r2, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00000000001080002"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newqdisc={0x88, 0x24, 0x4ee4e6a52ff56541, 0xfffffffd, 0x2004, {0x0, 0x0, 0x0, r4, {0xc}, {0xffff, 0xfff3}, {0xfff3, 0x1}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x10, [0x5, 0xd, 0x7, 0x10, 0x3d, 0xe, 0x0, 0xb, 0xb, 0x2, 0x0, 0x7, 0x2, 0xd, 0x3, 0xf], 0x0, [0x8001, 0x81, 0xaf9, 0x8, 0xc, 0x1, 0xee, 0x2, 0xfff8, 0x3, 0x4, 0x400, 0x1, 0x7f, 0x4, 0xe], [0x6, 0x1, 0x9f, 0xfffb, 0x1, 0xc2, 0x948, 0x4a8, 0x1, 0x2a, 0x8001, 0x0, 0x2ff, 0x0, 0x7, 0x3]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x8001}, 0x0) socketpair(0x2a, 0x2, 0x1, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000100)=0x14) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000400), 0x200400, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000040)=0x14) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000400000000000000000000850000005000000085000000d000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r9 = syz_io_uring_setup(0xd2, &(0x7f0000000440)={0x0, 0xdff9, 0x1, 0x1004, 0x100}, &(0x7f0000000400)=0x0, &(0x7f0000000080)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) io_uring_enter(r9, 0x47ba, 0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r8}, 0xe) r11 = socket$alg(0x26, 0x5, 0x0) bind$alg(r11, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'crc32c\x00'}, 0x58) 20.621871358s ago: executing program 3 (id=946): socket$l2tp6(0xa, 0x2, 0x73) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da", 0x33}], 0x3}], 0x1, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0/file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_open_dev$tty20(0xc, 0x4, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r7 = memfd_create(&(0x7f0000000480)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\"%/u\x17\xdam\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d[\v\xfc\xad\x0f\xa8\xc5\xad\x001\x8b%\xaa?\x00\x00\x00\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2Gj+kV', 0x3) ftruncate(r7, 0xffff) fcntl$addseals(r7, 0x409, 0x7) r8 = ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x0, 0x0, 0x2000}) lseek(r8, 0x8, 0x1) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) 19.64919191s ago: executing program 3 (id=947): r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) timerfd_gettime(0xffffffffffffffff, 0x0) listen(r0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xa) socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_GET_TID_ADDRESS(0x18, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'wg2\x00'}) 18.715350982s ago: executing program 3 (id=948): socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}}, 0x0, 0x0, 0x1b, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4f5d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) fcntl$getownex(r2, 0x10, &(0x7f0000000180)) r4 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r4, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, 0x0) ioctl$VIDIOC_QUERYMENU(r4, 0xc008561c, &(0x7f0000000000)={0xf0f000, 0x8, @value=0x3}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @desc3}, 0x0, 0x0, 0xfffffffffffffffe) write$cgroup_int(r5, &(0x7f0000000040)=0x1c9, 0x12) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) sendmsg$NL80211_CMD_SET_MPATH(r5, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x2c, r6, 0x10, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000014}, 0x1000) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x0, 0x2, 0x9, 0x4}, {0x6, 0x7b, 0xc}, {0x3, 0x3, 0x0, 0x10001}]}) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000b00)={0x7, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) 17.896336685s ago: executing program 0 (id=949): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x109491, 0x0) mount$bind(0x0, &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x20000, 0x0) read$FUSE(r8, &(0x7f0000000800)={0x2020}, 0x2027) 17.743481926s ago: executing program 3 (id=950): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) 16.265421834s ago: executing program 0 (id=951): writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000340)="8a226ff432407a7f5fd09590d734f795e12e57ce9fed3f0300eb6368ed559a85603b0080", 0x24}], 0x2) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x800007, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x2, 0x0, 0x0, 0x6}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b36, &(0x7f0000000000)={'wlan0\x00'}) (fail_nth: 1) 16.141559027s ago: executing program 3 (id=952): r0 = syz_open_dev$sndpcmp(&(0x7f0000000500), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r0, 0xc2604110, &(0x7f0000000000)={0x0, [[0x4, 0x2], [0x0, 0x5, 0x1000000, 0x0, 0xfffffffe, 0x0, 0x0, 0x1], [0x6606, 0x0, 0x0, 0x4, 0x0, 0x0, 0x18d]], '\x00', [{0x0, 0x6}, {0xffffffff}, {0x0, 0x1}, {0x1, 0x1}, {}, {0x1}, {}, {0x7, 0x7}, {}, {0x0, 0xb3}], '\x00', 0x0, 0x0, 0x0, 0x2}) (async) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r0, 0xc2604110, &(0x7f0000000000)={0x0, [[0x4, 0x2], [0x0, 0x5, 0x1000000, 0x0, 0xfffffffe, 0x0, 0x0, 0x1], [0x6606, 0x0, 0x0, 0x4, 0x0, 0x0, 0x18d]], '\x00', [{0x0, 0x6}, {0xffffffff}, {0x0, 0x1}, {0x1, 0x1}, {}, {0x1}, {}, {0x7, 0x7}, {}, {0x0, 0xb3}], '\x00', 0x0, 0x0, 0x0, 0x2}) 15.848794973s ago: executing program 0 (id=953): write$binfmt_aout(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) syz_io_uring_setup(0xbc3, &(0x7f0000001480)={0x0, 0x1064, 0x80, 0x4, 0x224}, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4001, 0x0, @loopback}, 0x1c) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000100)=0xcf5) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0100000004000900040000008b1eb1956d137c6e0967152a245425d50700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000000100"/28], 0x50) r2 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r2) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000240)={0x4, 0xad, 0x9, 0x5, 0x1, "af672a33c453d8adb3d6f800000000000016d1", 0x6, 0x7}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f000000cbc0)=@newtaction={0xe98, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{}, 0x97, 0x0, [{0x0, 0x0, 0x10}, {}]}, [{}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, {0x0, 0x0, 0x4}, {}, {0x0, 0x7}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}, {}, {}, {}, {}, {}, {}, {}, {0x20000000}, {}, {}, {0x5}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3, 0x0, 0x0, 0x0, 0x61b}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xab}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x10000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x8}, {0x0, 0x7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x89}, {}, {}, {}, {0x0, 0x0, 0xfffffffc}, {0x0, 0x1}], [{}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x2}, {}, {0x3}, {}, {}, {0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@gettaction={0x28, 0x32, 0x6dd711a25f4cb68b, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}]}]}, 0x28}}, 0x0) 15.501004615s ago: executing program 44 (id=953): write$binfmt_aout(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) syz_io_uring_setup(0xbc3, &(0x7f0000001480)={0x0, 0x1064, 0x80, 0x4, 0x224}, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4001, 0x0, @loopback}, 0x1c) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000100)=0xcf5) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0100000004000900040000008b1eb1956d137c6e0967152a245425d50700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000000100"/28], 0x50) r2 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r2) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000240)={0x4, 0xad, 0x9, 0x5, 0x1, "af672a33c453d8adb3d6f800000000000016d1", 0x6, 0x7}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f000000cbc0)=@newtaction={0xe98, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{}, 0x97, 0x0, [{0x0, 0x0, 0x10}, {}]}, [{}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, {0x0, 0x0, 0x4}, {}, {0x0, 0x7}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}, {}, {}, {}, {}, {}, {}, {}, {0x20000000}, {}, {}, {0x5}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3, 0x0, 0x0, 0x0, 0x61b}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xab}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x10000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x8}, {0x0, 0x7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x89}, {}, {}, {}, {0x0, 0x0, 0xfffffffc}, {0x0, 0x1}], [{}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x2}, {}, {0x3}, {}, {}, {0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@gettaction={0x28, 0x32, 0x6dd711a25f4cb68b, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}]}]}, 0x28}}, 0x0) 15.485256958s ago: executing program 3 (id=955): r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) timerfd_gettime(0xffffffffffffffff, 0x0) listen(r0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xa) socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_GET_TID_ADDRESS(0x18, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'wg2\x00'}) 15.402719543s ago: executing program 45 (id=955): r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) timerfd_gettime(0xffffffffffffffff, 0x0) listen(r0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xa) socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_GET_TID_ADDRESS(0x18, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'wg2\x00'}) 11.826118241s ago: executing program 5 (id=965): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006000000050005000200000005000400000000000900020073797a310000000011000300686173683a69702c6d6172"], 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) socket$nl_netfilter(0x10, 0x3, 0xc) 11.753027548s ago: executing program 5 (id=966): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) io_setup(0x222, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x80002, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close_range(r2, 0xffffffffffffffff, 0x2) dup3(r1, r3, 0x80000) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) syz_open_dev$vbi(0x0, 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r4, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) syz_usb_connect(0x2, 0x24, 0x0, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, &(0x7f0000000200)='\t', 0x1) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)={0x1c, 0xd, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x4010) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) acct(&(0x7f00000001c0)='./file0\x00') 9.024079499s ago: executing program 5 (id=970): mount$tmpfs(0x0, &(0x7f0000000540)='./file1\x00', &(0x7f0000000180), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x10000000) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, @aes128, 0x0, @desc2}) r0 = openat(0xffffffffffffff9c, 0x0, 0x641, 0x0) flock(r0, 0x2) syz_emit_ethernet(0x72, &(0x7f0000000080)={@broadcast, @remote, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "f7d8ff", 0x3c, 0x3c, 0x0, @local, @mcast2, {[@hopopts={0x0, 0x4, '\x00', [@hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @hao={0xc9, 0x10, @mcast2}]}], {0x0, 0x0, 0xc, 0x0, @gue={{0x1, 0x0, 0x1, 0x0, 0x0, @void}}}}}}}}, 0x0) syz_emit_ethernet(0x82, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff8100320086dd60f81fcb00483afffe80000000000000000000000000000001040090780039000000608c4aa1d300000000fc010000000000000000000000000000000000f47fbd03846381360f5d11128f00000000000000ffff7f0000013c00"/124], 0x0) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140), 0x2) r2 = memfd_create(&(0x7f0000000940)='y\x105\xfb\xf7u\x83%\b\x00\x00\x00\x00\x00\x00\x00\xea_\xccZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x10\x00\x00\x00\x04\x879\xa24\xa9a\b\x00\xb2\xd3\xcbZJ\x7fa\xc4\x1acB\xaa\xc1\xfb Q\x96\xd9xJ2\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea\b\x00\x00\x00\x00\x00\x00\x00\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9V\x01A\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\a\x00\x01vRk\xaabB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\x80\x81\xa0\xa2-g\b\x99\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecn\x02\xc8\xc4\f\x04\x99\xf6\xfc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8L\xae\x1ff\xcf\xb3\xb65\x12\x89\x02\x82t\x0f\xb0\xe89\x16\fO\x19\x91\xfd\x10\x0e\xa7r\x12\xab\xd4\xd1d\xad\f\x11\xb3\xb3c\xe2\xfe\xcd\x9f7\xa1\x14\xfa\xe2\xdf\x7f\xf4NG\xe3\xeb\x18\xde|\xb3\xf5S\x9a\x04\xb4Lry\xa9\xd6\xfb\xbc\n+N\xf7\xf6\x87\x95\xd9+\xd2sc/\x06\xaa#K3,k\xf3(\xcc\xc7\xb47\xfa\xc3\x1c\x91!\xd3\xd2`-\xa2xrR\x1c\x81i\x87u|29Q\xdf\xed\x10\x9b\x930\xa8v\xa0\x88\xa4t\x17\xb2\xca9\x02\x03\xc9P\xcc\xe0\xb7\x9c\x82\xb4\x03\x83e\xee\x95\xccO\x1b\x83\f\n{\xf3\x12\x90\xcf\x10\xb5>\b3\x80\x8d\xb2%7\x10\xeee\xe4\xc3\xb2^\xad\xb6~\xa2\xbdE\xbf\x91\vqt\x81\xbd\x19\xde\x81\tw\xd4p\xd1\x8aNJ\xb3M\a\xc4\xfa\xb0,$\x81j\xb4Hs\x93>\x16U\xd0t\xe4\xca0T\xb7\xf7\x9d4\b\xd9\xdeps\xec\xa0\nJ\xa5\xfe\xda{(\xee\xb5\x11?\xc3I-\x8bc\xc9\xfb\a\xe5\xab\xf8v1\xdc\xc5\x8c\xebs1\x81\xca\x81l\xa12\xff<\xf5\x12\xcc+\xd4\xab\x84\x16\xa4+\x0e\xd4\x02\xe3\xaa1\xeam\x8ce\xb4r\x0eo&3wff\xe6\x91\x7f\xba\xad\x05\xdd\xc0+\"\xa5\x80\'#\xfd\x9dA&\xee \x18\xe5\x17\x1bd\xd0\xb9\x90\xde\xec\xe4M\xe5\x06\x03r\fc\x8c\x10\x99x\xec`e`\xc3F\xdf\xbc\xa8\xff\x05\xe6\xea\xc3u\xd7\t\x88<\"\xf7!\xd6\x0e\xbbE^\xcd\xb0\x15g\xe6\xf2?y1\x9f\xd3\x95\xc4E\xd0\xb4\x16`r\x14\xad\x02\x17\x9a\x86I]\x02f\xd3\xc9\xe1H\xd7c\xcaQ\x8cE7\xcc\xcf=\xf3\xf7\xb9\xf6s\x88\bZi\b*w\xc5;\x88\r\xab\xa1\t\xf1\x02)5\x00\x84', 0xb) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x0, 0x100}, 0x0) ftruncate(r2, 0xffff) fcntl$addseals(r2, 0x409, 0x7) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f00000002c0)={r2, 0x0, 0x0, 0x8000}) 8.913081372s ago: executing program 5 (id=971): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x109491, 0x0) mount$bind(0x0, &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x20000, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r8, &(0x7f0000000800)={0x2020}, 0x2027) 7.803711992s ago: executing program 5 (id=974): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$video(&(0x7f0000000040), 0x3ff, 0x0) inotify_init1(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x4}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="41000000010006", 0x7) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e0001000000000000000000"], 0xb8}}, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_UIE_ON(r3, 0x7003) ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f0000000280)={0x24, 0x2f, 0x0, 0x1c, 0x6, 0x400004f, 0x100010, 0x2c, 0xffffffffffffffff}) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000b40), 0x80002, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x60680, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r7, 0x0, 0x80, &(0x7f00000004c0)={'nat\x00', 0x0, 0x0, 0x0, [0x1, 0xffffffffffffffff, 0x0, 0xae, 0x401, 0x8]}, &(0x7f0000000280)=0x78) ioctl$TIOCPKT(r6, 0x5420, &(0x7f00000000c0)=0x3ff) ioctl$TCSETS(r6, 0x5402, &(0x7f0000000080)={0x768, 0x2, 0x100000, 0x2, 0x5, "f694b8000000000000cc29e1f5eba328020016"}) (fail_nth: 3) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000001ac0)={r4, 0x0, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba073b3e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200"}}) 5.956743156s ago: executing program 2 (id=976): syz_usb_connect(0x0, 0x108, &(0x7f000000adc0)={{0x12, 0x1, 0x300, 0x34, 0x61, 0x41, 0x8, 0x83a, 0x4507, 0x2990, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xf6, 0x1, 0x3, 0x43, 0x90, 0x5, [{{0x9, 0x4, 0x9f, 0x1, 0x6, 0xeb, 0xf2, 0x72, 0x8, [], [{{0x9, 0x5, 0xb, 0x8, 0x200, 0x9, 0x4, 0x4}}, {{0x9, 0x5, 0x80, 0xc, 0x3b3, 0x1, 0x0, 0x8, [@generic={0x5f, 0x10, "1da9c886f7caebcdc3a80b721d8fad2c22d9c6b844af104b844e44319962af4b7e2e303b54bcf62dff906748bb4fc49860c702f181cb4602a7aa7f1d44c10e9e9ebfceca0575f2915581e9e45e5aea8775837899a5a9fe7c18b0884b1f"}]}}, {{0x9, 0x5, 0xa, 0x3, 0x3ff, 0x3, 0x40, 0x5, [@generic={0x4f, 0x11, "d830768c9a2907b85864c42ed38763c088b50efe5e64d066f6623ffbb3cc0a5cae18542892344c32cc44f42d1bc1b6e373388cb52d03e35467c051247f44d6c5f468c41aa18ece9f5045f7114b"}]}}, {{0x9, 0x5, 0x4, 0x0, 0x3ff, 0x81, 0x7, 0x6}}, {{0x9, 0x5, 0x0, 0x1, 0x8, 0x21, 0x5, 0x3}}, {{0x9, 0x5, 0x1, 0xf, 0x8, 0x5, 0x5, 0x5e}}]}}]}}]}}, &(0x7f000000b1c0)={0xa, &(0x7f000000b000)={0xa, 0x6, 0x310, 0x4, 0xf, 0x4, 0x40}, 0x19, &(0x7f000000b040)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x1, "8b206fa6dc6f2a51f74ce0c09bfddabe"}]}, 0x2, [{0x4, &(0x7f000000b080)=@lang_id={0x4, 0x3, 0x3c01}}, {0xd1, &(0x7f000000b0c0)=@string={0xd1, 0x3, "6bbef6bc3ffb1621c2e313487c8d412d2217c6728aa44e65c49838ebba820bd4a332af5ac9d347148deff2e71511bff590f26c1ad04c72dbb2438bad5df0efc081fe2bec0ce741196a4262fba7a3aa7d73a31b753159ca75a5f56a80355c1fca81559efd4aa95bba5113e7229c99635293451346ee1804472e813fc9e94d653803f616c325920f1381f6ba59109f89d8820020892a7fb27bdf26acc65ebd33d4e26f7e6cd7ae333638c9eec97fd642048e61e8d40d7d0c5029aed803118b1859df630fbb83fd2b4beb7eb716df2c89"}}]}) 5.536785046s ago: executing program 5 (id=977): syz_open_dev$loop(&(0x7f0000000100), 0x400000040000006, 0x400a00) r0 = socket$inet_sctp(0x2, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0x10) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r1, 0x40089413, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0xfffc, 0x52, @private1={0xfc, 0x1, '\x00', 0x1}, 0xc}, 0x1c) memfd_create(&(0x7f0000000100)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x17?$^\xe1Ob\xe1Y\xd6\xeb\x91\x83;\xeb\xf1\xd0\xce\xe5\x19T\xff\x01\x00\x00\xe2\x9f\xd9\xae\xcf>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xa2c\x12.\xb7\xbe`\'\xcb\xb6\xaf\xdc\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x06\xb5\xaa\xe6\x05\xe4\xc3\x90\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4\x84$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\xd0\xe1{\x84\xb5\x82q\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xf8\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\xb0\xc0:\x8f|\x8f\x06\xf8T\x826`M\x11\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?\x87\x84\\/y\xed\x01#?\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\xa3\xcc\x9b\f\xa7\x8f\x91O\xc9\xb9\x14M\x8b\xd0\xc0\xb8L\xbd\x1c4\xb59\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\f\xeaH\xd8cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\"\x1e\xf0', 0x6) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000080)={0x6, @sliced={0x3, [0x0, 0x53, 0x405, 0x7, 0xe72b, 0x7, 0x5, 0x80, 0x3b2e, 0x8, 0x4, 0x800, 0xe81d, 0x6e, 0x1, 0x5, 0xd842, 0x7, 0xfff, 0x6, 0xba4, 0xffff, 0xfffd, 0x101, 0x7, 0x1, 0x2, 0xa, 0x12, 0x400, 0x5, 0xacf, 0x4, 0x3, 0xfffa, 0x800, 0x6433, 0x4, 0x2, 0x7e3, 0x9, 0x477a, 0x1dc, 0x8, 0xa4, 0x65, 0x1d47, 0x6], 0xffffffff}}) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f0000000000000000000400000000"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x810) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r5) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000600)=0x24) ioctl$PPPIOCSNPMODE(0xffffffffffffffff, 0x4008744b, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000640)=ANY=[@ANYBLOB="57957ec0f252a84416c89e9e470bd925ce1fd85a542b4b872c28be46001f62aebb2bfb9e510b7ac22be7682df3bf33dcc59c18a8b93271f5e3ef718f2542e5dc94dbc4d37637c069388e8c6de00231e0ad327a868b69706051a54283006a53d17235126aacd6ef70b31f0975550bd3200663b0c605312ad8d6d798540b09d85996e6af74649ef440e3847e825003381ed66be88531f6dc1eee6ffc2881f4cf28acd480bc85a635e9bd4a7814c6025e1ea6c0a47a142e84e16624e298a880e6de395aa4605a4d00d8ce1a2d133733322570ec0000000000", @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000080002000100000008000100000000001800088014000780080005000000000008000500ffffffff0800048004000b80"], 0x44}}, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) connect$inet(r7, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r7, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'rr\x00', 0x15, 0x88, 0xc000067}, 0x2c) sendmsg$RDMA_NLDEV_CMD_SET(r4, 0x0, 0x40810) 5.30385828s ago: executing program 46 (id=977): syz_open_dev$loop(&(0x7f0000000100), 0x400000040000006, 0x400a00) r0 = socket$inet_sctp(0x2, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0x10) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r1, 0x40089413, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0xfffc, 0x52, @private1={0xfc, 0x1, '\x00', 0x1}, 0xc}, 0x1c) memfd_create(&(0x7f0000000100)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x17?$^\xe1Ob\xe1Y\xd6\xeb\x91\x83;\xeb\xf1\xd0\xce\xe5\x19T\xff\x01\x00\x00\xe2\x9f\xd9\xae\xcf>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xa2c\x12.\xb7\xbe`\'\xcb\xb6\xaf\xdc\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x06\xb5\xaa\xe6\x05\xe4\xc3\x90\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4\x84$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\xd0\xe1{\x84\xb5\x82q\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xf8\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\xb0\xc0:\x8f|\x8f\x06\xf8T\x826`M\x11\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?\x87\x84\\/y\xed\x01#?\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\xa3\xcc\x9b\f\xa7\x8f\x91O\xc9\xb9\x14M\x8b\xd0\xc0\xb8L\xbd\x1c4\xb59\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\f\xeaH\xd8cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\"\x1e\xf0', 0x6) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000080)={0x6, @sliced={0x3, [0x0, 0x53, 0x405, 0x7, 0xe72b, 0x7, 0x5, 0x80, 0x3b2e, 0x8, 0x4, 0x800, 0xe81d, 0x6e, 0x1, 0x5, 0xd842, 0x7, 0xfff, 0x6, 0xba4, 0xffff, 0xfffd, 0x101, 0x7, 0x1, 0x2, 0xa, 0x12, 0x400, 0x5, 0xacf, 0x4, 0x3, 0xfffa, 0x800, 0x6433, 0x4, 0x2, 0x7e3, 0x9, 0x477a, 0x1dc, 0x8, 0xa4, 0x65, 0x1d47, 0x6], 0xffffffff}}) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f0000000000000000000400000000"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x810) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r5) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000600)=0x24) ioctl$PPPIOCSNPMODE(0xffffffffffffffff, 0x4008744b, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000640)=ANY=[@ANYBLOB="57957ec0f252a84416c89e9e470bd925ce1fd85a542b4b872c28be46001f62aebb2bfb9e510b7ac22be7682df3bf33dcc59c18a8b93271f5e3ef718f2542e5dc94dbc4d37637c069388e8c6de00231e0ad327a868b69706051a54283006a53d17235126aacd6ef70b31f0975550bd3200663b0c605312ad8d6d798540b09d85996e6af74649ef440e3847e825003381ed66be88531f6dc1eee6ffc2881f4cf28acd480bc85a635e9bd4a7814c6025e1ea6c0a47a142e84e16624e298a880e6de395aa4605a4d00d8ce1a2d133733322570ec0000000000", @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000080002000100000008000100000000001800088014000780080005000000000008000500ffffffff0800048004000b80"], 0x44}}, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) connect$inet(r7, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r7, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'rr\x00', 0x15, 0x88, 0xc000067}, 0x2c) sendmsg$RDMA_NLDEV_CMD_SET(r4, 0x0, 0x40810) 4.35635311s ago: executing program 2 (id=979): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040)='\x00', 0x1, 0x20024044, &(0x7f0000000180)={0xa, 0x2, 0x396, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='scalable\x00', 0x9) syz_open_dev$usbfs(&(0x7f00000000c0), 0x201, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x4e21, @multicast2}, 0xb) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_getparam(r2, &(0x7f0000000100)) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000001c0)='block_bio_complete\x00'}, 0xffffffffffffff88) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x44}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRES8=r1], 0x8c}, 0x1, 0x0, 0x0, 0x10000182}, 0x4000080) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000082}, 0x4000080) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) syz_open_dev$cec(0x0, 0x0, 0xe2940) mkdir(&(0x7f00000002c0)='./file0\x00', 0x10) socket$netlink(0x10, 0x3, 0x0) 3.443413305s ago: executing program 2 (id=980): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$video(&(0x7f0000000040), 0x3ff, 0x0) inotify_init1(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x4}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="41000000010006", 0x7) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)={0x30, 0x3e, 0x9, 0x0, 0x800, {0x3}, [@typed={0x4, 0x4}, @nested={0x18, 0x1, 0x0, 0x1, [@typed={0x14, 0x1a, 0x0, 0x0, @ipv6=@private2={0xfc, 0x2, '\x00', 0x1}}]}]}, 0x30}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e0001000000000000000000"], 0xb8}}, 0x0) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_SET_TIME(r4, 0x4024700a, &(0x7f0000000280)={0x24, 0x2f, 0x0, 0x1c, 0x6, 0x400004f, 0x100010, 0x2c, 0xffffffffffffffff}) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000b40), 0x80002, 0x0) r6 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x60680, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r8, 0x0, 0x80, &(0x7f00000004c0)={'nat\x00', 0x0, 0x0, 0x0, [0x1, 0xffffffffffffffff, 0x0, 0xae, 0x401, 0x8]}, &(0x7f0000000280)=0x78) ioctl$TIOCPKT(r7, 0x5420, &(0x7f00000000c0)=0x3ff) ioctl$TCSETS(r7, 0x5402, &(0x7f0000000080)={0x768, 0x2, 0x100000, 0x2, 0x5, "f694b8000000000000cc29e1f5eba328020016"}) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, &(0x7f0000001ac0)={r5, 0x0, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba073b3e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200"}}) 1.46062721s ago: executing program 2 (id=981): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0xc00) ioctl$VHOST_VDPA_GET_IOVA_RANGE(0xffffffffffffffff, 0x8010af78, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = syz_io_uring_setup(0xeec, &(0x7f0000000780)={0x0, 0x0, 0x10100}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) mount$bind(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(0xffffffffffffffff, &(0x7f0000000800)={0x2020}, 0x2027) 521.106066ms ago: executing program 2 (id=982): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, 0x0, &(0x7f0000000100)) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, 0x0, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES32=0x0], 0x50) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000000, 0x70b8fa6d180fee78, 0xffffffffffffffff, 0xf0a50000) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x8, 0x11, r2, 0xb0d9000) ioctl$KVM_RUN(r5, 0xae80, 0x0) 184.965747ms ago: executing program 2 (id=983): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000000c000000bca30000000000002403000020feffff620af8fff8ffffff71a4f8ff000000001f03000000000000e5000200000000002604fdffff02000014010000033800001d130000000000007a0a00fe0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x203}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r2}, 0x10) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc4c85512, &(0x7f0000000280)={{0x6, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffefffffffff, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffbfffffff, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x3, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0x40, 0x0, 0xfffffffffffffffd, 0x100200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x10000, 0x1000, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7, 0x10000, 0x7785, 0x0, 0x4, 0x0, 0x8, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x1, 0x0, 0xfffffffffffffffe, 0x5, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x80000000000000, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x100, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xc0c0, 0x0, 0x0, 0x0, 0x0, 0x1000000000001, 0x0, 0x3, 0x0, 0xffffffffffeffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x80]}) 0s ago: executing program 47 (id=983): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000000c000000bca30000000000002403000020feffff620af8fff8ffffff71a4f8ff000000001f03000000000000e5000200000000002604fdffff02000014010000033800001d130000000000007a0a00fe0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x203}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r2}, 0x10) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc4c85512, &(0x7f0000000280)={{0x6, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffefffffffff, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffbfffffff, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x3, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0x40, 0x0, 0xfffffffffffffffd, 0x100200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x10000, 0x1000, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7, 0x10000, 0x7785, 0x0, 0x4, 0x0, 0x8, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x1, 0x0, 0xfffffffffffffffe, 0x5, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x80000000000000, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x100, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xc0c0, 0x0, 0x0, 0x0, 0x0, 0x1000000000001, 0x0, 0x3, 0x0, 0xffffffffffeffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x80]}) kernel console output (not intermixed with test programs): 554][ T9212] hsr_slave_1: entered promiscuous mode [ 411.399285][ T5125] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 411.400515][ T9212] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 411.419978][ T9212] Cannot create hsr debugfs directory [ 411.423397][ T5125] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 411.629012][ T9203] hsr_slave_0: entered promiscuous mode [ 411.635295][ T9203] hsr_slave_1: entered promiscuous mode [ 411.641669][ T9203] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 411.649627][ T9203] Cannot create hsr debugfs directory [ 412.095099][ T9254] chnl_net:caif_netlink_parms(): no params data found [ 412.182019][ T9254] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.189478][ T9254] bridge0: port 1(bridge_slave_0) entered disabled state [ 412.197220][ T9254] bridge_slave_0: entered allmulticast mode [ 412.204103][ T9254] bridge_slave_0: entered promiscuous mode [ 412.226415][ T9254] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.233560][ T9254] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.241247][ T9254] bridge_slave_1: entered allmulticast mode [ 412.249205][ T9254] bridge_slave_1: entered promiscuous mode [ 412.287795][ T9254] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 412.299874][ T9254] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 412.329771][ T9254] team0: Port device team_slave_0 added [ 412.352391][ T9254] team0: Port device team_slave_1 added [ 412.376788][ T9254] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 412.383775][ T9254] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 412.410142][ T9254] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 412.426082][ T9254] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 412.433165][ T9254] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 412.461711][ T9254] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 412.536583][ T9254] hsr_slave_0: entered promiscuous mode [ 412.548172][ T9254] hsr_slave_1: entered promiscuous mode [ 412.554309][ T9254] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 412.562726][ T9254] Cannot create hsr debugfs directory [ 412.650661][ T9207] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 412.663851][ T9207] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 412.680893][ T9207] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 412.692554][ T9207] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 412.828626][ T9207] 8021q: adding VLAN 0 to HW filter on device bond0 [ 412.856374][ T9207] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.903822][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.910955][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 412.935474][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.942635][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 413.001550][ T1315] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.060425][ T1315] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.159059][ T1315] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.179512][ T9212] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 413.205170][ T9212] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 413.216578][ T9212] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 413.244929][ T1315] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.264231][ T9212] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 413.300303][ T9207] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 413.476564][ T1315] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.510758][ T9212] 8021q: adding VLAN 0 to HW filter on device bond0 [ 413.527272][ T5821] Bluetooth: hci1: command tx timeout [ 413.534048][ T9212] 8021q: adding VLAN 0 to HW filter on device team0 [ 413.560316][ T6141] bridge0: port 1(bridge_slave_0) entered blocking state [ 413.567456][ T6141] bridge0: port 1(bridge_slave_0) entered forwarding state [ 413.594895][ T1315] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.628943][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 413.636046][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 413.681416][ T1315] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.726609][ T9207] veth0_vlan: entered promiscuous mode [ 413.760190][ T1315] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.799027][ T9207] veth1_vlan: entered promiscuous mode [ 413.899551][ T9212] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 413.933570][ T9207] veth0_macvtap: entered promiscuous mode [ 413.984174][ T9209] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 414.001039][ T9209] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 414.070082][ T9254] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.092611][ T9207] veth1_macvtap: entered promiscuous mode [ 414.099814][ T9209] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 414.124681][ T1315] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.149130][ T9209] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 414.183083][ T9254] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.219534][ T1315] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.255138][ T9254] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.276020][ T9207] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 414.287132][ T9207] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.297536][ T9207] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 414.308564][ T9207] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.320044][ T9207] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 414.330931][ T9207] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.340918][ T9207] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 414.351685][ T9207] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.362665][ T9207] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 414.374267][ T9207] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 414.384802][ T9207] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.395545][ T9207] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 414.410305][ T9207] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.420248][ T9207] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 414.430816][ T9207] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.440701][ T9207] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 414.451288][ T9207] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 414.461859][ T9207] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 414.487559][ T9254] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.513862][ T1315] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.560034][ T9207] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.568967][ T9207] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.580148][ T9207] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.588980][ T9207] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.611306][ T9212] veth0_vlan: entered promiscuous mode [ 414.653077][ T1315] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.673683][ T9212] veth1_vlan: entered promiscuous mode [ 414.863451][ T3550] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.873955][ T3550] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.891466][ T9209] 8021q: adding VLAN 0 to HW filter on device bond0 [ 414.924160][ T9212] veth0_macvtap: entered promiscuous mode [ 414.948294][ T1315] bridge_slave_1: left allmulticast mode [ 414.953956][ T1315] bridge_slave_1: left promiscuous mode [ 414.960247][ T1315] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.968612][ T1315] bridge_slave_0: left allmulticast mode [ 414.974241][ T1315] bridge_slave_0: left promiscuous mode [ 414.980442][ T1315] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.992260][ T1315] bridge_slave_1: left allmulticast mode [ 414.998287][ T1315] bridge_slave_1: left promiscuous mode [ 415.003897][ T1315] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.013062][ T1315] bridge_slave_0: left allmulticast mode [ 415.018954][ T1315] bridge_slave_0: left promiscuous mode [ 415.024550][ T1315] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.034219][ T1315] bridge_slave_1: left allmulticast mode [ 415.040082][ T1315] bridge_slave_1: left promiscuous mode [ 415.045740][ T1315] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.057996][ T1315] bridge_slave_0: left allmulticast mode [ 415.063638][ T1315] bridge_slave_0: left promiscuous mode [ 415.069749][ T1315] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.085518][ T1315] bridge_slave_1: left allmulticast mode [ 415.091397][ T1315] bridge_slave_1: left promiscuous mode [ 415.098301][ T1315] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.106382][ T1315] bridge_slave_0: left allmulticast mode [ 415.112509][ T1315] bridge_slave_0: left promiscuous mode [ 415.118909][ T1315] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.128186][ T1315] bridge_slave_1: left allmulticast mode [ 415.133809][ T1315] bridge_slave_1: left promiscuous mode [ 415.140600][ T1315] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.149272][ T1315] bridge_slave_0: left allmulticast mode [ 415.154898][ T1315] bridge_slave_0: left promiscuous mode [ 415.161262][ T1315] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.170426][ T1315] bridge_slave_1: left allmulticast mode [ 415.176045][ T1315] bridge_slave_1: left promiscuous mode [ 415.182030][ T1315] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.193843][ T1315] bridge_slave_0: left allmulticast mode [ 415.199698][ T1315] bridge_slave_0: left promiscuous mode [ 415.205302][ T1315] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.214775][ T1315] bridge_slave_1: left allmulticast mode [ 415.220817][ T1315] bridge_slave_1: left promiscuous mode [ 415.226449][ T1315] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.234705][ T1315] bridge_slave_0: left allmulticast mode [ 415.241636][ T1315] bridge_slave_0: left promiscuous mode [ 415.247602][ T1315] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.600279][ T5821] Bluetooth: hci1: command tx timeout [ 416.200122][ T1315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 416.209964][ T1315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 416.220932][ T1315] bond0 (unregistering): Released all slaves [ 416.232205][ T1315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 416.243840][ T1315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 416.253248][ T1315] bond0 (unregistering): Released all slaves [ 416.322909][ T1315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 416.333022][ T1315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 416.342791][ T1315] bond0 (unregistering): Released all slaves [ 416.360759][ T1315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 416.370953][ T1315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 416.382239][ T1315] bond0 (unregistering): Released all slaves [ 416.450694][ T1315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 416.460931][ T1315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 416.471600][ T1315] bond0 (unregistering): Released all slaves [ 416.540522][ T1315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 416.551262][ T1315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 416.563008][ T1315] bond0 (unregistering): Released all slaves [ 416.640969][ T1315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 416.651318][ T1315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 416.662849][ T1315] bond0 (unregistering): Released all slaves [ 416.674744][ T9212] veth1_macvtap: entered promiscuous mode [ 416.694423][ T9254] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 416.730535][ T5957] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 416.740525][ T9254] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 416.747750][ T5957] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 416.764130][ T9254] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 416.825883][ T9203] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 416.845645][ T9254] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 416.879307][ T9209] 8021q: adding VLAN 0 to HW filter on device team0 [ 416.891856][ T9212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 416.903273][ T9212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 416.913220][ T9212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 416.923728][ T9212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 416.933638][ T9212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 416.944101][ T9212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 416.954677][ T9212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 416.965468][ T9212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 416.975685][ T9212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 416.986128][ T9212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 416.997381][ T9212] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 417.006043][ T9203] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 417.023091][ T9203] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 417.064333][ T9212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 417.075080][ T9212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 417.085158][ T9212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 417.095657][ T9212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 417.105489][ T9212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 417.116018][ T9212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 417.126303][ T9212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 417.143589][ T9212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 417.153493][ T9212] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 417.164487][ T9212] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 417.175623][ T9212] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 417.194287][ T9203] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 417.223429][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 417.230604][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 417.257184][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 417.263284][ T9285] FAULT_INJECTION: forcing a failure. [ 417.263284][ T9285] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 417.264297][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 417.291133][ T9285] CPU: 0 UID: 60928 PID: 9285 Comm: syz.8.838 Not tainted 6.15.0-rc4-syzkaller-00052-g4f79eaa2ceac #0 PREEMPT(full) [ 417.291156][ T9285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 417.291165][ T9285] Call Trace: [ 417.291171][ T9285] [ 417.291177][ T9285] dump_stack_lvl+0x16c/0x1f0 [ 417.291203][ T9285] should_fail_ex+0x512/0x640 [ 417.291226][ T9285] strncpy_from_user+0x3b/0x2e0 [ 417.291246][ T9285] getname_flags.part.0+0x8f/0x550 [ 417.291269][ T9285] getname_flags+0x93/0xf0 [ 417.291291][ T9285] path_setxattrat+0x27a/0x2a0 [ 417.291315][ T9285] ? __pfx_path_setxattrat+0x10/0x10 [ 417.291341][ T9285] ? ksys_write+0x190/0x240 [ 417.291381][ T9285] ? fput+0x70/0xf0 [ 417.291397][ T9285] ? ksys_write+0x1b9/0x240 [ 417.291417][ T9285] ? __pfx_ksys_write+0x10/0x10 [ 417.291437][ T9285] ? rcu_is_watching+0x12/0xc0 [ 417.291457][ T9285] __x64_sys_setxattr+0xc6/0x140 [ 417.291470][ T9285] ? do_syscall_64+0x91/0x260 [ 417.291489][ T9285] ? lockdep_hardirqs_on+0x7c/0x110 [ 417.291507][ T9285] do_syscall_64+0xcd/0x260 [ 417.291528][ T9285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.291544][ T9285] RIP: 0033:0x7f480138e969 [ 417.291558][ T9285] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 417.291572][ T9285] RSP: 002b:00007f48021ab038 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 417.291588][ T9285] RAX: ffffffffffffffda RBX: 00007f48015b5fa0 RCX: 00007f480138e969 [ 417.291598][ T9285] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000200000000240 [ 417.291608][ T9285] RBP: 00007f48021ab090 R08: 0000000000000000 R09: 0000000000000000 [ 417.291617][ T9285] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 417.291626][ T9285] R13: 0000000000000000 R14: 00007f48015b5fa0 R15: 00007ffcc830a9a8 [ 417.291647][ T9285] [ 417.605280][ T9212] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.622394][ T9212] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.639063][ T9212] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.648065][ T9212] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.676890][ T5821] Bluetooth: hci1: command tx timeout [ 417.794375][ T9209] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 418.146918][ T9254] 8021q: adding VLAN 0 to HW filter on device bond0 [ 418.212294][ T9203] 8021q: adding VLAN 0 to HW filter on device bond0 [ 418.339831][ T5957] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 418.350401][ T9254] 8021q: adding VLAN 0 to HW filter on device team0 [ 418.395448][ T5957] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 418.409694][ T6140] bridge0: port 1(bridge_slave_0) entered blocking state [ 418.416844][ T6140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 418.469693][ T3550] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.476848][ T3550] bridge0: port 2(bridge_slave_1) entered forwarding state [ 418.492685][ T9209] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 418.511725][ T9203] 8021q: adding VLAN 0 to HW filter on device team0 [ 418.521040][ T3550] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 418.552771][ T3550] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 418.683957][ T6141] bridge0: port 1(bridge_slave_0) entered blocking state [ 418.691069][ T6141] bridge0: port 1(bridge_slave_0) entered forwarding state [ 418.700948][ T6141] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.708026][ T6141] bridge0: port 2(bridge_slave_1) entered forwarding state [ 418.841968][ T9203] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 418.888652][ T1315] hsr_slave_0: left promiscuous mode [ 418.894261][ T1315] hsr_slave_1: left promiscuous mode [ 418.904052][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 418.923091][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 418.925807][ T1315] hsr_slave_0: left promiscuous mode [ 418.926080][ T1315] hsr_slave_1: left promiscuous mode [ 418.926328][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 418.926611][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 418.932348][ T1315] hsr_slave_0: left promiscuous mode [ 418.932602][ T1315] hsr_slave_1: left promiscuous mode [ 418.932848][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 418.933098][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 418.937763][ T1315] hsr_slave_0: left promiscuous mode [ 418.938036][ T1315] hsr_slave_1: left promiscuous mode [ 418.938281][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 418.939360][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 418.997001][ T1315] hsr_slave_0: left promiscuous mode [ 418.997265][ T1315] hsr_slave_1: left promiscuous mode [ 418.997513][ T1315] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 418.997542][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 418.997914][ T1315] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 418.997935][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 419.016092][ T1315] hsr_slave_0: left promiscuous mode [ 419.016546][ T1315] hsr_slave_1: left promiscuous mode [ 419.016919][ T1315] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 419.016979][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 419.017369][ T1315] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 419.017389][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 419.023908][ T1315] hsr_slave_0: left promiscuous mode [ 419.024167][ T1315] hsr_slave_1: left promiscuous mode [ 419.024429][ T1315] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 419.024466][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 419.024821][ T1315] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 419.024841][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 419.105510][ T1315] veth1_macvtap: left promiscuous mode [ 419.105571][ T1315] veth0_macvtap: left promiscuous mode [ 419.105642][ T1315] veth1_vlan: left promiscuous mode [ 419.105694][ T1315] veth0_vlan: left promiscuous mode [ 419.111745][ T1315] veth0_macvtap: left allmulticast mode [ 419.111799][ T1315] veth1_macvtap: left promiscuous mode [ 419.111827][ T1315] veth0_macvtap: left promiscuous mode [ 419.111869][ T1315] veth1_vlan: left promiscuous mode [ 419.111916][ T1315] veth0_vlan: left promiscuous mode [ 419.114699][ T1315] veth0_macvtap: left allmulticast mode [ 419.114745][ T1315] veth1_macvtap: left promiscuous mode [ 419.114774][ T1315] veth0_macvtap: left promiscuous mode [ 419.115539][ T1315] veth1_vlan: left promiscuous mode [ 419.115688][ T1315] veth0_vlan: left promiscuous mode [ 419.793813][ T5821] Bluetooth: hci1: command tx timeout [ 419.944813][ T9306] tty tty39: ldisc open failed (-12), clearing slot 38 [ 419.967556][ T1315] team0 (unregistering): Port device team_slave_1 removed [ 420.062641][ T1315] team0 (unregistering): Port device team_slave_0 removed [ 421.422149][ T30] audit: type=1400 audit(1746124821.459:808): avc: denied { listen } for pid=9321 comm="syz.8.847" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 421.512967][ T30] audit: type=1400 audit(1746124821.539:809): avc: denied { create } for pid=9321 comm="syz.8.847" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 421.765486][ T9330] x_tables: duplicate underflow at hook 1 [ 421.993911][ T30] audit: type=1400 audit(1746124821.919:810): avc: denied { getopt } for pid=9326 comm="syz.9.848" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 422.445730][ T1315] team0 (unregistering): Port device team_slave_1 removed [ 422.667692][ T1315] team0 (unregistering): Port device team_slave_0 removed [ 423.109242][ T1315] team0 (unregistering): Port device team_slave_1 removed [ 423.172319][ T1315] team0 (unregistering): Port device team_slave_0 removed [ 423.348330][ T9339] netlink: 'syz.8.850': attribute type 3 has an invalid length. [ 423.805037][ T1315] team0 (unregistering): Port device team_slave_1 removed [ 423.833594][ T1315] team0 (unregistering): Port device team_slave_0 removed [ 424.302665][ T1315] team0 (unregistering): Port device team_slave_1 removed [ 424.336416][ T1315] team0 (unregistering): Port device team_slave_0 removed [ 424.864551][ T1315] team0 (unregistering): Port device team_slave_1 removed [ 424.895531][ T1315] team0 (unregistering): Port device team_slave_0 removed [ 425.392625][ T1315] team0 (unregistering): Port device team_slave_1 removed [ 425.424490][ T1315] team0 (unregistering): Port device team_slave_0 removed [ 425.693481][ T9327] bridge0: entered promiscuous mode [ 425.707038][ T9327] macvlan2: entered promiscuous mode [ 425.713063][ T9327] bridge0: port 3(macvlan2) entered blocking state [ 425.729874][ T9327] bridge0: port 3(macvlan2) entered disabled state [ 425.741121][ T9327] macvlan2: entered allmulticast mode [ 425.747071][ T9327] bridge0: entered allmulticast mode [ 425.754098][ T9327] macvlan2: left allmulticast mode [ 425.762500][ T9327] bridge0: left allmulticast mode [ 425.771890][ T9327] bridge0: left promiscuous mode [ 425.866583][ T9254] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 425.885290][ T9254] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 426.400130][ T9209] veth0_vlan: entered promiscuous mode [ 426.600608][ T9209] veth1_vlan: entered promiscuous mode [ 427.026488][ T9209] veth0_macvtap: entered promiscuous mode [ 427.057943][ T5860] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 427.067755][ T9209] veth1_macvtap: entered promiscuous mode [ 427.091105][ T9209] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 427.109724][ T9209] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 427.121236][ T9209] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 427.132643][ T9209] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 427.143355][ T9209] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 427.154617][ T9209] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 427.172034][ T9209] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 427.185440][ T9209] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 427.203092][ T9209] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 427.213327][ T9209] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 427.223950][ T5860] usb 9-1: Using ep0 maxpacket: 16 [ 427.230430][ T9209] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 427.241406][ T5860] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 427.250570][ T5860] usb 9-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 427.261096][ T9209] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 427.271637][ T5860] usb 9-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 427.271860][ T9209] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 427.281925][ T5860] usb 9-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 427.292737][ T9209] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 427.307462][ T5860] usb 9-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 427.321083][ T5860] usb 9-1: config 1 interface 0 has no altsetting 0 [ 427.327942][ T5860] usb 9-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 427.330413][ T9209] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 427.345985][ T5860] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.357498][ T9209] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 427.366219][ T9209] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 427.369878][ T5860] ums-sddr09 9-1:1.0: USB Mass Storage device detected [ 427.379434][ T9209] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 427.458863][ T9254] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 427.513927][ T9203] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 427.603212][ T5860] scsi host1: usb-storage 9-1:1.0 [ 427.699050][ T3550] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 427.719366][ T3550] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 427.805482][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 427.851411][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 427.864400][ T5845] usb 9-1: USB disconnect, device number 2 [ 428.049493][ T9254] veth0_vlan: entered promiscuous mode [ 428.114172][ T9254] veth1_vlan: entered promiscuous mode [ 428.149434][ T9254] veth0_macvtap: entered promiscuous mode [ 428.158636][ T9254] veth1_macvtap: entered promiscuous mode [ 428.174687][ T9254] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 428.185698][ T9254] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 428.197849][ T9254] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 428.208953][ T9254] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 428.220513][ T9254] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 428.231347][ T9254] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 428.244571][ T9254] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 428.260471][ T9254] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 428.277491][ T9254] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 428.296583][ T9390] vlan2: entered allmulticast mode [ 428.305463][ T9390] veth1: entered allmulticast mode [ 428.760516][ T9254] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 428.772614][ T9254] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 428.782658][ T9254] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 428.793198][ T9254] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 428.803330][ T9254] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 428.813920][ T9254] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 428.823804][ T9254] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 428.834957][ T9254] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 428.850211][ T9254] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 428.871853][ T9203] veth0_vlan: entered promiscuous mode [ 428.896451][ T9254] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.925157][ T9254] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.952399][ T9254] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.961818][ T9254] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.001322][ T9203] veth1_vlan: entered promiscuous mode [ 429.106392][ T9203] veth0_macvtap: entered promiscuous mode [ 429.219255][ T9203] veth1_macvtap: entered promiscuous mode [ 429.319401][ T9203] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 429.333175][ T9203] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 429.350004][ T9203] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 429.403272][ T9203] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 429.413707][ T9203] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 429.426016][ T9203] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 429.439973][ T9203] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 429.461280][ T9203] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 429.473110][ T9203] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 429.495868][ T9203] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 429.521322][ T9203] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 429.556432][ T9203] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 429.575624][ T9203] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 429.585769][ T9203] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 429.596616][ T9203] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 429.616953][ T9203] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 429.648868][ T9203] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 429.689861][ T9203] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 429.710873][ T9203] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 429.743512][ T9203] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 429.771128][ T9203] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 429.911041][ T9203] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 429.943890][ T6093] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 429.962063][ T6093] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.100567][ T9417] debugfs: Directory 'ptm0' with parent 'caif_serial' already present! [ 430.367896][ T9203] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.382684][ T9203] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.391924][ T9203] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.402529][ T9203] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.550031][ T9421] mkiss: ax0: crc mode is auto. [ 430.586225][ T5957] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 430.680089][ T5957] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.935297][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 430.955007][ T30] audit: type=1400 audit(1746124830.989:811): avc: denied { read } for pid=9431 comm="syz.8.874" name="btrfs-control" dev="devtmpfs" ino=1309 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 430.998964][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 431.065074][ T30] audit: type=1400 audit(1746124831.019:812): avc: denied { open } for pid=9431 comm="syz.8.874" path="/dev/btrfs-control" dev="devtmpfs" ino=1309 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 431.199386][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 431.219388][ T30] audit: type=1400 audit(1746124831.019:813): avc: denied { ioctl } for pid=9431 comm="syz.8.874" path="/dev/btrfs-control" dev="devtmpfs" ino=1309 ioctlcmd=0x9405 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 431.244940][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 431.414218][ T9445] FAULT_INJECTION: forcing a failure. [ 431.414218][ T9445] name failslab, interval 1, probability 0, space 0, times 0 [ 431.431696][ T9445] CPU: 0 UID: 0 PID: 9445 Comm: syz.9.877 Not tainted 6.15.0-rc4-syzkaller-00052-g4f79eaa2ceac #0 PREEMPT(full) [ 431.431721][ T9445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 431.431731][ T9445] Call Trace: [ 431.431742][ T9445] [ 431.431750][ T9445] dump_stack_lvl+0x16c/0x1f0 [ 431.431776][ T9445] should_fail_ex+0x512/0x640 [ 431.431797][ T9445] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 431.431823][ T9445] should_failslab+0xc2/0x120 [ 431.431842][ T9445] __kmalloc_cache_noprof+0x6a/0x3e0 [ 431.431866][ T9445] ? mark_held_locks+0x49/0x80 [ 431.431888][ T9445] ? find_css_set+0x75d/0x1c70 [ 431.431914][ T9445] find_css_set+0x75d/0x1c70 [ 431.431945][ T9445] ? __pfx_find_css_set+0x10/0x10 [ 431.431988][ T9445] cgroup_migrate_prepare_dst+0x10b/0x7f0 [ 431.432019][ T9445] cgroup_attach_task+0x48e/0x910 [ 431.432047][ T9445] ? __pfx_cgroup_attach_task+0x10/0x10 [ 431.432083][ T9445] ? cgroup_attach_permissions+0x2a1/0x790 [ 431.432108][ T9445] ? __cgroup_procs_write+0x3c7/0x660 [ 431.432124][ T9445] __cgroup_procs_write+0x3c7/0x660 [ 431.432143][ T9445] ? __pfx___cgroup_procs_write+0x10/0x10 [ 431.432169][ T9445] cgroup_procs_write+0x26/0x60 [ 431.432186][ T9445] cgroup_file_write+0x1ec/0x790 [ 431.432206][ T9445] ? __pfx_cgroup_procs_write+0x10/0x10 [ 431.432224][ T9445] ? __pfx_cgroup_file_write+0x10/0x10 [ 431.432243][ T9445] ? trace_kmalloc+0x2b/0xd0 [ 431.432270][ T9445] kernfs_fop_write_iter+0x351/0x510 [ 431.432292][ T9445] ? __pfx_cgroup_file_write+0x10/0x10 [ 431.432316][ T9445] vfs_write+0x5ba/0x1180 [ 431.432341][ T9445] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 431.432364][ T9445] ? __pfx___mutex_lock+0x10/0x10 [ 431.432386][ T9445] ? __pfx_vfs_write+0x10/0x10 [ 431.432428][ T9445] ksys_write+0x12a/0x240 [ 431.432452][ T9445] ? __pfx_ksys_write+0x10/0x10 [ 431.432474][ T9445] ? rcu_is_watching+0x12/0xc0 [ 431.432500][ T9445] do_syscall_64+0xcd/0x260 [ 431.432524][ T9445] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.432541][ T9445] RIP: 0033:0x7f070478e969 [ 431.432556][ T9445] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 431.432572][ T9445] RSP: 002b:00007f07025f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 431.432588][ T9445] RAX: ffffffffffffffda RBX: 00007f07049b6160 RCX: 00007f070478e969 [ 431.432599][ T9445] RDX: 0000000000000012 RSI: 0000200000000180 RDI: 0000000000000006 [ 431.432609][ T9445] RBP: 00007f07025f6090 R08: 0000000000000000 R09: 0000000000000000 [ 431.432619][ T9445] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 431.432628][ T9445] R13: 0000000000000000 R14: 00007f07049b6160 R15: 00007fff8cde4658 [ 431.432652][ T9445] [ 431.701814][ C0] vkms_vblank_simulate: vblank timer overrun [ 432.828786][ T30] audit: type=1400 audit(1746124832.869:814): avc: denied { connect } for pid=9463 comm="syz.7.882" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 435.076853][ T5860] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 435.136959][ T69] bridge_slave_1: left allmulticast mode [ 435.142650][ T69] bridge_slave_1: left promiscuous mode [ 435.153221][ T69] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.163902][ T69] bridge_slave_0: left allmulticast mode [ 435.193216][ T69] bridge_slave_0: left promiscuous mode [ 435.206136][ T69] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.336817][ T5860] usb 5-1: Using ep0 maxpacket: 32 [ 435.348239][ T5860] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 435.356379][ T5860] usb 5-1: config 0 has no interface number 0 [ 435.380431][ T9489] FAULT_INJECTION: forcing a failure. [ 435.380431][ T9489] name failslab, interval 1, probability 0, space 0, times 0 [ 435.394010][ T9489] CPU: 1 UID: 0 PID: 9489 Comm: syz.7.892 Not tainted 6.15.0-rc4-syzkaller-00052-g4f79eaa2ceac #0 PREEMPT(full) [ 435.394034][ T9489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 435.394044][ T9489] Call Trace: [ 435.394050][ T9489] [ 435.394057][ T9489] dump_stack_lvl+0x16c/0x1f0 [ 435.394082][ T9489] should_fail_ex+0x512/0x640 [ 435.394107][ T9489] should_failslab+0xc2/0x120 [ 435.394125][ T9489] __kmalloc_cache_noprof+0x6a/0x3e0 [ 435.394150][ T9489] ? tipc_conn_alloc+0x48/0x590 [ 435.394171][ T9489] tipc_conn_alloc+0x48/0x590 [ 435.394188][ T9489] tipc_topsrv_kern_subscr+0x11c/0x3c0 [ 435.394208][ T9489] ? __pfx_tipc_topsrv_kern_subscr+0x10/0x10 [ 435.394237][ T9489] tipc_group_create+0x4ab/0x660 [ 435.394259][ T9489] tipc_setsockopt+0x7f0/0xdb0 [ 435.394284][ T9489] ? __pfx_tipc_setsockopt+0x10/0x10 [ 435.394315][ T9489] ? selinux_socket_setsockopt+0x6a/0x80 [ 435.394336][ T9489] ? __pfx_tipc_setsockopt+0x10/0x10 [ 435.394359][ T9489] do_sock_setsockopt+0x221/0x470 [ 435.394380][ T9489] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 435.394415][ T9489] __sys_setsockopt+0x1a0/0x230 [ 435.394451][ T9489] __x64_sys_setsockopt+0xbd/0x160 [ 435.394475][ T9489] ? do_syscall_64+0x91/0x260 [ 435.394494][ T9489] ? lockdep_hardirqs_on+0x7c/0x110 [ 435.394514][ T9489] do_syscall_64+0xcd/0x260 [ 435.394536][ T9489] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.394553][ T9489] RIP: 0033:0x7eff6958e969 [ 435.394567][ T9489] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 435.394583][ T9489] RSP: 002b:00007eff6a40d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 435.394599][ T9489] RAX: ffffffffffffffda RBX: 00007eff697b6160 RCX: 00007eff6958e969 [ 435.394610][ T9489] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000009 [ 435.394620][ T9489] RBP: 00007eff6a40d090 R08: 0000000000000010 R09: 0000000000000000 [ 435.394630][ T9489] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 435.394640][ T9489] R13: 0000000000000000 R14: 00007eff697b6160 R15: 00007ffcb8660c08 [ 435.394662][ T9489] [ 435.698214][ T5860] usb 5-1: config 0 interface 12 has no altsetting 0 [ 435.953340][ T5860] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 435.962539][ T5860] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.971486][ T5860] usb 5-1: Product: syz [ 436.045461][ T5860] usb 5-1: Manufacturer: syz [ 436.050188][ T5860] usb 5-1: SerialNumber: syz [ 436.069836][ T5860] usb 5-1: config 0 descriptor?? [ 436.197581][ T5125] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 436.210073][ T5125] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 436.219487][ T5125] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 436.233489][ T5125] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 436.243768][ T5125] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 436.395768][ T69] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 436.407516][ T69] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 436.418587][ T69] bond0 (unregistering): Released all slaves [ 436.544125][ T9472] netlink: 4 bytes leftover after parsing attributes in process `syz.4.884'. [ 437.013577][ T69] hsr_slave_0: left promiscuous mode [ 437.075185][ T69] hsr_slave_1: left promiscuous mode [ 437.318709][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 437.362999][ T69] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 437.486980][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 437.494498][ T69] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 437.552653][ T69] veth1_macvtap: left promiscuous mode [ 437.636461][ T69] veth0_macvtap: left promiscuous mode [ 437.722348][ T69] veth1_vlan: left promiscuous mode [ 437.764168][ T69] veth0_vlan: left promiscuous mode [ 438.277619][ T5860] f81534 5-1:0.12: f81534_set_register: reg: 1002 data: 3 failed: -32 [ 438.304194][ T5860] f81534 5-1:0.12: f81534_find_config_idx: read failed: -32 [ 438.319415][ T5125] Bluetooth: hci0: command tx timeout [ 438.416488][ T9523] FAULT_INJECTION: forcing a failure. [ 438.416488][ T9523] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 438.430787][ T9523] CPU: 0 UID: 0 PID: 9523 Comm: syz.9.903 Not tainted 6.15.0-rc4-syzkaller-00052-g4f79eaa2ceac #0 PREEMPT(full) [ 438.430811][ T9523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 438.430821][ T9523] Call Trace: [ 438.430827][ T9523] [ 438.430833][ T9523] dump_stack_lvl+0x16c/0x1f0 [ 438.430859][ T9523] should_fail_ex+0x512/0x640 [ 438.430884][ T9523] _copy_from_user+0x2e/0xd0 [ 438.430908][ T9523] do_sys_poll+0x1d5/0xe00 [ 438.430941][ T9523] ? __pfx_do_sys_poll+0x10/0x10 [ 438.430992][ T9523] ? find_held_lock+0x2b/0x80 [ 438.431059][ T9523] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 438.431085][ T9523] ? set_user_sigmask+0x21b/0x2b0 [ 438.431105][ T9523] ? __pfx_set_user_sigmask+0x10/0x10 [ 438.431123][ T9523] ? __fget_files+0x20e/0x3c0 [ 438.431152][ T9523] __x64_sys_ppoll+0x254/0x2d0 [ 438.431178][ T9523] ? __pfx___x64_sys_ppoll+0x10/0x10 [ 438.431201][ T9523] ? ksys_write+0x1b9/0x240 [ 438.431225][ T9523] ? __pfx_ksys_write+0x10/0x10 [ 438.431247][ T9523] ? rcu_is_watching+0x12/0xc0 [ 438.431273][ T9523] do_syscall_64+0xcd/0x260 [ 438.431296][ T9523] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.431315][ T9523] RIP: 0033:0x7f070478e969 [ 438.431329][ T9523] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 438.431345][ T9523] RSP: 002b:00007f070552b038 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 438.431361][ T9523] RAX: ffffffffffffffda RBX: 00007f07049b6080 RCX: 00007f070478e969 [ 438.431372][ T9523] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0 [ 438.431383][ T9523] RBP: 00007f070552b090 R08: 0000000000000000 R09: 0000000000000000 [ 438.431393][ T9523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 438.431403][ T9523] R13: 0000000000000000 R14: 00007f07049b6080 R15: 00007fff8cde4658 [ 438.431424][ T9523] [ 438.964894][ T5860] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -32 [ 438.998092][ T5860] f81534 5-1:0.12: probe with driver f81534 failed with error -32 [ 439.122569][ T5821] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 439.136327][ T5821] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 439.146161][ T5821] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 439.162639][ T5821] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 439.172033][ T5821] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 439.352676][ T69] team0 (unregistering): Port device team_slave_1 removed [ 439.398422][ T69] team0 (unregistering): Port device team_slave_0 removed [ 439.601767][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.608181][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.360214][ T5860] usb 5-1: USB disconnect, device number 6 [ 440.397152][ T5821] Bluetooth: hci0: command tx timeout [ 440.653934][ T9494] chnl_net:caif_netlink_parms(): no params data found [ 441.276740][ T5821] Bluetooth: hci2: command tx timeout [ 441.488725][ T9525] chnl_net:caif_netlink_parms(): no params data found [ 441.561569][ T9562] netlink: 'syz.4.912': attribute type 23 has an invalid length. [ 441.971291][ T9494] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.059397][ T9494] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.130404][ T9494] bridge_slave_0: entered allmulticast mode [ 442.419294][ T9494] bridge_slave_0: entered promiscuous mode [ 442.477011][ T5821] Bluetooth: hci0: command tx timeout [ 442.519542][ T69] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.600396][ T9494] bridge0: port 2(bridge_slave_1) entered blocking state [ 442.620237][ T9494] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.628311][ T9494] bridge_slave_1: entered allmulticast mode [ 442.635853][ T9494] bridge_slave_1: entered promiscuous mode [ 442.708554][ T9525] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.716212][ T9525] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.726175][ T9525] bridge_slave_0: entered allmulticast mode [ 442.876023][ T9525] bridge_slave_0: entered promiscuous mode [ 443.079445][ T69] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.127682][ T9494] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 443.142367][ T9494] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 443.152746][ T9525] bridge0: port 2(bridge_slave_1) entered blocking state [ 443.187600][ T9525] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.194797][ T9525] bridge_slave_1: entered allmulticast mode [ 443.203558][ T9525] bridge_slave_1: entered promiscuous mode [ 443.291817][ T69] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.411947][ T5821] Bluetooth: hci2: command tx timeout [ 443.422591][ T9494] team0: Port device team_slave_0 added [ 443.441543][ T9494] team0: Port device team_slave_1 added [ 443.463180][ T9525] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 443.479648][ T9525] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 443.754616][ T69] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 444.006400][ T9525] team0: Port device team_slave_0 added [ 444.013475][ T9494] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 444.033696][ T9494] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 444.060362][ T9494] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 444.072692][ T9494] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 444.081387][ T9494] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 444.112068][ T9494] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 444.225786][ T9525] team0: Port device team_slave_1 added [ 444.557212][ T5821] Bluetooth: hci0: command tx timeout [ 444.749558][ T9525] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 444.774056][ T9525] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 444.800013][ C0] vkms_vblank_simulate: vblank timer overrun [ 444.840208][ T9525] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 444.875486][ T9525] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 444.976760][ T9525] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 445.002664][ C0] vkms_vblank_simulate: vblank timer overrun [ 445.066778][ T9525] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 445.353754][ T9494] hsr_slave_0: entered promiscuous mode [ 445.380413][ T9494] hsr_slave_1: entered promiscuous mode [ 445.390017][ T9494] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 445.397681][ T9494] Cannot create hsr debugfs directory [ 445.507302][ T5821] Bluetooth: hci2: command tx timeout [ 445.621810][ T9525] hsr_slave_0: entered promiscuous mode [ 445.646608][ T9525] hsr_slave_1: entered promiscuous mode [ 445.663954][ T5125] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 445.674763][ T5125] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 445.683923][ T5125] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 445.684425][ T9525] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 445.701513][ T5125] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 445.716964][ T5125] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 445.780941][ T9525] Cannot create hsr debugfs directory [ 445.919487][ T69] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.065578][ T69] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.694883][ T5821] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 446.704503][ T5821] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 446.713611][ T5821] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 446.725165][ T5821] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 446.740497][ T5821] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 446.740872][ T69] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.845041][ T69] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.190184][ T9602] chnl_net:caif_netlink_parms(): no params data found [ 447.354056][ T9623] Invalid source name [ 447.358567][ T9623] UBIFS error (pid: 9623): cannot open "./file0", error -22 [ 447.445591][ T69] bridge_slave_1: left allmulticast mode [ 447.462902][ T69] bridge_slave_1: left promiscuous mode [ 447.477865][ T69] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.496103][ T69] bridge_slave_0: left allmulticast mode [ 447.501825][ T69] bridge_slave_0: left promiscuous mode [ 447.508115][ T69] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.516985][ T5125] Bluetooth: hci2: command tx timeout [ 447.518805][ T69] bridge_slave_1: left allmulticast mode [ 447.528697][ T69] bridge_slave_1: left promiscuous mode [ 447.534339][ T69] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.543339][ T69] bridge_slave_0: left allmulticast mode [ 447.549233][ T69] bridge_slave_0: left promiscuous mode [ 447.554923][ T69] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.766834][ T5125] Bluetooth: hci1: command tx timeout [ 447.964850][ T69] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 447.976205][ T69] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 447.988030][ T69] bond0 (unregistering): Released all slaves [ 448.041998][ T30] audit: type=1400 audit(1746124848.079:815): avc: denied { create } for pid=9626 comm="syz.7.931" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 448.042182][ T9627] ======================================================= [ 448.042182][ T9627] WARNING: The mand mount option has been deprecated and [ 448.042182][ T9627] and is ignored by this kernel. Remove the mand [ 448.042182][ T9627] option from the mount to silence this warning. [ 448.042182][ T9627] ======================================================= [ 448.104926][ T30] audit: type=1400 audit(1746124848.079:816): avc: denied { append } for pid=9626 comm="syz.7.931" name="loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 448.165644][ T69] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 448.169384][ T30] audit: type=1400 audit(1746124848.199:817): avc: denied { mounton } for pid=9626 comm="syz.7.931" path="/19/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 448.197989][ T30] audit: type=1400 audit(1746124848.229:818): avc: denied { remount } for pid=9626 comm="syz.7.931" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 448.219130][ T30] audit: type=1400 audit(1746124848.259:819): avc: denied { ioctl } for pid=9626 comm="syz.7.931" path="socket:[31083]" dev="sockfs" ino=31083 ioctlcmd=0x89e3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 448.219475][ T69] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 448.253827][ T69] bond0 (unregistering): Released all slaves [ 448.263925][ T9608] chnl_net:caif_netlink_parms(): no params data found [ 448.292526][ T9627] netlink: 28 bytes leftover after parsing attributes in process `syz.7.931'. [ 448.302011][ T9627] netlink: 28 bytes leftover after parsing attributes in process `syz.7.931'. [ 448.399523][ T9602] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.408600][ T9602] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.416445][ T9602] bridge_slave_0: entered allmulticast mode [ 448.424365][ T9602] bridge_slave_0: entered promiscuous mode [ 448.477811][ T9602] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.485023][ T9602] bridge0: port 2(bridge_slave_1) entered disabled state [ 448.493052][ T9602] bridge_slave_1: entered allmulticast mode [ 448.504077][ T9602] bridge_slave_1: entered promiscuous mode [ 448.683875][ T9602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 448.706327][ T9608] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.713633][ T9608] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.722144][ T9608] bridge_slave_0: entered allmulticast mode [ 448.729304][ T9608] bridge_slave_0: entered promiscuous mode [ 448.744743][ T9602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 448.756326][ T9608] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.767947][ T9608] bridge0: port 2(bridge_slave_1) entered disabled state [ 448.775709][ T9608] bridge_slave_1: entered allmulticast mode [ 448.783295][ T9608] bridge_slave_1: entered promiscuous mode [ 448.797713][ T5125] Bluetooth: hci3: command tx timeout [ 448.845602][ T9525] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 448.854482][ T9525] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 448.878711][ T9608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 448.905185][ T9525] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 448.919740][ T9602] team0: Port device team_slave_0 added [ 448.929131][ T9608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 448.973375][ T9525] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 448.983442][ T9602] team0: Port device team_slave_1 added [ 449.006765][ T9608] team0: Port device team_slave_0 added [ 449.033629][ T69] hsr_slave_0: left promiscuous mode [ 449.041188][ T69] hsr_slave_1: left promiscuous mode [ 449.046949][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 449.054407][ T69] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 449.062594][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 449.070149][ T69] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 449.082089][ T69] hsr_slave_0: left promiscuous mode [ 449.087909][ T69] hsr_slave_1: left promiscuous mode [ 449.093534][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 449.100999][ T69] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 449.110061][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 449.117972][ T69] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 449.139480][ T69] veth1_macvtap: left promiscuous mode [ 449.144999][ T69] veth0_macvtap: left promiscuous mode [ 449.150632][ T69] veth1_vlan: left promiscuous mode [ 449.155914][ T69] veth0_vlan: left promiscuous mode [ 449.162268][ T69] veth1_macvtap: left promiscuous mode [ 449.167837][ T69] veth0_macvtap: left promiscuous mode [ 449.173396][ T69] veth1_vlan: left promiscuous mode [ 449.179014][ T69] veth0_vlan: left promiscuous mode [ 449.861150][ T5125] Bluetooth: hci1: command tx timeout [ 450.023644][ T69] team0 (unregistering): Port device team_slave_1 removed [ 450.054283][ T69] team0 (unregistering): Port device team_slave_0 removed [ 450.611879][ T69] team0 (unregistering): Port device team_slave_1 removed [ 450.641504][ T69] team0 (unregistering): Port device team_slave_0 removed [ 450.879967][ T5125] Bluetooth: hci3: command tx timeout [ 450.908411][ T9608] team0: Port device team_slave_1 added [ 450.976353][ T9602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 450.988462][ T9602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 451.014964][ T9602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 451.027964][ T9602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 451.034949][ T9602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 451.062561][ T9602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 451.076327][ T9608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 451.083975][ T9608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 451.110133][ T9608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 451.154451][ T9608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 451.161934][ T9608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 451.189287][ T9608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 451.230594][ T9602] hsr_slave_0: entered promiscuous mode [ 451.238381][ T9602] hsr_slave_1: entered promiscuous mode [ 451.244410][ T9602] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 451.256173][ T9602] Cannot create hsr debugfs directory [ 451.391632][ T9608] hsr_slave_0: entered promiscuous mode [ 451.411209][ T9608] hsr_slave_1: entered promiscuous mode [ 451.431641][ T9608] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 451.443566][ T9608] Cannot create hsr debugfs directory [ 451.663874][ T5821] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 451.673811][ T5821] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 451.681892][ T5821] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 451.691824][ T5821] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 451.699412][ T5821] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 451.728242][ T9525] 8021q: adding VLAN 0 to HW filter on device bond0 [ 451.748527][ T9494] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 451.761685][ T9494] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 451.784066][ T9494] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 451.808762][ T9494] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 451.908613][ T9525] 8021q: adding VLAN 0 to HW filter on device team0 [ 451.916848][ T5821] Bluetooth: hci1: command tx timeout [ 451.933095][ T3550] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.940212][ T3550] bridge0: port 1(bridge_slave_0) entered forwarding state [ 451.997325][ T5957] bridge0: port 2(bridge_slave_1) entered blocking state [ 452.004413][ T5957] bridge0: port 2(bridge_slave_1) entered forwarding state [ 452.044741][ T9494] 8021q: adding VLAN 0 to HW filter on device bond0 [ 452.082592][ T9494] 8021q: adding VLAN 0 to HW filter on device team0 [ 452.098268][ T3550] bridge0: port 1(bridge_slave_0) entered blocking state [ 452.105369][ T3550] bridge0: port 1(bridge_slave_0) entered forwarding state [ 452.137583][ T69] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.155833][ T3550] bridge0: port 2(bridge_slave_1) entered blocking state [ 452.162953][ T3550] bridge0: port 2(bridge_slave_1) entered forwarding state [ 452.213533][ T69] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.302704][ T69] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.350396][ T9643] chnl_net:caif_netlink_parms(): no params data found [ 452.410889][ T69] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.492300][ T9602] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 452.524414][ T9602] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 452.556086][ T9602] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 452.575558][ T9602] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 452.642007][ T9643] bridge0: port 1(bridge_slave_0) entered blocking state [ 452.655361][ T9643] bridge0: port 1(bridge_slave_0) entered disabled state [ 452.662936][ T9643] bridge_slave_0: entered allmulticast mode [ 452.670156][ T9643] bridge_slave_0: entered promiscuous mode [ 452.681193][ T9525] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 452.705336][ T9643] bridge0: port 2(bridge_slave_1) entered blocking state [ 452.713477][ T9643] bridge0: port 2(bridge_slave_1) entered disabled state [ 452.721524][ T9643] bridge_slave_1: entered allmulticast mode [ 452.732187][ T9643] bridge_slave_1: entered promiscuous mode [ 452.774350][ T9643] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 452.809513][ T9643] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 452.843950][ T9494] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 452.886594][ T9525] veth0_vlan: entered promiscuous mode [ 452.915715][ T9643] team0: Port device team_slave_0 added [ 452.934478][ T9525] veth1_vlan: entered promiscuous mode [ 452.950395][ T9643] team0: Port device team_slave_1 added [ 452.957281][ T5821] Bluetooth: hci3: command tx timeout [ 452.994946][ T69] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.068973][ T69] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.086536][ T9643] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 453.096213][ T9643] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 453.125850][ T9643] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 453.138282][ T9643] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 453.145242][ T9643] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 453.171730][ T9643] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 453.199991][ T9608] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 453.222182][ T69] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.251865][ T9525] veth0_macvtap: entered promiscuous mode [ 453.260451][ T9608] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 453.270632][ T9608] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 453.280848][ T9608] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 453.310236][ T69] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.324975][ T9525] veth1_macvtap: entered promiscuous mode [ 453.350424][ T9643] hsr_slave_0: entered promiscuous mode [ 453.356542][ T9643] hsr_slave_1: entered promiscuous mode [ 453.364467][ T9643] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 453.372579][ T9643] Cannot create hsr debugfs directory [ 453.419915][ T9494] veth0_vlan: entered promiscuous mode [ 453.455885][ T9525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 453.466452][ T9525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 453.476598][ T9525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 453.487613][ T9525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 453.497642][ T9525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 453.508214][ T9525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 453.520340][ T9525] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 453.559490][ T9525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 453.570236][ T9525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 453.580124][ T9525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 453.590564][ T9525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 453.600757][ T9525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 453.611231][ T9525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 453.622771][ T9525] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 453.643029][ T9525] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.653728][ T9525] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.662795][ T9525] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.671583][ T9525] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.692481][ T9494] veth1_vlan: entered promiscuous mode [ 453.743415][ T9602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 453.757321][ T5821] Bluetooth: hci4: command tx timeout [ 453.842960][ T9602] 8021q: adding VLAN 0 to HW filter on device team0 [ 453.873504][ T69] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.890359][ T9494] veth0_macvtap: entered promiscuous mode [ 453.920146][ T9494] veth1_macvtap: entered promiscuous mode [ 453.954607][ T69] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.983927][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 453.991074][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 453.998754][ T5821] Bluetooth: hci1: command tx timeout [ 454.030650][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 454.037763][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 454.059469][ T69] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.091083][ T9608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 454.107010][ T9494] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 454.118021][ T5957] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 454.133240][ T5957] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 454.141389][ T9494] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 454.152240][ T9494] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 454.162859][ T9494] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 454.172742][ T9494] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 454.183319][ T9494] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 454.193152][ T9494] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 454.203697][ T9494] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 454.214538][ T9494] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 454.244122][ T69] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.268193][ T9494] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 454.278929][ T9494] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 454.288890][ T9494] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 454.301126][ T9494] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 454.311194][ T9494] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 454.324017][ T9494] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 454.334916][ T9494] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 454.345665][ T9494] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 454.357972][ T9494] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 454.384458][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 454.395835][ T9602] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 454.408579][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 454.411098][ T9602] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 454.443795][ T9494] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.459866][ T9494] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.471581][ T9494] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.480852][ T9494] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.495052][ T9608] 8021q: adding VLAN 0 to HW filter on device team0 [ 454.590609][ T9595] bridge0: port 1(bridge_slave_0) entered blocking state [ 454.597778][ T9595] bridge0: port 1(bridge_slave_0) entered forwarding state [ 454.648216][ T9595] bridge0: port 2(bridge_slave_1) entered blocking state [ 454.655291][ T9595] bridge0: port 2(bridge_slave_1) entered forwarding state [ 455.036980][ T5821] Bluetooth: hci3: command tx timeout [ 455.539391][ T9602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 455.550400][ T69] bridge_slave_1: left allmulticast mode [ 455.556066][ T69] bridge_slave_1: left promiscuous mode [ 455.571046][ T69] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.581607][ T69] bridge_slave_0: left allmulticast mode [ 455.591820][ T69] bridge_slave_0: left promiscuous mode [ 455.602291][ T69] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.616425][ T69] bridge_slave_1: left allmulticast mode [ 455.623497][ T69] bridge_slave_1: left promiscuous mode [ 455.632991][ T69] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.643418][ T69] bridge_slave_0: left allmulticast mode [ 455.650669][ T69] bridge_slave_0: left promiscuous mode [ 455.656371][ T69] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.666938][ T69] bridge_slave_1: left allmulticast mode [ 455.672582][ T69] bridge_slave_1: left promiscuous mode [ 455.678965][ T69] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.689573][ T69] bridge_slave_0: left allmulticast mode [ 455.695196][ T69] bridge_slave_0: left promiscuous mode [ 455.701597][ T69] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.768594][ T9669] Invalid source name [ 455.772611][ T9669] UBIFS error (pid: 9669): cannot open "./file0", error -22 [ 455.837021][ T5821] Bluetooth: hci4: command tx timeout [ 456.663014][ T69] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 456.713551][ T69] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 456.734562][ T69] bond0 (unregistering): Released all slaves [ 457.141360][ T69] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 457.194639][ T69] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 457.230135][ T69] bond0 (unregistering): Released all slaves [ 457.325965][ T69] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 457.335772][ T69] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 457.345931][ T69] bond0 (unregistering): Released all slaves [ 457.362879][ T9608] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 457.373555][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 457.381556][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 457.386846][ T9608] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 457.448652][ T9643] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 457.473919][ T9643] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 457.506068][ T9643] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 457.604948][ T9602] veth0_vlan: entered promiscuous mode [ 457.618836][ T9602] veth1_vlan: entered promiscuous mode [ 457.642136][ T9602] veth0_macvtap: entered promiscuous mode [ 457.651206][ T9602] veth1_macvtap: entered promiscuous mode [ 457.689848][ T9643] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 457.916706][ T5821] Bluetooth: hci4: command tx timeout [ 458.026522][ T6093] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 458.130551][ T6093] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 458.150467][ T9602] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 458.162962][ T9602] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.173876][ T9602] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 458.184454][ T9602] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.194411][ T9602] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 458.206680][ T9602] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.216515][ T9602] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 458.228044][ T9602] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.240257][ T9602] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 458.250738][ T9602] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.262451][ T9602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 458.289022][ T9602] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 458.303606][ T9602] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.314006][ T9602] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 458.331522][ T9602] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.341615][ T9602] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 458.352337][ T9602] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.367142][ T9602] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 458.385642][ T9602] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.396196][ T9602] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 458.413822][ T9602] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.425199][ T9602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 459.100835][ T9602] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.111719][ T9602] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.126293][ T9602] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.139484][ T9602] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.280151][ T9692] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 459.403436][ T9608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 459.822162][ T3550] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 459.835186][ T3550] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 459.883940][ T9608] veth0_vlan: entered promiscuous mode [ 459.924955][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 459.927621][ T9608] veth1_vlan: entered promiscuous mode [ 459.933844][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 459.996866][ T5821] Bluetooth: hci4: command tx timeout [ 460.004828][ T9643] 8021q: adding VLAN 0 to HW filter on device bond0 [ 460.072685][ T9608] veth0_macvtap: entered promiscuous mode [ 460.111425][ T9608] veth1_macvtap: entered promiscuous mode [ 460.142648][ T9695] FAULT_INJECTION: forcing a failure. [ 460.142648][ T9695] name failslab, interval 1, probability 0, space 0, times 0 [ 460.155813][ T9695] CPU: 1 UID: 0 PID: 9695 Comm: syz.0.924 Not tainted 6.15.0-rc4-syzkaller-00052-g4f79eaa2ceac #0 PREEMPT(full) [ 460.155836][ T9695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 460.155846][ T9695] Call Trace: [ 460.155851][ T9695] [ 460.155857][ T9695] dump_stack_lvl+0x16c/0x1f0 [ 460.155883][ T9695] should_fail_ex+0x512/0x640 [ 460.155903][ T9695] ? fs_reclaim_acquire+0xae/0x150 [ 460.155927][ T9695] ? tomoyo_encode2+0x100/0x3e0 [ 460.155948][ T9695] should_failslab+0xc2/0x120 [ 460.155965][ T9695] __kmalloc_noprof+0xd2/0x510 [ 460.155989][ T9695] ? d_absolute_path+0x136/0x1a0 [ 460.156012][ T9695] tomoyo_encode2+0x100/0x3e0 [ 460.156038][ T9695] tomoyo_encode+0x29/0x50 [ 460.156058][ T9695] tomoyo_realpath_from_path+0x18f/0x6e0 [ 460.156086][ T9695] tomoyo_path_number_perm+0x245/0x580 [ 460.156105][ T9695] ? tomoyo_path_number_perm+0x237/0x580 [ 460.156127][ T9695] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 460.156148][ T9695] ? find_held_lock+0x2b/0x80 [ 460.156188][ T9695] ? find_held_lock+0x2b/0x80 [ 460.156206][ T9695] ? hook_file_ioctl_common+0x145/0x410 [ 460.156227][ T9695] ? __fget_files+0x20e/0x3c0 [ 460.156255][ T9695] security_file_ioctl+0x9b/0x240 [ 460.156280][ T9695] __x64_sys_ioctl+0xb7/0x200 [ 460.156302][ T9695] do_syscall_64+0xcd/0x260 [ 460.156325][ T9695] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.156341][ T9695] RIP: 0033:0x7f8171b8e969 [ 460.156355][ T9695] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 460.156371][ T9695] RSP: 002b:00007f8172982038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 460.156390][ T9695] RAX: ffffffffffffffda RBX: 00007f8171db5fa0 RCX: 00007f8171b8e969 [ 460.156401][ T9695] RDX: 00002000000005c0 RSI: 0000000080685600 RDI: 0000000000000003 [ 460.156410][ T9695] RBP: 00007f8172982090 R08: 0000000000000000 R09: 0000000000000000 [ 460.156420][ T9695] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 460.156428][ T9695] R13: 0000000000000000 R14: 00007f8171db5fa0 R15: 00007ffca3112158 [ 460.156451][ T9695] [ 460.156509][ T9695] ERROR: Out of memory at tomoyo_realpath_from_path. [ 460.379890][ T5125] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 460.389896][ T5125] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 460.399011][ T5125] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 460.407673][ T5125] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 460.415217][ T5125] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 460.433035][ T69] hsr_slave_0: left promiscuous mode [ 460.442833][ T69] hsr_slave_1: left promiscuous mode [ 460.450405][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 460.458467][ T69] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 460.466045][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 460.474729][ T69] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 460.485854][ T69] hsr_slave_0: left promiscuous mode [ 460.492379][ T69] hsr_slave_1: left promiscuous mode [ 460.498176][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 460.506188][ T69] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 460.529530][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 460.541935][ T69] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 460.597032][ T69] hsr_slave_0: left promiscuous mode [ 460.631456][ T69] hsr_slave_1: left promiscuous mode [ 460.647549][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 460.658991][ T69] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 460.677407][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 460.690461][ T69] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 461.080035][ T69] veth1_macvtap: left promiscuous mode [ 461.197724][ T69] veth0_macvtap: left promiscuous mode [ 461.230477][ T69] veth1_vlan: left promiscuous mode [ 461.257762][ T69] veth0_vlan: left promiscuous mode [ 461.280664][ T69] veth1_macvtap: left promiscuous mode [ 461.286312][ T69] veth0_macvtap: left promiscuous mode [ 461.294844][ T69] veth1_vlan: left promiscuous mode [ 461.301865][ T69] veth0_vlan: left promiscuous mode [ 461.309251][ T69] veth1_macvtap: left promiscuous mode [ 461.314736][ T69] veth0_macvtap: left promiscuous mode [ 461.321688][ T69] veth1_vlan: left promiscuous mode [ 461.327110][ T69] veth0_vlan: left promiscuous mode [ 461.720482][ T69] team0 (unregistering): Port device team_slave_1 removed [ 461.752807][ T69] team0 (unregistering): Port device team_slave_0 removed [ 462.487547][ T5125] Bluetooth: hci0: command tx timeout [ 462.804813][ T69] team0 (unregistering): Port device team_slave_1 removed [ 462.837744][ T69] team0 (unregistering): Port device team_slave_0 removed [ 463.860706][ T69] team0 (unregistering): Port device team_slave_1 removed [ 463.894223][ T69] team0 (unregistering): Port device team_slave_0 removed [ 464.296598][ T9714] block device autoloading is deprecated and will be removed. [ 464.569676][ T5125] Bluetooth: hci0: command tx timeout [ 464.732729][ T9643] 8021q: adding VLAN 0 to HW filter on device team0 [ 464.921346][ T9608] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 464.932778][ T9608] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 464.946865][ T9608] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 464.961234][ T9608] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 464.972074][ T9608] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 464.986078][ T9608] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 465.177674][ T9608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 465.945089][ T9595] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.952252][ T9595] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.964913][ T9595] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.972045][ T9595] bridge0: port 2(bridge_slave_1) entered forwarding state [ 466.304259][ T9608] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 466.321305][ T9608] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 466.333887][ T9608] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 466.344882][ T9608] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 466.359344][ T9608] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 466.370450][ T9608] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 466.393907][ T9608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 466.569138][ T9608] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.577955][ T9608] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.588368][ T9608] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.597259][ T9608] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.637050][ T5125] Bluetooth: hci0: command tx timeout [ 466.641899][ T9643] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 466.656430][ T9643] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 466.900620][ T9595] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.923569][ T9696] chnl_net:caif_netlink_parms(): no params data found [ 466.965018][ T9595] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.112249][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.130021][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.141665][ T9643] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 467.441874][ T9696] bridge0: port 1(bridge_slave_0) entered blocking state [ 467.472010][ T9696] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.502721][ T9696] bridge_slave_0: entered allmulticast mode [ 467.521195][ T9696] bridge_slave_0: entered promiscuous mode [ 467.594827][ T9696] bridge0: port 2(bridge_slave_1) entered blocking state [ 467.603560][ T9696] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.626861][ T9696] bridge_slave_1: entered allmulticast mode [ 467.634343][ T9696] bridge_slave_1: entered promiscuous mode [ 467.650455][ T30] audit: type=1326 audit(1746124867.679:820): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9745 comm="syz.2.957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac8b8e969 code=0x7ffc0000 [ 467.693358][ T30] audit: type=1326 audit(1746124867.679:821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9745 comm="syz.2.957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f9ac8b8e969 code=0x7ffc0000 [ 467.694349][ T5821] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 467.720966][ T30] audit: type=1326 audit(1746124867.689:822): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9745 comm="syz.2.957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac8b8e969 code=0x7ffc0000 [ 467.737752][ T5821] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 467.754399][ T5822] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 467.756319][ T5821] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 467.773793][ T5822] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 467.777623][ T5821] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 467.782827][ T5822] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 467.788863][ T5821] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 467.797467][ T5822] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 467.814396][ T30] audit: type=1326 audit(1746124867.689:823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9745 comm="syz.2.957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=111 compat=0 ip=0x7f9ac8b8e969 code=0x7ffc0000 [ 467.815187][ T5822] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 467.879211][ T9752] binder: BINDER_SET_CONTEXT_MGR already set [ 467.889915][ T9752] binder: 9751:9752 ioctl 4018620d 2000000000c0 returned -16 [ 467.892865][ T30] audit: type=1326 audit(1746124867.689:824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9745 comm="syz.2.957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac8b8e969 code=0x7ffc0000 [ 467.925170][ T9696] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 467.943408][ T30] audit: type=1326 audit(1746124867.689:825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9745 comm="syz.2.957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=434 compat=0 ip=0x7f9ac8b8e969 code=0x7ffc0000 [ 467.996427][ T9696] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 468.019684][ T30] audit: type=1326 audit(1746124867.689:826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9745 comm="syz.2.957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac8b8e969 code=0x7ffc0000 [ 468.050873][ T9643] veth0_vlan: entered promiscuous mode [ 468.059498][ T30] audit: type=1326 audit(1746124867.689:827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9745 comm="syz.2.957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=438 compat=0 ip=0x7f9ac8b8e969 code=0x7ffc0000 [ 468.093645][ T30] audit: type=1326 audit(1746124867.689:828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9745 comm="syz.2.957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac8b8e969 code=0x7ffc0000 [ 468.127263][ T30] audit: type=1326 audit(1746124867.689:829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9745 comm="syz.2.957" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f9ac8b8e969 code=0x7ffc0000 [ 468.166011][ T9696] team0: Port device team_slave_0 added [ 468.173361][ T9757] IPVS: set_ctl: invalid protocol: 12 100.1.1.1:2 [ 468.180881][ T9643] veth1_vlan: entered promiscuous mode [ 468.196433][ T9696] team0: Port device team_slave_1 added [ 468.468676][ T9759] netlink: 20 bytes leftover after parsing attributes in process `syz.2.960'. [ 468.541165][ T9696] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 468.549062][ T9696] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 468.584264][ T5901] IPVS: starting estimator thread 0... [ 468.598653][ T9696] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 468.611351][ T9696] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 468.621381][ T9696] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 468.647733][ T9696] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 468.716864][ T9760] IPVS: using max 78 ests per chain, 187200 per kthread [ 468.718394][ T5821] Bluetooth: hci0: command tx timeout [ 468.786425][ T9696] hsr_slave_0: entered promiscuous mode [ 468.797705][ T9696] hsr_slave_1: entered promiscuous mode [ 468.828956][ T69] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.856542][ T9643] veth0_macvtap: entered promiscuous mode [ 468.873485][ T5901] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 468.885383][ T5913] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 468.928095][ T9643] veth1_macvtap: entered promiscuous mode [ 468.953579][ T69] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 469.019862][ T9643] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 469.030888][ T9643] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 469.042213][ T9643] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 469.052779][ T9643] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 469.063196][ T9643] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 469.073979][ T9643] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 469.085169][ T9643] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 469.095662][ T9643] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 469.113456][ T9643] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 469.169207][ T69] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 469.235539][ T9643] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 469.246200][ T9643] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 469.257034][ T9643] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 469.267866][ T9643] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 469.278843][ T9643] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 469.291481][ T9643] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 469.302528][ T9643] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 469.313481][ T9643] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 469.330806][ T9643] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 469.381859][ T69] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 469.444932][ T9643] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 469.454860][ T9643] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 469.465732][ T9643] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 469.475831][ T9643] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 469.540250][ T9747] chnl_net:caif_netlink_parms(): no params data found [ 469.923819][ T5821] Bluetooth: hci1: command tx timeout [ 469.929546][ T5822] Bluetooth: hci2: command tx timeout [ 469.954364][ T9749] chnl_net:caif_netlink_parms(): no params data found [ 470.167708][ T9747] bridge0: port 1(bridge_slave_0) entered blocking state [ 470.174808][ T9747] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.184797][ T9747] bridge_slave_0: entered allmulticast mode [ 470.192433][ T9747] bridge_slave_0: entered promiscuous mode [ 470.219560][ T6093] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 470.232582][ T6093] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 470.267228][ T9747] bridge0: port 2(bridge_slave_1) entered blocking state [ 470.275283][ T9747] bridge0: port 2(bridge_slave_1) entered disabled state [ 470.282500][ T9747] bridge_slave_1: entered allmulticast mode [ 470.290149][ T9747] bridge_slave_1: entered promiscuous mode [ 470.327091][ T5866] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 470.327240][ T9749] bridge0: port 1(bridge_slave_0) entered blocking state [ 470.342926][ T9749] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.350432][ T9749] bridge_slave_0: entered allmulticast mode [ 470.358904][ T9749] bridge_slave_0: entered promiscuous mode [ 470.381373][ T69] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.415106][ T9747] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 470.431497][ T9747] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 470.441195][ T9749] bridge0: port 2(bridge_slave_1) entered blocking state [ 470.449108][ T9749] bridge0: port 2(bridge_slave_1) entered disabled state [ 470.456246][ T9749] bridge_slave_1: entered allmulticast mode [ 470.463097][ T9749] bridge_slave_1: entered promiscuous mode [ 470.473174][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 470.494494][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 470.504389][ T69] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.517383][ T5866] usb 3-1: Using ep0 maxpacket: 16 [ 470.538800][ T5866] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 470.548001][ T5866] usb 3-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 470.564965][ T5866] usb 3-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 470.575000][ T5866] usb 3-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 470.585273][ T5866] usb 3-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 470.599706][ T5866] usb 3-1: config 1 interface 0 has no altsetting 0 [ 470.606335][ T5866] usb 3-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 470.624950][ T5866] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 470.637893][ T9747] team0: Port device team_slave_0 added [ 470.642426][ T5866] ums-sddr09 3-1:1.0: USB Mass Storage device detected [ 470.663570][ T69] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.681484][ T9749] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 470.693710][ T9749] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 470.738350][ T69] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.755393][ T9747] team0: Port device team_slave_1 added [ 470.859943][ T5866] scsi host1: usb-storage 3-1:1.0 [ 470.881117][ T9747] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 470.890316][ T9747] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 470.932635][ T9747] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 470.952711][ T9749] team0: Port device team_slave_0 added [ 470.972537][ T9747] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 470.979741][ T9747] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 471.008316][ T9747] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 471.022963][ T9749] team0: Port device team_slave_1 added [ 471.104035][ T5911] usb 3-1: USB disconnect, device number 18 [ 471.185078][ T9749] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 471.192621][ T9749] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 471.222910][ T9749] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 471.234875][ T9696] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 471.278657][ T9749] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 471.288751][ T9749] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 471.315274][ T9749] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 471.326602][ T9696] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 471.353628][ T9747] hsr_slave_0: entered promiscuous mode [ 471.361218][ T9747] hsr_slave_1: entered promiscuous mode [ 471.367598][ T9747] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 471.376148][ T9747] Cannot create hsr debugfs directory [ 471.386106][ T9696] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 471.424679][ T9696] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 471.495721][ T69] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.546192][ T9749] hsr_slave_0: entered promiscuous mode [ 471.553523][ T9749] hsr_slave_1: entered promiscuous mode [ 471.561074][ T9749] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 471.569394][ T9749] Cannot create hsr debugfs directory [ 471.600242][ T69] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.755360][ T69] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.586337][ T5821] Bluetooth: hci1: command tx timeout [ 472.592169][ T5821] Bluetooth: hci2: command tx timeout [ 472.637951][ T10] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 472.701576][ T69] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.798869][ T5866] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 472.838535][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 472.838549][ T30] audit: type=1400 audit(1746124872.859:838): avc: denied { map } for pid=9799 comm="syz.2.968" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 472.876076][ T30] audit: type=1400 audit(1746124872.859:839): avc: denied { execute } for pid=9799 comm="syz.2.968" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 473.139404][ T9794] Process accounting resumed [ 473.685404][ T69] bridge_slave_1: left allmulticast mode [ 473.692042][ T69] bridge_slave_1: left promiscuous mode [ 473.699027][ T69] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.806165][ T69] bridge_slave_0: left allmulticast mode [ 473.813053][ T69] bridge_slave_0: left promiscuous mode [ 473.818892][ T69] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.838682][ T69] bridge_slave_1: left allmulticast mode [ 473.844345][ T69] bridge_slave_1: left promiscuous mode [ 473.851669][ T69] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.179595][ T69] bridge_slave_0: left allmulticast mode [ 474.218447][ T69] bridge_slave_0: left promiscuous mode [ 474.276565][ T69] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.337079][ T69] bridge_slave_1: left allmulticast mode [ 474.348145][ T69] bridge_slave_1: left promiscuous mode [ 474.354343][ T69] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.364532][ T69] bridge_slave_0: left allmulticast mode [ 474.370668][ T69] bridge_slave_0: left promiscuous mode [ 474.383716][ T69] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.857720][ T5822] Bluetooth: hci1: command tx timeout [ 474.865139][ T5821] Bluetooth: hci2: command tx timeout [ 476.370319][ T69] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 476.381050][ T69] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 476.391162][ T69] bond0 (unregistering): Released all slaves [ 476.469341][ T69] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 476.479602][ T69] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 476.490305][ T69] bond0 (unregistering): Released all slaves [ 476.565437][ T69] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 476.575357][ T69] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 476.584995][ T69] bond0 (unregistering): Released all slaves [ 476.733867][ T9696] 8021q: adding VLAN 0 to HW filter on device bond0 [ 476.823079][ T9696] 8021q: adding VLAN 0 to HW filter on device team0 [ 476.840861][ T3550] bridge0: port 1(bridge_slave_0) entered blocking state [ 476.848026][ T3550] bridge0: port 1(bridge_slave_0) entered forwarding state [ 476.876409][ T6093] bridge0: port 2(bridge_slave_1) entered blocking state [ 476.883603][ T6093] bridge0: port 2(bridge_slave_1) entered forwarding state [ 476.893060][ T5821] Bluetooth: hci2: command tx timeout [ 476.896818][ T5822] Bluetooth: hci1: command tx timeout [ 476.904846][ T9747] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 476.915720][ T9747] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 476.926029][ T9747] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 476.958428][ T5860] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 476.971347][ T9747] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 477.148894][ T5860] usb 3-1: Using ep0 maxpacket: 8 [ 477.191663][ T5860] usb 3-1: config 3 has an invalid interface number: 159 but max is 0 [ 477.209582][ T5860] usb 3-1: config 3 has no interface number 0 [ 477.224306][ T5860] usb 3-1: config 3 interface 159 altsetting 1 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 477.247761][ T5860] usb 3-1: config 3 interface 159 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 477.281972][ T5860] usb 3-1: config 3 interface 159 altsetting 1 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 477.307363][ T5860] usb 3-1: config 3 interface 159 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 477.325282][ T5860] usb 3-1: config 3 interface 159 has no altsetting 0 [ 477.344769][ T5860] usb 3-1: New USB device found, idVendor=083a, idProduct=4507, bcdDevice=29.90 [ 477.383626][ T9747] 8021q: adding VLAN 0 to HW filter on device bond0 [ 477.390462][ T5860] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.414845][ T5860] usb 3-1: Product: syz [ 477.442081][ T5860] usb 3-1: Manufacturer: 빫볶﬿№䠓赼ⵁᜢ狆ꒊ敎飄芺퐋㊣媯평ᑇᄕᩬ䳐䎲궋샯ﺁ᥁䉪ﭢꎧ綪ꍳ甛失痊聪尵쨟喁ﶞꥊ멛ፑ⋧馜剣䖓䘓ᣮ䜄脮줿䷩㡥쌖鈥ጏ妺鼐‚褠缪箲⛟욬뵞퐳濢汾껗㘳줸짮홿т憎퓨納倌긩Ϙ謑夘揟묏ﶃ䬫绫ᚷⳟ [ 477.488035][ T9747] 8021q: adding VLAN 0 to HW filter on device team0 [ 477.499447][ T5860] usb 3-1: SerialNumber: syz [ 477.539371][ T6093] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.546503][ T6093] bridge0: port 1(bridge_slave_0) entered forwarding state [ 477.588193][ T1315] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.595298][ T1315] bridge0: port 2(bridge_slave_1) entered forwarding state [ 477.670132][ T69] hsr_slave_0: left promiscuous mode [ 477.676425][ T5821] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 477.688193][ T5821] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 477.697583][ T69] hsr_slave_1: left promiscuous mode [ 477.703735][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 477.712714][ T5821] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 477.712724][ T69] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 477.729696][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 477.741279][ T5821] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 477.742094][ T69] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 477.756217][ T5821] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 477.756960][ T5860] usb 3-1: Could not find all expected endpoints [ 477.784512][ T69] hsr_slave_0: left promiscuous mode [ 477.790736][ T69] hsr_slave_1: left promiscuous mode [ 477.796368][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 477.806111][ T5860] usb 3-1: USB disconnect, device number 19 [ 477.814372][ T69] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 477.831116][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 477.839461][ T69] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 477.854689][ T69] hsr_slave_0: left promiscuous mode [ 477.861084][ T69] hsr_slave_1: left promiscuous mode [ 477.866742][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 477.874148][ T69] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 477.882126][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 477.890206][ T69] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 477.917037][ T69] veth1_macvtap: left promiscuous mode [ 477.922562][ T69] veth0_macvtap: left promiscuous mode [ 477.930444][ T69] veth1_vlan: left promiscuous mode [ 477.935777][ T69] veth0_vlan: left promiscuous mode [ 477.942499][ T69] veth1_macvtap: left promiscuous mode [ 477.948466][ T69] veth0_macvtap: left promiscuous mode [ 477.953974][ T69] veth1_vlan: left promiscuous mode [ 477.960364][ T69] veth0_vlan: left promiscuous mode [ 477.966404][ T69] veth1_macvtap: left promiscuous mode [ 477.972915][ T69] veth0_macvtap: left promiscuous mode [ 477.978603][ T69] veth1_vlan: left promiscuous mode [ 477.983833][ T69] veth0_vlan: left promiscuous mode [ 478.334143][ T30] audit: type=1400 audit(1746124878.369:840): avc: denied { name_bind } for pid=9834 comm="syz.2.979" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 478.893126][ T69] team0 (unregistering): Port device team_slave_1 removed [ 478.925295][ T69] team0 (unregistering): Port device team_slave_0 removed [ 479.228529][ T9839] Bluetooth: MGMT ver 1.23 [ 479.300398][ T9840] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 479.366332][ T9840] loop6: detected capacity change from 0 to 524287999 [ 479.568575][ T69] team0 (unregistering): Port device team_slave_1 removed [ 479.600262][ T69] team0 (unregistering): Port device team_slave_0 removed [ 479.838097][ T5822] Bluetooth: hci4: command tx timeout [ 480.245971][ T69] team0 (unregistering): Port device team_slave_1 removed [ 480.281559][ T69] team0 (unregistering): Port device team_slave_0 removed [ 480.558102][ T5913] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 480.628813][ T9696] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 480.660760][ T9749] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 480.688823][ T9749] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 480.724011][ T9749] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 480.762399][ T9749] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 480.788165][ T9747] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 481.207828][ T5866] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 481.233764][ T9747] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 481.281995][ T9749] 8021q: adding VLAN 0 to HW filter on device bond0 [ 481.348724][ T9749] 8021q: adding VLAN 0 to HW filter on device team0 [ 481.381277][ T9696] veth0_vlan: entered promiscuous mode [ 481.842767][ T9832] chnl_net:caif_netlink_parms(): no params data found [ 481.862568][ T9524] bridge0: port 1(bridge_slave_0) entered blocking state [ 481.869702][ T9524] bridge0: port 1(bridge_slave_0) entered forwarding state [ 481.905269][ T9524] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.912467][ T9524] bridge0: port 2(bridge_slave_1) entered forwarding state [ 481.920478][ T5822] Bluetooth: hci4: command tx timeout [ 481.988946][ T9696] veth1_vlan: entered promiscuous mode [ 482.059594][ T9749] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 482.201246][ T9696] veth0_macvtap: entered promiscuous mode [ 482.248565][ T9832] bridge0: port 1(bridge_slave_0) entered blocking state [ 482.255667][ T9832] bridge0: port 1(bridge_slave_0) entered disabled state [ 482.267656][ T9832] bridge_slave_0: entered allmulticast mode [ 482.274906][ T9832] bridge_slave_0: entered promiscuous mode [ 482.284418][ T9832] bridge0: port 2(bridge_slave_1) entered blocking state [ 482.291722][ T9832] bridge0: port 2(bridge_slave_1) entered disabled state [ 482.300379][ T9832] bridge_slave_1: entered allmulticast mode [ 482.307590][ T9832] bridge_slave_1: entered promiscuous mode [ 482.352020][ T9696] veth1_macvtap: entered promiscuous mode [ 482.363208][ T9832] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 482.375014][ T9832] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 482.398154][ T9747] veth0_vlan: entered promiscuous mode [ 482.440261][ T9749] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 482.488803][ T9832] team0: Port device team_slave_0 added [ 482.507548][ T9832] team0: Port device team_slave_1 added [ 482.535928][ T9747] veth1_vlan: entered promiscuous mode [ 482.579734][ T9696] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 482.608314][ T9696] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 482.630304][ T9696] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 482.641067][ T9696] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 482.656301][ T9696] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 482.668431][ T9832] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 482.675367][ T9832] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 482.708111][ T9832] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 482.720712][ T9832] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 482.727909][ T9832] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 482.754127][ T9832] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 482.787374][ T9696] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 482.798193][ T9696] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 482.816677][ T9696] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 482.836078][ T9696] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 482.857674][ T9696] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 482.910360][ T69] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.924517][ T5821] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 482.932952][ T5821] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 482.942236][ T5821] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 482.948938][ T9696] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.959838][ T9696] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.969011][ T9696] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.969467][ T5821] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 482.981944][ T9696] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.987034][ T5821] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 483.055886][ T9747] veth0_macvtap: entered promiscuous mode [ 483.074046][ T69] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.089822][ T9832] hsr_slave_0: entered promiscuous mode [ 483.095774][ T9832] hsr_slave_1: entered promiscuous mode [ 483.103872][ T9832] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 483.111731][ T9832] Cannot create hsr debugfs directory [ 483.128123][ T9747] veth1_macvtap: entered promiscuous mode [ 483.199988][ T69] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.271001][ T69] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.300733][ T9747] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 483.312122][ T9747] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 483.321976][ T9747] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 483.332524][ T9747] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 483.342368][ T9747] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 483.352805][ T9747] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 483.363416][ T9747] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 483.396306][ T9747] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 483.406683][ T3550] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 483.408413][ T9747] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 483.414523][ T3550] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 483.424342][ T9747] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 483.424355][ T9747] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 483.424393][ T9747] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 483.424405][ T9747] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 483.425393][ T9747] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 483.481187][ T9749] veth0_vlan: entered promiscuous mode [ 483.492560][ T9749] veth1_vlan: entered promiscuous mode [ 483.540101][ T9747] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.550107][ T9747] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.561340][ T9747] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.570964][ T9747] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.625136][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 483.635250][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 483.720402][ T9696] ================================================================== [ 483.728543][ T9696] BUG: KASAN: slab-use-after-free in binder_add_device+0xa4/0xb0 [ 483.736238][ T9696] Write of size 8 at addr ffff88807dc0b808 by task syz-executor/9696 [ 483.744272][ T9696] [ 483.746578][ T9696] CPU: 0 UID: 0 PID: 9696 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00052-g4f79eaa2ceac #0 PREEMPT(full) [ 483.746591][ T9696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 483.746598][ T9696] Call Trace: [ 483.746602][ T9696] [ 483.746607][ T9696] dump_stack_lvl+0x116/0x1f0 [ 483.746628][ T9696] print_report+0xc3/0x670 [ 483.746645][ T9696] ? __virt_addr_valid+0x5e/0x590 [ 483.746660][ T9696] ? __phys_addr+0xc6/0x150 [ 483.746674][ T9696] ? binder_add_device+0xa4/0xb0 [ 483.746686][ T9696] kasan_report+0xe0/0x110 [ 483.746696][ T9696] ? binder_add_device+0xa4/0xb0 [ 483.746709][ T9696] binder_add_device+0xa4/0xb0 [ 483.746722][ T9696] binderfs_binder_device_create.isra.0+0x95f/0xb70 [ 483.746741][ T9696] binderfs_fill_super+0x8d4/0x1360 [ 483.746757][ T9696] ? __pfx_binderfs_fill_super+0x10/0x10 [ 483.746777][ T9696] ? shrinker_register+0x1a8/0x260 [ 483.746788][ T9696] ? sget_fc+0x808/0xc20 [ 483.746803][ T9696] ? __pfx_set_anon_super_fc+0x10/0x10 [ 483.746817][ T9696] ? __pfx_binderfs_fill_super+0x10/0x10 [ 483.746832][ T9696] get_tree_nodev+0xda/0x190 [ 483.746847][ T9696] vfs_get_tree+0x8b/0x340 [ 483.746859][ T9696] path_mount+0x14d4/0x1f20 [ 483.746870][ T9696] ? kmem_cache_free+0x2d4/0x4d0 [ 483.746886][ T9696] ? __pfx_path_mount+0x10/0x10 [ 483.746897][ T9696] ? putname+0x154/0x1a0 [ 483.746908][ T9696] __x64_sys_mount+0x28d/0x310 [ 483.746918][ T9696] ? __pfx___x64_sys_mount+0x10/0x10 [ 483.746928][ T9696] ? rcu_is_watching+0x12/0xc0 [ 483.746942][ T9696] do_syscall_64+0xcd/0x260 [ 483.746956][ T9696] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.746967][ T9696] RIP: 0033:0x7f717739010a [ 483.746976][ T9696] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 483.746986][ T9696] RSP: 002b:00007ffee97a05a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 483.746997][ T9696] RAX: ffffffffffffffda RBX: 00007f7177410e74 RCX: 00007f717739010a [ 483.747003][ T9696] RDX: 00007f71774208cb RSI: 00007f7177410e74 RDI: 00007f71774208cb [ 483.747010][ T9696] RBP: 00007f71774110bd R08: 0000000000000000 R09: 00007f71775b6738 [ 483.747016][ T9696] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f71773ec1a8 [ 483.747022][ T9696] R13: 00007f71773ec180 R14: 0000000000000009 R15: 0000000000000000 [ 483.747032][ T9696] [ 483.747035][ T9696] [ 483.785487][ T9749] veth0_macvtap: entered promiscuous mode [ 483.789348][ T9696] Allocated by task 9608: [ 483.789357][ T9696] kasan_save_stack+0x33/0x60 [ 483.789384][ T9696] kasan_save_track+0x14/0x30 [ 483.999368][ T9696] __kasan_kmalloc+0xaa/0xb0 [ 484.003939][ T9696] binderfs_binder_device_create.isra.0+0x17a/0xb70 [ 484.010503][ T9696] binderfs_fill_super+0x8d4/0x1360 [ 484.015674][ T9696] get_tree_nodev+0xda/0x190 [ 484.020240][ T9696] vfs_get_tree+0x8b/0x340 [ 484.024628][ T9696] path_mount+0x14d4/0x1f20 [ 484.029114][ T9696] __x64_sys_mount+0x28d/0x310 [ 484.033890][ T9696] do_syscall_64+0xcd/0x260 [ 484.038377][ T9696] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.044242][ T9696] [ 484.046534][ T9696] Freed by task 24: [ 484.050315][ T9696] kasan_save_stack+0x33/0x60 [ 484.054974][ T9696] kasan_save_track+0x14/0x30 [ 484.059624][ T9696] kasan_save_free_info+0x3b/0x60 [ 484.064620][ T9696] __kasan_slab_free+0x51/0x70 [ 484.069353][ T9696] kfree+0x2b6/0x4d0 [ 484.073222][ T9696] binder_proc_dec_tmpref+0x4c3/0x590 [ 484.078580][ T9696] binder_deferred_func+0xe87/0x12c0 [ 484.083868][ T9696] process_one_work+0x9cc/0x1b70 [ 484.088782][ T9696] worker_thread+0x6c8/0xf10 [ 484.093349][ T9696] kthread+0x3c2/0x780 [ 484.097392][ T9696] ret_from_fork+0x45/0x80 [ 484.101780][ T9696] ret_from_fork_asm+0x1a/0x30 [ 484.106519][ T9696] [ 484.108818][ T9696] The buggy address belongs to the object at ffff88807dc0b800 [ 484.108818][ T9696] which belongs to the cache kmalloc-512 of size 512 [ 484.122852][ T9696] The buggy address is located 8 bytes inside of [ 484.122852][ T9696] freed 512-byte region [ffff88807dc0b800, ffff88807dc0ba00) [ 484.136457][ T9696] [ 484.138757][ T9696] The buggy address belongs to the physical page: [ 484.145135][ T9696] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7dc08 [ 484.153862][ T9696] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 484.162341][ T9696] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 484.169852][ T9696] page_type: f5(slab) [ 484.173801][ T9696] raw: 00fff00000000040 ffff88801b441c80 dead000000000100 dead000000000122 [ 484.182365][ T9696] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 484.190926][ T9696] head: 00fff00000000040 ffff88801b441c80 dead000000000100 dead000000000122 [ 484.199574][ T9696] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 484.208215][ T9696] head: 00fff00000000002 ffffea0001f70201 00000000ffffffff 00000000ffffffff [ 484.216853][ T9696] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 484.225489][ T9696] page dumped because: kasan: bad access detected [ 484.231886][ T9696] page_owner tracks the page as allocated [ 484.237580][ T9696] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5806, tgid 5806 (syz-executor), ts 60637461120, free_ts 60527820689 [ 484.256820][ T9696] post_alloc_hook+0x181/0x1b0 [ 484.261567][ T9696] get_page_from_freelist+0x135c/0x3920 [ 484.267096][ T9696] __alloc_frozen_pages_noprof+0x263/0x23a0 [ 484.272963][ T9696] alloc_pages_mpol+0x1fb/0x550 [ 484.277790][ T9696] new_slab+0x244/0x340 [ 484.281957][ T9696] ___slab_alloc+0xd9c/0x1940 [ 484.286608][ T9696] __slab_alloc.constprop.0+0x56/0xb0 [ 484.291962][ T9696] __kmalloc_noprof+0x2f2/0x510 [ 484.296798][ T9696] fib6_info_alloc+0x40/0x160 [ 484.301450][ T9696] ip6_route_info_create+0x33f/0x18e0 [ 484.306795][ T9696] addrconf_f6i_alloc+0x391/0x670 [ 484.311789][ T9696] addrconf_notify+0x10a1/0x19e0 [ 484.316698][ T9696] notifier_call_chain+0xb9/0x410 [ 484.321696][ T9696] call_netdevice_notifiers_info+0xbe/0x140 [ 484.327570][ T9696] __dev_notify_flags+0x12c/0x2e0 [ 484.332588][ T9696] netif_change_flags+0x108/0x160 [ 484.337585][ T9696] page last free pid 971 tgid 971 stack trace: [ 484.343703][ T9696] __free_frozen_pages+0x69d/0xff0 [ 484.348788][ T9696] qlist_free_all+0x4e/0x120 [ 484.353358][ T9696] kasan_quarantine_reduce+0x195/0x1e0 [ 484.358794][ T9696] __kasan_slab_alloc+0x69/0x90 [ 484.363611][ T9696] __kmalloc_cache_noprof+0x1f1/0x3e0 [ 484.368955][ T9696] nsim_fib_event_work+0x17f5/0x2e80 [ 484.374212][ T9696] process_one_work+0x9cc/0x1b70 [ 484.379131][ T9696] worker_thread+0x6c8/0xf10 [ 484.383710][ T9696] kthread+0x3c2/0x780 [ 484.387747][ T9696] ret_from_fork+0x45/0x80 [ 484.392134][ T9696] ret_from_fork_asm+0x1a/0x30 [ 484.396872][ T9696] [ 484.399165][ T9696] Memory state around the buggy address: [ 484.404769][ T9696] ffff88807dc0b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 484.412801][ T9696] ffff88807dc0b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 484.420838][ T9696] >ffff88807dc0b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 484.428879][ T9696] ^ [ 484.433199][ T9696] ffff88807dc0b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 484.441240][ T9696] ffff88807dc0b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 484.449281][ T9696] ================================================================== [ 484.467707][ T5821] Bluetooth: hci4: command tx timeout [ 484.473175][ T9696] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 484.480364][ T9696] CPU: 0 UID: 0 PID: 9696 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00052-g4f79eaa2ceac #0 PREEMPT(full) [ 484.492495][ T9696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 484.502528][ T9696] Call Trace: [ 484.505788][ T9696] [ 484.508702][ T9696] dump_stack_lvl+0x3d/0x1f0 [ 484.513280][ T9696] panic+0x71c/0x800 [ 484.517175][ T9696] ? __pfx_panic+0x10/0x10 [ 484.521575][ T9696] ? mark_held_locks+0x49/0x80 [ 484.526325][ T9696] ? preempt_schedule_thunk+0x16/0x30 [ 484.531676][ T9696] ? binder_add_device+0xa4/0xb0 [ 484.536600][ T9696] ? preempt_schedule_common+0x44/0xc0 [ 484.542048][ T9696] ? check_panic_on_warn+0x1f/0xb0 [ 484.547146][ T9696] ? binder_add_device+0xa4/0xb0 [ 484.552067][ T9696] check_panic_on_warn+0xab/0xb0 [ 484.556991][ T9696] end_report+0x107/0x170 [ 484.561298][ T9696] kasan_report+0xee/0x110 [ 484.565692][ T9696] ? binder_add_device+0xa4/0xb0 [ 484.570617][ T9696] binder_add_device+0xa4/0xb0 [ 484.575370][ T9696] binderfs_binder_device_create.isra.0+0x95f/0xb70 [ 484.581950][ T9696] binderfs_fill_super+0x8d4/0x1360 [ 484.587141][ T9696] ? __pfx_binderfs_fill_super+0x10/0x10 [ 484.592766][ T9696] ? shrinker_register+0x1a8/0x260 [ 484.597857][ T9696] ? sget_fc+0x808/0xc20 [ 484.602084][ T9696] ? __pfx_set_anon_super_fc+0x10/0x10 [ 484.607528][ T9696] ? __pfx_binderfs_fill_super+0x10/0x10 [ 484.613145][ T9696] get_tree_nodev+0xda/0x190 [ 484.617719][ T9696] vfs_get_tree+0x8b/0x340 [ 484.622116][ T9696] path_mount+0x14d4/0x1f20 [ 484.626600][ T9696] ? kmem_cache_free+0x2d4/0x4d0 [ 484.631528][ T9696] ? __pfx_path_mount+0x10/0x10 [ 484.636358][ T9696] ? putname+0x154/0x1a0 [ 484.640592][ T9696] __x64_sys_mount+0x28d/0x310 [ 484.645343][ T9696] ? __pfx___x64_sys_mount+0x10/0x10 [ 484.650607][ T9696] ? rcu_is_watching+0x12/0xc0 [ 484.655353][ T9696] do_syscall_64+0xcd/0x260 [ 484.659842][ T9696] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.665715][ T9696] RIP: 0033:0x7f717739010a [ 484.670112][ T9696] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 484.689701][ T9696] RSP: 002b:00007ffee97a05a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 484.698101][ T9696] RAX: ffffffffffffffda RBX: 00007f7177410e74 RCX: 00007f717739010a [ 484.706053][ T9696] RDX: 00007f71774208cb RSI: 00007f7177410e74 RDI: 00007f71774208cb [ 484.714002][ T9696] RBP: 00007f71774110bd R08: 0000000000000000 R09: 00007f71775b6738 [ 484.721951][ T9696] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f71773ec1a8 [ 484.729899][ T9696] R13: 00007f71773ec180 R14: 0000000000000009 R15: 0000000000000000 [ 484.737854][ T9696] [ 484.741079][ T9696] Kernel Offset: disabled [ 484.745376][ T9696] Rebooting in 86400 seconds..