last executing test programs: 2m13.455130105s ago: executing program 3 (id=1298): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x800, 0x0, 0x103, 0x1}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$unix(0x1, 0x2, 0x0) bind$unix(r4, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000000)="d2", 0x1}], 0x1) recvmmsg(r4, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) 2m11.470960251s ago: executing program 3 (id=1300): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r3, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r6], 0x54}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000001000250800170000000000000a000000", @ANYRES32=r8, @ANYBLOB="0174dfdb0d"], 0x20}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=@newlink={0x50, 0x10, 0xf11, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x104}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x20, 0x20}}}}}}, @IFLA_MASTER={0x8, 0xa, r9}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 2m9.934953232s ago: executing program 3 (id=1306): r0 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14}, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) pwritev(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x54, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x54}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001ac0)=@newlink={0x44, 0x10, 0x609, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffa7}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x44}}, 0x0) 2m5.895899739s ago: executing program 3 (id=1313): r0 = socket(0xa, 0x6, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x11, @local, 0x0, 0x0, 'lblcr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) 2m5.35824939s ago: executing program 3 (id=1316): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8000000000000001, 0xffffffff7fffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/snmp6\x00') read$FUSE(r1, &(0x7f0000004800)={0x2020}, 0x2020) openat$autofs(0xffffffffffffff9c, &(0x7f0000000180), 0x414801, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='l\x00', @ANYBLOB="01000000000000000000030000005800018044000400200001000a000004000000000000000000000000000000000000000100000000200002000a00000000000000fe8000000000000000000000000000bb000000000d0001007564703a73797a3100000000"], 0x6c}}, 0x0) r2 = socket(0x1e, 0x4, 0x0) connect$tipc(r2, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x4}}, 0x10) sendmmsg$unix(r2, &(0x7f0000004400), 0x400000000000203, 0x0) 2m3.590496174s ago: executing program 3 (id=1320): sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x400034f, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fsmount(r4, 0x0, 0x0) fsmount(r4, 0x0, 0x2) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000000)='sched_switch\x00', r5}, 0x10) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0) semctl$SETVAL(0x0, 0x3, 0x10, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) ioctl$SIOCPNENABLEPIPE(r6, 0x89ed, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f00)={&(0x7f0000000000)={0x2, 0x16, 0x7, 0x9, 0xa, 0x0, 0x70bd2b, 0x25dfdbfe, [@sadb_x_policy={0x8, 0x12, 0x1, 0x0, 0x0, 0x0, 0x6c, {0x6, 0x9d, 0xa6, 0xf, 0x0, 0x6e531a13, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@multicast1}}]}, 0x50}}, 0x20000080) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000640)='./file1\x00', 0x3014850, &(0x7f00000001c0)={[{@quota}, {@barrier_val={'barrier', 0x3d, 0x1000}}, {@grpjquota}, {@norecovery}, {@dioread_lock}]}, 0x3, 0x4d1, &(0x7f0000000b80)="$eJzs3dFrW9cZAPDvynbiJM7sbHvIwpaFLcMJWyQ7XhKzh8yDsT0FlmXvnmfLxli2jCUnsQnDYX/AYGxraZ/61JdCn0uh5E9oC4H2vZTSEtokfWihrYrkqyZxZVsmlpVYvx8c33PuvfL3HQsd69x7uTeAjnUqIsYioisizkZEf7o+k5ZYWy/V/R7cvzVZLUlUKtc+TSJJ19V/V5Iuj6Qv642Iv/454h/J9+OWVlbnJgqF/FLazpXnF3OlldVzs/MTM/mZ/MLYyPDF0UujF0aHdq2vl//40f///eqfLr/1mxsfjH9y5p/VtPrSbY/3oxlrTe633vWe2t+irjsilnYS7BnWlfanp92JAADQlOp3/B9GxC8i4uFL7c4GAAAAaIXK7/viqySiAgAAAOxbmdo1sEkmm14L0BeZTDa7fg3vj+NwplAslX89XVxemFq/VnYgejLTs4X8UHqt8ED0JNX2cK3+qH1+Q3skIo5FxH/7D9Xa2cliYardBz8AAACgQxzZMP//vH99/g8AAADsMwPtTgAAAABoOfN/AAAA2P82nf8n3XubCAAAANAKf7lypVoq9edfT11fWZ4rXj83lS/NZeeXJ7OTxaXF7EyxOFO7Z9/8dr+vUCwu/jYWlm/myvlSOVdaWR2fLy4vlMdrz/Uez3tONAAAAOy9Yz+/834SEWu/O1QrVQfSbU3M1cdamx3QSpmd7Z60Kg9g73W1OwGgbba5wPedn+5VIsCecz4e2GZi/78N7R0eNgAAAJ4Fgz95qvP/zgfCc8xEHjqX8//QudzgCzqX8//Q4Q5uv0vvZhve3uVcAACAlumrlSSTTc8F9kUmk81GHK09FqAnmZ4t5Ici4gcR8V5/z8Fqe7jdSQMAAAAAAAAAAAAAAAAAAAAAAADAc6ZSSaICAAAA7GsRmY+T9EH+g/2n+zYeHziQfNFfW0bEjZevvXBzolxeGq6u/+y79eUX0/Xn23EEAwAAANioPk+vz+MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYDc9uH9rsl72Mu69P0TEQKP43dFbW/a+0R8Rhx8m0f3Y65KI6NqF+Gu3I+J4o/hJNa0YSLPYGD8TEYfaHP/ILsSHTnanOv6MNfr8ZeJUbdn489edlqd179Rm41+mPv7VxrlG49/RJmOcuPt6btP4tyNOdDcef+rxk6ccf//+t9XVzbZVXokYbPj/J3kiVq48v5grrayem52fmMnP5BdGRoYvjl4avTA6lJueLeTTnw1j/Odnb36zVf8PbxJ/YJv+n26y/1/fvXn/R1vEP/PLjfG/rL3/x7eIX/3b/yr9P1DdPlivr63XH3fytXdPbtX/qU36v937f6bJ/p+9+q8Pm9wVANgDpZXVuYlCIb+k8lxWeryDKltVrqYf9B2/vM0DEwAAsOsefelvdyYAAAAAAAAAAAAAAAAAAADQuVp+E7KDT95ZoLd9XQUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2NK3AQAA///VO9QU") r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800"/16], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={r7, 0xffffffffffffffff, 0x2d, 0x0, @val=@netfilter={0x2, 0x0, 0x6, 0x1}}, 0x20) 1m48.00989666s ago: executing program 32 (id=1320): sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x400034f, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fsmount(r4, 0x0, 0x0) fsmount(r4, 0x0, 0x2) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000000)='sched_switch\x00', r5}, 0x10) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0) semctl$SETVAL(0x0, 0x3, 0x10, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) ioctl$SIOCPNENABLEPIPE(r6, 0x89ed, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f00)={&(0x7f0000000000)={0x2, 0x16, 0x7, 0x9, 0xa, 0x0, 0x70bd2b, 0x25dfdbfe, [@sadb_x_policy={0x8, 0x12, 0x1, 0x0, 0x0, 0x0, 0x6c, {0x6, 0x9d, 0xa6, 0xf, 0x0, 0x6e531a13, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@multicast1}}]}, 0x50}}, 0x20000080) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000640)='./file1\x00', 0x3014850, &(0x7f00000001c0)={[{@quota}, {@barrier_val={'barrier', 0x3d, 0x1000}}, {@grpjquota}, {@norecovery}, {@dioread_lock}]}, 0x3, 0x4d1, &(0x7f0000000b80)="$eJzs3dFrW9cZAPDvynbiJM7sbHvIwpaFLcMJWyQ7XhKzh8yDsT0FlmXvnmfLxli2jCUnsQnDYX/AYGxraZ/61JdCn0uh5E9oC4H2vZTSEtokfWihrYrkqyZxZVsmlpVYvx8c33PuvfL3HQsd69x7uTeAjnUqIsYioisizkZEf7o+k5ZYWy/V/R7cvzVZLUlUKtc+TSJJ19V/V5Iuj6Qv642Iv/454h/J9+OWVlbnJgqF/FLazpXnF3OlldVzs/MTM/mZ/MLYyPDF0UujF0aHdq2vl//40f///eqfLr/1mxsfjH9y5p/VtPrSbY/3oxlrTe633vWe2t+irjsilnYS7BnWlfanp92JAADQlOp3/B9GxC8i4uFL7c4GAAAAaIXK7/viqySiAgAAAOxbmdo1sEkmm14L0BeZTDa7fg3vj+NwplAslX89XVxemFq/VnYgejLTs4X8UHqt8ED0JNX2cK3+qH1+Q3skIo5FxH/7D9Xa2cliYardBz8AAACgQxzZMP//vH99/g8AAADsMwPtTgAAAABoOfN/AAAA2P82nf8n3XubCAAAANAKf7lypVoq9edfT11fWZ4rXj83lS/NZeeXJ7OTxaXF7EyxOFO7Z9/8dr+vUCwu/jYWlm/myvlSOVdaWR2fLy4vlMdrz/Uez3tONAAAAOy9Yz+/834SEWu/O1QrVQfSbU3M1cdamx3QSpmd7Z60Kg9g73W1OwGgbba5wPedn+5VIsCecz4e2GZi/78N7R0eNgAAAJ4Fgz95qvP/zgfCc8xEHjqX8//QudzgCzqX8//Q4Q5uv0vvZhve3uVcAACAlumrlSSTTc8F9kUmk81GHK09FqAnmZ4t5Ici4gcR8V5/z8Fqe7jdSQMAAAAAAAAAAAAAAAAAAAAAAADAc6ZSSaICAAAA7GsRmY+T9EH+g/2n+zYeHziQfNFfW0bEjZevvXBzolxeGq6u/+y79eUX0/Xn23EEAwAAANioPk+vz+MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYDc9uH9rsl72Mu69P0TEQKP43dFbW/a+0R8Rhx8m0f3Y65KI6NqF+Gu3I+J4o/hJNa0YSLPYGD8TEYfaHP/ILsSHTnanOv6MNfr8ZeJUbdn489edlqd179Rm41+mPv7VxrlG49/RJmOcuPt6btP4tyNOdDcef+rxk6ccf//+t9XVzbZVXokYbPj/J3kiVq48v5grrayem52fmMnP5BdGRoYvjl4avTA6lJueLeTTnw1j/Odnb36zVf8PbxJ/YJv+n26y/1/fvXn/R1vEP/PLjfG/rL3/x7eIX/3b/yr9P1DdPlivr63XH3fytXdPbtX/qU36v937f6bJ/p+9+q8Pm9wVANgDpZXVuYlCIb+k8lxWeryDKltVrqYf9B2/vM0DEwAAsOsefelvdyYAAAAAAAAAAAAAAAAAAADQuVp+E7KDT95ZoLd9XQUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2NK3AQAA///VO9QU") r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800"/16], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={r7, 0xffffffffffffffff, 0x2d, 0x0, @val=@netfilter={0x2, 0x0, 0x6, 0x1}}, 0x20) 1m20.291243638s ago: executing program 0 (id=1514): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/3\x00') getpid() io_uring_enter(0xffffffffffffffff, 0x46f6, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000015c0)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/stat\x00', 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102"], 0x14}}, 0x0) close(0x3) bind$inet6(r5, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r5, 0xfff) 1m18.444899867s ago: executing program 0 (id=1517): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000380)=@allocspi={0x100, 0x16, 0x4, 0x0, 0x0, {{{@in=@dev={0xac, 0x14, 0x14, 0x39}, @in6=@private1}, {@in=@broadcast}, @in6=@loopback, {}, {0x0, 0x48a9, 0x0, 0x1}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50}, 0x0, 0x5}, [@XFRMA_IF_ID={0x8}]}, 0x100}, 0x1, 0x0, 0x0, 0x20000840}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x28101, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="8fedcb5d07081175f37538"], 0xfdef) 1m18.185269942s ago: executing program 0 (id=1524): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x1f4, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x1bc, 0x4, 0x0, 0x1, [{0x1b8, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x1a8, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x191, 0x3, "d67a8527f76ec1d39e537c4c3060c6a405106c72848aa8bcb429b3a20d532452032d5f166334739d1719a5778bd4f724ee4ca57f2527aeeb0c75755d68fc6fa55f4825682ee95e581039823e5963beedcf65b8b005623d90772b8b6ebd2498b0aff725a3eabb6c99cb2edfe10b9c33be8a971e08401bc0807e75a2ff376b7934473bc1f02bb512b77414daf260c9c7d4e1f0758b56ec5823892af310e6252fcfb1d9dbaddefdaa26f43f12f831fd221926d6536eeff641db46920ae0e48f3ff5de599714ba6510ce479d4116a519792281736f39c9fc0e10ef557392c43389271cebcf36543fcf6f83bf74b93ee4eb5e8c82e35bb4784cc1ed0ad291b16e8368487589f7590bf5896f340a36555a1cf69736da230a809176dbdfba3d47efb9a6932e5503d277532b7d4e6f7c7373a298e5843a9f74d5fd07fbc6ad22bc644ba9b3c94ec3c8f0b9321b16e5826b1f058f781760a5d4b6a8880202b41689139c37cd51f65a92d883f8901add03b650c9ec182fb565a4d657ebba9d6a5eb426b22d5933b72362e6ec327fb679aa80"}, @NFTA_MATCH_NAME={0x8, 0x1, 'bpf\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x9, 0x7, 0x1, 0x0, "030780fd4c"}]}], {0x14}}, 0x21c}}, 0x4048010) 1m17.173751302s ago: executing program 0 (id=1530): ioctl$VFAT_IOCTL_READDIR_BOTH(0xffffffffffffffff, 0x82187201, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000100)=@ethtool_wolinfo={0x6, 0x9, 0x3, "746478bdfd09"}}) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000005c0)=ANY=[@ANYRES32=r1, @ANYRES32=r1, @ANYBLOB], 0x20) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x400448ca, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xf0, 0xf0, 0x2, [@volatile={0xa, 0x0, 0x0, 0x9, 0x3}, @restrict={0x1, 0x0, 0x0, 0xb, 0x2}, @enum64={0x8, 0x4, 0x0, 0x13, 0x1, 0xe, [{0x7}, {0x10, 0x5, 0xfffffff9}, {0xf, 0x5, 0xda00}, {0x10, 0x10001, 0x3}]}, @enum64={0xb, 0x9, 0x0, 0x13, 0x0, 0xc, [{0x4, 0x6, 0x6cc}, {0x10, 0xfffffffc}, {0x2, 0x7fff, 0x4}, {0x5, 0x1c, 0x5}, {0x5, 0x2, 0xfffffff8}, {0x7, 0x1, 0x9}, {0x5, 0x9}, {0xf, 0x7, 0x1}, {0x4, 0xffffff75, 0x3}]}, @const={0x9, 0x0, 0x0, 0xa, 0x3}, @volatile={0x8, 0x0, 0x0, 0x9, 0x1}, @const={0xe, 0x0, 0x0, 0xa, 0x3}]}}, &(0x7f00000004c0)=""/199, 0x10a, 0xc7, 0x0, 0xffff, 0x0, @void, @value}, 0x28) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='net_prio.prioidx\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x16, 0x1, 0x2, 0x8, 0x50a02, 0x1, 0x8, '\x00', 0x0, r4, 0x2, 0x1, 0x2, 0x0, @void, @value, @value=r5}, 0x50) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000181000010000000000000000000000000a40000000060a010400000000000000000200050000000000000400000000000000796e7365740000180002800900010073797a30000000000800044000000000140000001100010000000000000000000000000a"], 0x68}}, 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00', @ANYRES16=r6], 0x44}}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8931, 0x0) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x400452c8, &(0x7f0000000100)) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, 0x0, 0x41) socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket(0x1, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4eeffffff00000000003a000010210006001480eb000000951300000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0xe, 0x4, &(0x7f0000000200)=ANY=[@ANYRESDEC=r2], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe, 0xffffffffffffffff, 0x8, 0x0, 0x5f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r8 = accept$packet(r7, &(0x7f00000006c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000700)=0x14) accept$packet(r8, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000780)=0x14) r9 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$bt_BT_POWER(r3, 0x112, 0x9, &(0x7f0000000680)=0x7, 0x1) sendmsg$nl_route_sched(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=@newtaction={0xd4, 0x30, 0x1, 0x0, 0x0, {}, [{0xc0, 0x1, [@m_ct={0x74, 0x2, 0x0, 0x0, {{0x7}, {0x4c, 0x2, 0x0, 0x1, [@TCA_CT_ACTION={0xc, 0x3, 0x35}, @TCA_CT_NAT_IPV4_MAX={0x8, 0xa, @broadcast}, @TCA_CT_LABELS={0x14, 0x7, "d415b9dde780a9ed9bbe2bc5a6064d41"}, @TCA_CT_MARK={0x8, 0x5, 0x7}, @TCA_CT_NAT_IPV6_MIN={0x14, 0xb, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @TCA_CT_NAT_IPV4_MAX={0x8, 0xa, @rand_addr=0x64010101}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xc, 0x762, 0x5, 0xc, 0x9}, 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4040}, 0x0) 1m15.054367496s ago: executing program 0 (id=1535): openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f00000003c0)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="00000102", 0xfffff, r2) 1m14.81225085s ago: executing program 0 (id=1536): openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r0, &(0x7f0000000040)={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0xc) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x49, &(0x7f0000000040)=0x2, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB, @ANYBLOB], 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r3, &(0x7f0000001900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000012c0)={0x14, 0x3, 0x3, 0x201, 0x0, 0x0, {0x0, 0x0, 0x2000}}, 0x14}}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fchown(r4, 0x0, 0xee01) r5 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0x0, 0x800, 0x0, 0x0, 0x0, r4}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x282, 0x0) sendfile(r8, r8, 0x0, 0x40008) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x47ba, 0x0, 0x0, 0x0, 0x0) 59.625763612s ago: executing program 33 (id=1536): openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r0, &(0x7f0000000040)={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0xc) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x49, &(0x7f0000000040)=0x2, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB, @ANYBLOB], 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r3, &(0x7f0000001900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000012c0)={0x14, 0x3, 0x3, 0x201, 0x0, 0x0, {0x0, 0x0, 0x2000}}, 0x14}}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fchown(r4, 0x0, 0xee01) r5 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0x0, 0x800, 0x0, 0x0, 0x0, r4}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x282, 0x0) sendfile(r8, r8, 0x0, 0x40008) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x47ba, 0x0, 0x0, 0x0, 0x0) 25.562378515s ago: executing program 5 (id=1688): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x800, 0x0, 0x103, 0x1}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) bind$unix(r3, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r4 = socket$unix(0x1, 0x2, 0x0) connect$unix(r4, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r4, &(0x7f0000000040)=[{&(0x7f0000000000)="d2", 0x1}], 0x1) recvmmsg(r3, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) 18.759542025s ago: executing program 5 (id=1711): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x80080, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x1) 11.373060519s ago: executing program 1 (id=1734): r0 = socket$inet_smc(0x2b, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000100)={'IDLETIMER\x00'}, &(0x7f00000001c0)=0x1e) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x80042, 0x0) ioctl$TCFLSH(r3, 0x540b, 0x2) 7.923187763s ago: executing program 2 (id=1743): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) 7.696262755s ago: executing program 2 (id=1744): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x0, 0x400000, 0xffff, 'syz1\x00', 0x1}, 0x0, [0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffc, 0x204, 0x7ff, 0x2, 0x0, 0x40, 0x0, 0x0, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x10, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7f, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x1, 0x0, 0x0, 0x20000, 0xfffffffffffff4cd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x8, 0x0, 0x8000000, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbe9e, 0x20, 0x0, 0x6, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x4, 0x0, 0x6]}) 6.864671245s ago: executing program 5 (id=1745): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x30, 0x0, &(0x7f0000000100)=0x600) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x2041, 0x0) semget$private(0x0, 0x3, 0x0) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r4, 0x890b, &(0x7f0000000280)={0x0, @bcast, @bpq0, 0xffff, 'syz0\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xfffffdba, 0x2, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r8}, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x24000015}, 0x8000) ioctl$sock_netrom_SIOCADDRT(r4, 0x890b, &(0x7f0000000000)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x4, 'syz1\x00', @default, 0x1, 0x0, [@default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) 5.787762928s ago: executing program 5 (id=1746): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b40)={&(0x7f00000014c0)={0x2, 0x4e20, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000000200)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @local}}}, @ip_retopts={{0x18, 0x0, 0x7, {[@ssrr={0x89, 0x7, 0x4, [@multicast2]}]}}}], 0x38}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) sendmmsg$sock(0xffffffffffffffff, &(0x7f00000024c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_genetlink_get_family_id$nfc(0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2ddc4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1300, 0x0, 0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) 4.935165748s ago: executing program 2 (id=1748): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xf, 0x4, 0x8, 0x9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r2 = socket(0x1, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r1, &(0x7f0000000100), &(0x7f00000001c0)=@tcp=r2}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r1, &(0x7f0000000100), &(0x7f0000000140)=@udp6=r0, 0x1}, 0x20) 4.858213193s ago: executing program 5 (id=1749): openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) readv(0xffffffffffffffff, &(0x7f0000001500), 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x8) futex(&(0x7f000000cffc)=0x100000000000004, 0x0, 0x4, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r4}}) 4.762101948s ago: executing program 1 (id=1751): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x8, &(0x7f0000006680)) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x404}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) 3.608900256s ago: executing program 2 (id=1753): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="120101000d0067204f17316a3f26010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x6c) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) bpf$MAP_DELETE_BATCH(0x18, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) getpid() bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) 3.607954986s ago: executing program 4 (id=1754): prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') preadv(r0, &(0x7f00000000c0)=[{&(0x7f00000010c0)=""/4097, 0x1001}], 0x1, 0x300, 0x0) 3.455109825s ago: executing program 4 (id=1755): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) 3.232788628s ago: executing program 1 (id=1758): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x30, 0x0, &(0x7f0000000100)=0x600) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x2041, 0x0) semget$private(0x0, 0x3, 0x0) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r4, 0x890b, &(0x7f0000000280)={0x0, @bcast, @bpq0, 0xffff, 'syz0\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xfffffdba, 0x2, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r8}, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x24000015}, 0x8000) ioctl$sock_netrom_SIOCADDRT(r4, 0x890b, &(0x7f0000000000)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x4, 'syz1\x00', @default, 0x1, 0x0, [@default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) 3.232488339s ago: executing program 5 (id=1759): sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x0, 0x400000, 0xffff, 'syz1\x00', 0x1}, 0x0, [0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffc, 0x204, 0x7ff, 0x2, 0x0, 0x40, 0x0, 0x0, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x10, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7f, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x1, 0x0, 0x0, 0x20000, 0xfffffffffffff4cd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x8, 0x0, 0x8000000, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbe9e, 0x20, 0x0, 0x6, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x4, 0x0, 0x6]}) 3.189496551s ago: executing program 4 (id=1760): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x28, 0x0, 0x7, 0x3, 0x0, 0x0, {}, [@NFACCT_FLAGS={0x8}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x8081}, 0x8000) 2.951006425s ago: executing program 4 (id=1761): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/3\x00') getpid() io_uring_enter(0xffffffffffffffff, 0x46f6, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000015c0)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/stat\x00', 0x0, 0x0) pread64(r5, &(0x7f0000002780)=""/59, 0x3b, 0xf27b) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102"], 0x14}}, 0x0) close(0x3) bind$inet6(r6, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r6, 0xfff) 2.007411821s ago: executing program 6 (id=1762): r0 = socket$inet_smc(0x2b, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000100)={'IDLETIMER\x00'}, &(0x7f00000001c0)=0x1e) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x80042, 0x0) ioctl$TCFLSH(r4, 0x540b, 0x2) 1.812659533s ago: executing program 1 (id=1763): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r5], 0x54}}, 0x0) 1.69056644s ago: executing program 1 (id=1764): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xf, 0x4, 0x8, 0x9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r2 = socket(0x1, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r1, &(0x7f0000000100), &(0x7f00000001c0)=@tcp=r2}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r1, &(0x7f0000000100), &(0x7f0000000140)=@udp6=r0, 0x1}, 0x20) 1.500492001s ago: executing program 1 (id=1765): sendmsg$unix(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000080)}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x18}, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) prlimit64(0x0, 0x5a09776efe689725, &(0x7f0000000140)={0x8, 0x3}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={r0, 0xffffffffffffffff, 0x2d, 0x0, @val=@netfilter={0x2, 0x0, 0x6, 0x1}}, 0x20) bpf$LINK_DETACH(0x22, &(0x7f00000001c0)=r5, 0x4) semget$private(0x0, 0x207, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305-generic\x00'}, 0x58) r7 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x41, 0x3f, 0x5f, 0x20, 0x61d, 0xc150, 0xce6f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x33, 0x0, 0x1, 0x18, 0x70, 0xfd, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x4}}]}}]}}]}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000bcbe642045058080010003010902"], 0x0) syz_usb_control_io$printer(r7, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r7, 0x82, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="a200004ef3b11f948e"]) r8 = accept4(r6, 0x0, 0x0, 0x80000) sendmsg$inet6(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000440)="a60e", 0x2}], 0x1}, 0x0) 1.164575081s ago: executing program 4 (id=1766): r0 = socket$inet(0x2, 0x6000000000000001, 0x0) setrlimit(0x8, &(0x7f0000000080)) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x2000001, 0x2011, r0, 0x0) 1.074960206s ago: executing program 2 (id=1767): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x7e658000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00004bd000/0x3000)=nil, 0x3000}}) 1.074481366s ago: executing program 4 (id=1768): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x0, 0x400000, 0xffff, 'syz1\x00', 0x1}, 0x0, [0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffc, 0x204, 0x7ff, 0x2, 0x0, 0x40, 0x0, 0x0, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x10, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7f, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x1, 0x0, 0x0, 0x20000, 0xfffffffffffff4cd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x8, 0x0, 0x8000000, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbe9e, 0x20, 0x0, 0x6, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x4, 0x0, 0x6]}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x40, 0x7ffc0002}]}) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000ff010000850000000e000000850000005000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000400)='kmem_cache_free\x00', r4}, 0x10) sysinfo(&(0x7f0000000180)=""/65) r5 = socket$packet(0x11, 0x2, 0x300) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f00000001c0)={0x0, 0x1, 0x0, 0x0, @vifc_lcl_addr=@loopback, @private=0xa010100}, 0x10) setsockopt$sock_int(r5, 0x1, 0x1, &(0x7f0000000040)=0x3, 0x4) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_IP_XFRM_POLICY(r7, 0x0, 0x11, &(0x7f0000000000)={{{@in=@empty, @in=@initdev}}, {{@in6=@mcast1}}}, &(0x7f0000000400)=0xe8) 554.783277ms ago: executing program 6 (id=1769): r0 = syz_init_net_socket$ax25(0x3, 0x2, 0xf0) ioctl$sock_ax25_SIOCADDRT(r0, 0x5411, 0x0) 461.308123ms ago: executing program 6 (id=1770): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) 336.14226ms ago: executing program 6 (id=1771): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000440)=ANY=[@ANYBLOB="84010000", @ANYRES16=r1, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b8008000a0000000000080009"], 0x184}}, 0x0) 214.893417ms ago: executing program 6 (id=1772): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=ANY=[@ANYBLOB="440100001000010000000000fcdbdf25fe800000000000000000000000000000ac1e000100000000000000000000000000000000000000000000000032000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0100000000000000000000000000000000000032000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005ca30000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001c"], 0x144}}, 0x0) 108.359644ms ago: executing program 6 (id=1773): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3e, &(0x7f00000000c0)=0x4, 0x4) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0xf0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$sock_ax25_SIOCADDRT(r1, 0x890b, &(0x7f00000000c0)={@default, @default, 0x0, [@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null]}) r3 = syz_init_net_socket$ax25(0x3, 0x3, 0xc4) ioctl$sock_ax25_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@default, @default, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) connect$ax25(r1, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xc8}}, 0x0) sendmmsg$inet(r0, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x1, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r5}, 0x0, &(0x7f0000000380)}, 0xffffffffffffff8c) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'wlan1\x00'}) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000002c0)=ANY=[@ANYRESDEC=r2, @ANYRES16], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r6}, 0x10) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a00000005000000020000000700000000000000", @ANYRES32], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000818110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r8, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0900000004000000e47f0000010000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0200000002000000ffffffff00"/28], 0x50) socket$nl_route(0x10, 0x3, 0x0) 0s ago: executing program 2 (id=1774): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000004f4b000000000000000000180100002020702000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000fdffffff850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='sched_switch\x00', r2}, 0x18) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r2, r5, 0x20, 0x0, @void}, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) capset(&(0x7f00000020c0)={0x19980330}, &(0x7f0000002100)) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x46, &(0x7f0000000340)=0x41, 0x4) r8 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x2}) ioctl$vim2m_VIDIOC_STREAMOFF(r8, 0x40045612, &(0x7f0000000240)=0x1) ioctl$vim2m_VIDIOC_ENUM_FMT(r8, 0xc0405602, &(0x7f0000000000)={0x2, 0x1, 0x1, "4a37f6c000190000000000000020000000000000000000000100", 0x31435641}) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f0000001300)={@val={0xa}, @void, @eth={@multicast, @remote, @void, {@ipv6={0x86dd, @gre_packet={0x3, 0x6, "14f35c", 0x44, 0x2f, 0xff, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x2}, {0x1}, {0x1}, {0x8, 0x88be, 0x3, {{0x9, 0x1, 0xa1, 0x1, 0x0, 0x2, 0x4, 0x6}, 0x1, {0x7ff}}}, {0x8, 0x22eb, 0x4, {{0xd, 0x2, 0x1, 0x0, 0x1, 0x3, 0x5, 0xc}, 0x2, {0x80000000, 0x1, 0x2, 0x1b, 0x0, 0x0, 0x2, 0x0, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}}}, 0x7e) kernel console output (not intermixed with test programs): 6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 43.146247][ T4067] Bluetooth: hci0: command 0x041b tx timeout [ 43.148283][ T4067] Bluetooth: hci1: command 0x041b tx timeout [ 43.148644][ T4021] device veth0_macvtap entered promiscuous mode [ 43.153271][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 43.156925][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 43.159592][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 43.162156][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.164848][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 43.170331][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.184934][ T4030] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 43.191667][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 43.194331][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 43.197670][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.200292][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 43.202953][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.211159][ T4028] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 43.215079][ T4021] device veth1_macvtap entered promiscuous mode [ 43.220994][ T4026] device veth1_vlan entered promiscuous mode [ 43.238263][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 43.241005][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 43.243419][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 43.251423][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 43.254048][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.283116][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 43.292583][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.303045][ T4021] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 43.305474][ T4067] Bluetooth: hci2: command 0x041b tx timeout [ 43.307446][ T4067] Bluetooth: hci4: command 0x041b tx timeout [ 43.309138][ T4067] Bluetooth: hci3: command 0x041b tx timeout [ 43.320741][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 43.323220][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 43.327418][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.330063][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.342382][ T4031] device veth0_vlan entered promiscuous mode [ 43.349503][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 43.352156][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.365014][ T4026] device veth0_macvtap entered promiscuous mode [ 43.374275][ T4021] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 43.383554][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 43.387739][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 43.390528][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.394434][ T4031] device veth1_vlan entered promiscuous mode [ 43.411596][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 43.413689][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 43.428996][ T4026] device veth1_macvtap entered promiscuous mode [ 43.434165][ T4021] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.439281][ T4021] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.441545][ T4021] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.443776][ T4021] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.454330][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 43.457485][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 43.459479][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 43.471702][ T4026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 43.474637][ T4026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.479647][ T4026] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 43.490104][ T4028] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 43.493556][ T4030] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 43.503049][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.508405][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.512916][ T4026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 43.519336][ T4026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.523171][ T4026] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 43.534590][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 43.537609][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.552377][ T4031] device veth0_macvtap entered promiscuous mode [ 43.557370][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 43.560328][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.563342][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 43.584373][ T4026] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.587186][ T4026] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.590521][ T4026] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.593078][ T4026] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.603560][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 43.607442][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.616210][ T4031] device veth1_macvtap entered promiscuous mode [ 43.631017][ T4030] device veth0_vlan entered promiscuous mode [ 43.652244][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 43.656314][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 43.664692][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.670120][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 43.672806][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 43.697110][ T4031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 43.699887][ T4031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.702331][ T4031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 43.704998][ T4031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.712692][ T4031] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 43.742539][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.747210][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.754299][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.757051][ T4030] device veth1_vlan entered promiscuous mode [ 43.757296][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.772616][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 43.775528][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 43.777872][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 43.780511][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.808902][ T4031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 43.811662][ T4031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.814047][ T4031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 43.819551][ T4031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 43.823333][ T4031] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 43.828744][ T4031] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.830824][ T4031] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.832917][ T4031] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.835049][ T4031] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.854737][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 43.860782][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.863504][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 43.867690][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.870533][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 43.872767][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 43.919727][ T4028] device veth0_vlan entered promiscuous mode [ 43.931417][ T153] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.933662][ T153] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.938562][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 43.941655][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 43.951338][ T4028] device veth1_vlan entered promiscuous mode [ 43.959467][ T1628] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.961758][ T1628] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.964587][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 43.969286][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 44.009683][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 44.012322][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.014977][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.038993][ T4028] device veth0_macvtap entered promiscuous mode [ 44.053620][ T4028] device veth1_macvtap entered promiscuous mode [ 44.063200][ T4030] device veth0_macvtap entered promiscuous mode [ 44.068965][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 44.071618][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.074465][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.081652][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 44.084433][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 44.124997][ T1628] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 44.129575][ T1628] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 44.132590][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 44.140397][ T4030] device veth1_macvtap entered promiscuous mode [ 44.142991][ T4028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 44.147534][ T4028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.149884][ T4028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 44.152412][ T4028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.154908][ T4028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 44.159469][ T4028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.163702][ T4028] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 44.177314][ T4028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 44.184375][ T4028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.188207][ T4028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 44.190740][ T4028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.193102][ T4028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 44.208056][ T4028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.212150][ T4028] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 44.218319][ T4028] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.220617][ T4028] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.222969][ T4028] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.226004][ T4028] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.234007][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 44.238109][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 44.240808][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.243984][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 44.248353][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.264285][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 44.271713][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 44.310956][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 44.367567][ T4030] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 44.370409][ T4030] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.372940][ T4030] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 44.422401][ T4030] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.428537][ T4030] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 44.431453][ T4030] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.434052][ T4030] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 44.529653][ T4030] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.533847][ T4030] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 45.950916][ T26] audit: type=1326 audit(44.720:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4107 comm="syz.1.7" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 46.030336][ T26] audit: type=1326 audit(44.720:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4107 comm="syz.1.7" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 46.370151][ T26] audit: type=1326 audit(44.740:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4107 comm="syz.1.7" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=31 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 46.579647][ T26] audit: type=1326 audit(44.740:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4107 comm="syz.1.7" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 46.732606][ T26] audit: type=1326 audit(44.740:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4107 comm="syz.1.7" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 46.897824][ T26] audit: type=1326 audit(44.740:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4107 comm="syz.1.7" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=243 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 47.285128][ C0] sched: RT throttling activated [ 47.289759][ T4098] Bluetooth: hci1: command 0x040f tx timeout [ 47.291420][ T4098] Bluetooth: hci0: command 0x040f tx timeout [ 47.293123][ T4098] Bluetooth: hci3: command 0x040f tx timeout [ 47.294826][ T4098] Bluetooth: hci4: command 0x040f tx timeout [ 47.296728][ T4098] Bluetooth: hci2: command 0x040f tx timeout [ 47.344669][ T4106] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 47.348403][ T4106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.353443][ T153] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 47.356192][ T153] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 47.361971][ T4106] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 48.017919][ T4130] loop1: detected capacity change from 0 to 64 [ 48.307567][ T4030] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 48.310311][ T4030] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 48.312724][ T4030] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 48.316635][ T4030] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 48.319217][ T4030] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 48.322020][ T4030] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 48.324461][ T4030] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 48.586264][ T4030] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 48.590541][ T4030] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 48.620794][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 48.623481][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 48.697627][ T4030] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.700108][ T4030] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.702517][ T4030] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.704617][ T4030] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.795921][ T4114] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 48.798115][ T4114] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 48.802596][ T4132] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3'. [ 48.834229][ T4106] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 49.092212][ T4130] ======================================================= [ 49.092212][ T4130] WARNING: The mand mount option has been deprecated and [ 49.092212][ T4130] and is ignored by this kernel. Remove the mand [ 49.092212][ T4130] option from the mount to silence this warning. [ 49.092212][ T4130] ======================================================= [ 49.194486][ T148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.196921][ T148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.221477][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 49.298067][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.300244][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.303848][ T4106] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 49.305468][ T1534] Bluetooth: hci2: command 0x0419 tx timeout [ 49.308008][ T1534] Bluetooth: hci4: command 0x0419 tx timeout [ 49.309820][ T1534] Bluetooth: hci3: command 0x0419 tx timeout [ 49.313663][ T1534] Bluetooth: hci0: command 0x0419 tx timeout [ 49.319166][ T1534] Bluetooth: hci1: command 0x0419 tx timeout [ 49.373453][ T4140] netdevsim netdevsim0: Direct firmware load for / [ 49.373453][ T4140] failed with error -2 [ 49.387259][ T4140] netdevsim netdevsim0: Falling back to sysfs fallback for: / [ 49.387259][ T4140] [ 49.408804][ T4114] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.410999][ T4114] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.414061][ T4114] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 49.827008][ T4157] device wlan0 entered promiscuous mode [ 49.828772][ T4157] device macsec1 entered promiscuous mode [ 51.204614][ T4189] netlink: 8 bytes leftover after parsing attributes in process `syz.3.23'. [ 51.782708][ T4177] dccp_close: ABORT with 128 bytes unread [ 51.929627][ T4210] netlink: 48 bytes leftover after parsing attributes in process `syz.3.33'. [ 53.504944][ T4253] netlink: 24 bytes leftover after parsing attributes in process `syz.0.44'. [ 53.743519][ T4257] netlink: 324 bytes leftover after parsing attributes in process `syz.0.46'. [ 53.914406][ T4249] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 55.283742][ T4282] loop0: detected capacity change from 0 to 512 [ 55.417954][ T4282] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 55.426502][ T4282] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 55.457180][ T4282] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2816: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 55.474055][ T4282] EXT4-fs (loop0): 1 truncate cleaned up [ 55.489931][ T4282] EXT4-fs (loop0): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 56.100745][ T4304] netlink: 88 bytes leftover after parsing attributes in process `syz.3.60'. [ 56.103168][ T4304] netlink: 8 bytes leftover after parsing attributes in process `syz.3.60'. [ 56.138276][ T4304] netlink: 4 bytes leftover after parsing attributes in process `syz.3.60'. [ 59.014067][ T4320] loop3: detected capacity change from 0 to 8 [ 60.179970][ T4351] device bridge1 entered promiscuous mode [ 60.301297][ T4356] loop4: detected capacity change from 0 to 512 [ 60.378018][ T4356] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 60.417742][ T4356] EXT4-fs (loop4): 1 truncate cleaned up [ 60.421828][ T4356] EXT4-fs (loop4): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 60.473663][ T4360] netlink: set zone limit has 8 unknown bytes [ 63.843242][ T4399] netlink: 324 bytes leftover after parsing attributes in process `syz.2.94'. [ 64.345169][ T4406] loop1: detected capacity change from 0 to 512 [ 65.895432][ T4406] EXT4-fs (loop1): mounted filesystem without journal. Opts: quota,barrier=0x0000000000001000,grpjquota=,norecovery,dioread_lock,,errors=continue. Quota mode: writeback. [ 66.457540][ T4416] loop4: detected capacity change from 0 to 512 [ 66.581774][ T4416] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 66.607602][ T4416] EXT4-fs (loop4): 1 truncate cleaned up [ 66.609223][ T4416] EXT4-fs (loop4): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 67.489183][ T4414] netlink: 28 bytes leftover after parsing attributes in process `syz.2.99'. [ 67.663537][ T4431] loop1: detected capacity change from 0 to 8 [ 67.669825][ T1534] hid-generic 0005:07C0:06E6.0001: item fetching failed at offset 0/1 [ 67.672545][ T1534] hid-generic: probe of 0005:07C0:06E6.0001 failed with error -22 [ 67.929113][ T4437] loop3: detected capacity change from 0 to 512 [ 68.014022][ T4437] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 68.070802][ T4437] EXT4-fs (loop3): 1 truncate cleaned up [ 68.072616][ T4437] EXT4-fs (loop3): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 69.645711][ T4449] SET target dimension over the limit! [ 69.814563][ T4451] loop0: detected capacity change from 0 to 512 [ 70.295888][ T2055] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.298004][ T2055] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.484641][ T4451] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 70.538565][ T4451] EXT4-fs (loop0): 1 truncate cleaned up [ 70.540006][ T4451] EXT4-fs (loop0): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 70.593464][ T4466] tipc: Started in network mode [ 70.594966][ T4466] tipc: Node identity ba98e4c87f1a, cluster identity 4711 [ 70.635383][ T4466] tipc: Enabled bearer , priority 10 [ 70.847408][ T4470] loop3: detected capacity change from 0 to 8 [ 71.366637][ T4487] 8021q: adding VLAN 0 to HW filter on device bond1 [ 71.397328][ T4487] bridge0: port 3(bond1) entered blocking state [ 71.425706][ T4487] bridge0: port 3(bond1) entered disabled state [ 71.428575][ T4487] device bond1 entered promiscuous mode [ 71.430526][ T4487] bridge0: port 3(bond1) entered blocking state [ 71.432348][ T4487] bridge0: port 3(bond1) entered forwarding state [ 71.535405][ T4488] netlink: 8 bytes leftover after parsing attributes in process `syz.3.121'. [ 71.539250][ T4367] bridge0: port 3(bond1) entered disabled state [ 71.636420][ T4316] tipc: Node number set to 3313689800 [ 72.391059][ T4505] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 72.393138][ T4505] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 72.560223][ T4510] loop1: detected capacity change from 0 to 512 [ 72.607646][ T4510] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 72.630298][ T4510] EXT4-fs (loop1): 1 truncate cleaned up [ 72.631859][ T4510] EXT4-fs (loop1): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 72.709739][ T4515] loop4: detected capacity change from 0 to 512 [ 72.797798][ T4515] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 72.808638][ T4515] EXT4-fs (loop4): 1 truncate cleaned up [ 72.810551][ T4515] EXT4-fs (loop4): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 73.461024][ T4528] netlink: 'syz.3.133': attribute type 29 has an invalid length. [ 73.485518][ T4528] netlink: 'syz.3.133': attribute type 29 has an invalid length. [ 73.491894][ T4528] netlink: 'syz.3.133': attribute type 29 has an invalid length. [ 74.119343][ T4535] netlink: 4 bytes leftover after parsing attributes in process `syz.1.135'. [ 74.787578][ T7] cfg80211: failed to load regulatory.db [ 75.269775][ T4549] netlink: 'syz.0.140': attribute type 4 has an invalid length. [ 76.637104][ T4566] loop1: detected capacity change from 0 to 512 [ 76.704687][ T4566] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 76.729945][ T4566] EXT4-fs (loop1): 1 truncate cleaned up [ 76.731544][ T4566] EXT4-fs (loop1): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 76.804442][ T4572] x_tables: ip_tables: bpf.1 match: invalid size 528 (kernel) != (user) 536 [ 76.854841][ T4569] tipc: Started in network mode [ 76.856432][ T4569] tipc: Node identity ac1414aa, cluster identity 4711 [ 76.897227][ T4569] tipc: Enabled bearer , priority 10 [ 77.705688][ T4580] tmpfs: Unknown parameter '' [ 78.450284][ T4583] udc-core: couldn't find an available UDC or it's busy [ 78.452068][ T4583] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 78.471052][ T4584] netlink: 4 bytes leftover after parsing attributes in process `syz.2.151'. [ 78.559661][ T4065] tipc: Node number set to 2886997162 [ 79.507484][ T4589] netlink: 8 bytes leftover after parsing attributes in process `syz.0.154'. [ 79.509953][ T4589] Zero length message leads to an empty skb [ 79.731987][ T4597] syz.4.155 uses obsolete (PF_INET,SOCK_PACKET) [ 80.879792][ T4619] tmpfs: Unknown parameter '' [ 81.782324][ T4623] loop2: detected capacity change from 0 to 512 [ 81.891396][ T4623] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 81.933008][ T4623] EXT4-fs (loop2): 1 truncate cleaned up [ 81.935906][ T4623] EXT4-fs (loop2): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 81.951674][ T4644] loop3: detected capacity change from 0 to 512 [ 82.130296][ T4644] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 82.304100][ T4644] EXT4-fs (loop3): 1 truncate cleaned up [ 82.310611][ T4644] EXT4-fs (loop3): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 83.389395][ T4658] loop1: detected capacity change from 0 to 512 [ 85.311660][ T4658] EXT4-fs: error -4 creating inode table initialization thread [ 85.314189][ T4658] EXT4-fs (loop1): mount failed [ 86.404918][ T4696] netlink: 232 bytes leftover after parsing attributes in process `syz.1.182'. [ 86.416153][ T4696] device macvtap1 entered promiscuous mode [ 86.418048][ T4696] device syz_tun entered promiscuous mode [ 86.433139][ T4696] team0: Device macvtap1 failed to register rx_handler [ 86.446403][ T4696] device syz_tun left promiscuous mode [ 86.649251][ T4701] loop4: detected capacity change from 0 to 512 [ 86.737318][ T4701] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 86.765971][ T4701] EXT4-fs (loop4): 1 truncate cleaned up [ 86.767671][ T4701] EXT4-fs (loop4): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 87.095844][ T4716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.189'. [ 87.118957][ T4716] device bond_slave_0 entered promiscuous mode [ 87.120875][ T4716] device bond_slave_1 entered promiscuous mode [ 87.122734][ T4716] device macvtap1 entered promiscuous mode [ 87.124530][ T4716] device bond0 entered promiscuous mode [ 87.128558][ T4716] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 87.180318][ T4716] device bond0 left promiscuous mode [ 87.182369][ T4716] device bond_slave_0 left promiscuous mode [ 87.184063][ T4716] device bond_slave_1 left promiscuous mode [ 87.607313][ T4729] device batadv_slave_1 entered promiscuous mode [ 87.614826][ T4727] device batadv_slave_1 left promiscuous mode [ 87.876400][ T4739] netlink: 68 bytes leftover after parsing attributes in process `syz.3.198'. [ 88.011368][ T4744] netlink: 'syz.4.200': attribute type 2 has an invalid length. [ 88.014031][ T4742] raw_sendmsg: syz.3.199 forgot to set AF_INET. Fix it! [ 88.014478][ T4744] netlink: 'syz.4.200': attribute type 1 has an invalid length. [ 88.393534][ T4757] tmpfs: Bad value for 'mpol' [ 89.188438][ T4760] loop2: detected capacity change from 0 to 512 [ 89.225082][ T4760] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 89.252335][ T4760] EXT4-fs (loop2): 1 truncate cleaned up [ 89.253994][ T4760] EXT4-fs (loop2): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 89.658469][ T4785] x_tables: ip_tables: bpf.1 match: invalid size 528 (kernel) != (user) 536 [ 89.994748][ T4798] netlink: 8 bytes leftover after parsing attributes in process `syz.1.220'. [ 90.164639][ T4803] netlink: 'syz.2.222': attribute type 4 has an invalid length. [ 90.244615][ T4805] netlink: 'syz.2.222': attribute type 4 has an invalid length. [ 90.604892][ T4818] dccp_close: ABORT with 58 bytes unread [ 90.705872][ T4828] netlink: 8 bytes leftover after parsing attributes in process `syz.4.233'. [ 92.255778][ T4066] Bluetooth: hci0: command 0x0401 tx timeout [ 92.607655][ T4870] device syzkaller1 entered promiscuous mode [ 92.698512][ T4874] netlink: 8 bytes leftover after parsing attributes in process `syz.2.248'. [ 93.045616][ T4864] netlink: 28 bytes leftover after parsing attributes in process `syz.3.243'. [ 94.036641][ T4898] udc-core: couldn't find an available UDC or it's busy [ 94.048648][ T4898] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 94.255001][ T4906] netlink: 8 bytes leftover after parsing attributes in process `syz.1.260'. [ 95.670497][ T4932] netlink: 16 bytes leftover after parsing attributes in process `syz.4.272'. [ 99.009256][ T4987] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input2 [ 99.348683][ T4994] loop4: detected capacity change from 0 to 512 [ 100.307413][ T4993] netlink: 52 bytes leftover after parsing attributes in process `syz.0.294'. [ 100.985806][ T4994] EXT4-fs (loop4): mounted filesystem without journal. Opts: quota,barrier=0x0000000000001000,grpjquota=,norecovery,dioread_lock,,errors=continue. Quota mode: writeback. [ 101.298358][ T4987] netlink: 64 bytes leftover after parsing attributes in process `syz.1.292'. [ 101.437190][ T4993] device geneve0 entered promiscuous mode [ 101.476648][ T4989] device geneve0 left promiscuous mode [ 101.696588][ T5005] netlink: 36 bytes leftover after parsing attributes in process `syz.0.297'. [ 102.124150][ T5017] netlink: 200 bytes leftover after parsing attributes in process `syz.0.301'. [ 102.735020][ T5018] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.737910][ T5018] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.576207][ T5018] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 103.610846][ T5018] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 104.254125][ T5018] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.256861][ T5018] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.259267][ T5018] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.261595][ T5018] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.510418][ T5018] device bridge1 left promiscuous mode [ 104.935407][ T5045] loop0: detected capacity change from 0 to 512 [ 105.067096][ T5045] EXT4-fs (loop0): mounted filesystem without journal. Opts: quota,barrier=0x0000000000001000,grpjquota=,norecovery,dioread_lock,,errors=continue. Quota mode: writeback. [ 105.895820][ T5086] loop1: detected capacity change from 0 to 512 [ 105.941936][ T5086] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 105.962844][ T5086] EXT4-fs (loop1): 1 truncate cleaned up [ 105.964417][ T5086] EXT4-fs (loop1): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 106.818343][ T5107] loop2: detected capacity change from 0 to 512 [ 106.844955][ T5110] netlink: 8 bytes leftover after parsing attributes in process `syz.3.334'. [ 106.938616][ T5107] EXT4-fs (loop2): mounted filesystem without journal. Opts: quota,barrier=0x0000000000001000,grpjquota=,norecovery,dioread_lock,,errors=continue. Quota mode: writeback. [ 107.099723][ T5121] loop3: detected capacity change from 0 to 512 [ 107.184679][ T5121] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 107.244321][ T5121] EXT4-fs (loop3): 1 truncate cleaned up [ 107.245909][ T5121] EXT4-fs (loop3): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 108.782494][ T5151] netlink: 8 bytes leftover after parsing attributes in process `syz.4.348'. [ 109.417359][ T5173] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 109.680455][ T5179] loop2: detected capacity change from 0 to 8 [ 109.730260][ T5189] udc-core: couldn't find an available UDC or it's busy [ 109.765314][ T5189] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 111.145372][ T5211] netlink: 'syz.2.374': attribute type 10 has an invalid length. [ 111.147369][ T5211] netlink: 55 bytes leftover after parsing attributes in process `syz.2.374'. [ 111.975581][ T5209] delete_channel: no stack [ 113.286970][ T5235] loop0: detected capacity change from 0 to 8 [ 115.174993][ T5276] netlink: set zone limit has 8 unknown bytes [ 115.265613][ T5273] loop1: detected capacity change from 0 to 8 [ 115.328908][ T5276] netlink: 8 bytes leftover after parsing attributes in process `syz.0.398'. [ 115.344051][ T5276] netlink: 24 bytes leftover after parsing attributes in process `syz.0.398'. [ 117.945938][ T5300] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input3 [ 118.140457][ T5308] ieee802154 phy0 wpan0: encryption failed: -22 [ 118.627783][ T5323] netlink: 20 bytes leftover after parsing attributes in process `syz.2.413'. [ 119.272629][ T5342] netlink: 8 bytes leftover after parsing attributes in process `syz.4.421'. [ 119.442103][ T5346] netlink: 28 bytes leftover after parsing attributes in process `syz.0.423'. [ 120.013036][ T5358] ksmbd: Unknown IPC event: 6, ignore. [ 120.138853][ T5360] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 120.505263][ T5383] netlink: 'syz.4.434': attribute type 1 has an invalid length. [ 120.562621][ T5383] 8021q: adding VLAN 0 to HW filter on device bond2 [ 120.577409][ T5388] netlink: 'syz.1.436': attribute type 1 has an invalid length. [ 120.599564][ T5383] 8021q: adding VLAN 0 to HW filter on device bond2 [ 120.603958][ T5383] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 120.624595][ T5383] bond2: (slave vxcan3): Error -22 calling dev_set_mtu [ 120.714342][ T5390] device ip6erspan0 entered promiscuous mode [ 120.748732][ T5390] bond2: (slave ip6erspan0): making interface the new active one [ 120.765344][ T5390] bond2: (slave ip6erspan0): Enslaving as an active interface with an up link [ 120.767824][ T5393] netlink: 8 bytes leftover after parsing attributes in process `syz.0.438'. [ 120.826262][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 121.317713][ T5408] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 121.332167][ T5407] device team_slave_0 entered promiscuous mode [ 121.333882][ T5407] device team_slave_1 entered promiscuous mode [ 121.337079][ T5407] device vlan2 entered promiscuous mode [ 121.338357][ T5407] device team0 entered promiscuous mode [ 121.355479][ T5407] device team0 left promiscuous mode [ 121.357173][ T5407] device team_slave_0 left promiscuous mode [ 121.358729][ T5407] device team_slave_1 left promiscuous mode [ 121.875285][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 122.166138][ T5417] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 122.484253][ T5434] netlink: 20 bytes leftover after parsing attributes in process `syz.0.451'. [ 122.510257][ T5434] device vlan2 entered promiscuous mode [ 122.527621][ T5434] device gretap0 entered promiscuous mode [ 122.905280][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 122.924146][ T5448] loop3: detected capacity change from 0 to 8 [ 122.947793][ T5451] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 123.295621][ T5458] A link change request failed with some changes committed already. Interface macvlan0 may have been left with an inconsistent configuration, please check. [ 123.945371][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 124.985224][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 125.492224][ T5494] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 125.703914][ T5503] netlink: 20 bytes leftover after parsing attributes in process `syz.0.473'. [ 126.035285][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 126.917938][ T5523] netlink: 8 bytes leftover after parsing attributes in process `syz.3.482'. [ 127.024452][ T5527] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 127.065312][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 127.263091][ T5537] netlink: 12 bytes leftover after parsing attributes in process `syz.0.486'. [ 127.341154][ T5540] netlink: 'syz.3.488': attribute type 4 has an invalid length. [ 127.654946][ T5544] netlink: 'syz.0.489': attribute type 4 has an invalid length. [ 128.116212][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 128.303789][ T5440] ODEBUG: Out of memory. ODEBUG disabled [ 128.755329][ T5547] netlink: 'syz.0.489': attribute type 4 has an invalid length. [ 129.145880][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 130.195257][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 130.527316][ T5591] netlink: 8 bytes leftover after parsing attributes in process `syz.1.505'. [ 130.693162][ T5440] Set syz1 is full, maxelem 65536 reached [ 130.867034][ T5604] tipc: Started in network mode [ 130.868482][ T5604] tipc: Node identity ffffffff, cluster identity 4711 [ 130.870225][ T5604] tipc: Node number set to 4294967295 [ 131.073968][ T2055] ieee802154 phy0 wpan0: encryption failed: -22 [ 131.075734][ T2055] ieee802154 phy1 wpan1: encryption failed: -22 [ 131.225215][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 132.265254][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 132.502140][ T5647] netlink: 28 bytes leftover after parsing attributes in process `syz.4.525'. [ 132.624977][ T5647] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 132.627634][ T5647] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 132.630876][ T5647] 8021q: adding VLAN 0 to HW filter on device bond0 [ 132.636215][ T5647] 8021q: adding VLAN 0 to HW filter on device team0 [ 132.675400][ T5647] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 132.680402][ T5650] netlink: 'syz.4.525': attribute type 4 has an invalid length. [ 132.684746][ T5650] netlink: 152 bytes leftover after parsing attributes in process `syz.4.525'. [ 132.716034][ T5650] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 133.016941][ T5661] netlink: 8 bytes leftover after parsing attributes in process `syz.3.530'. [ 133.047026][ T2475] hid-generic 0005:0C45:06E6.0002: item fetching failed at offset 0/1 [ 133.049429][ T2475] hid-generic: probe of 0005:0C45:06E6.0002 failed with error -22 [ 133.305241][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 133.308428][ T5675] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.777898][ T5693] netlink: 8 bytes leftover after parsing attributes in process `syz.0.543'. [ 134.322288][ T5713] netlink: 28 bytes leftover after parsing attributes in process `syz.0.551'. [ 134.355248][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 134.750924][ T5722] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 134.773702][ T5726] netlink: 8 bytes leftover after parsing attributes in process `syz.2.556'. [ 135.385273][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 135.592120][ T5764] loop2: detected capacity change from 0 to 512 [ 135.836223][ T5764] EXT4-fs (loop2): mounted filesystem without journal. Opts: quota,barrier=0x0000000000001000,grpjquota=,norecovery,dioread_lock,,errors=continue. Quota mode: writeback. [ 136.435236][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 136.893295][ T5804] device ip6tnl1 entered promiscuous mode [ 137.465411][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 138.505244][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 139.178025][ T5830] netlink: 16 bytes leftover after parsing attributes in process `syz.2.585'. [ 139.195531][ T5830] netlink: 16 bytes leftover after parsing attributes in process `syz.2.585'. [ 139.555267][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 140.585265][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 141.635210][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 142.665282][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 143.266750][ T5903] device geneve0 entered promiscuous mode [ 143.269048][ T5902] device geneve0 left promiscuous mode [ 143.705228][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 144.745305][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 144.873779][ T5953] netlink: 20 bytes leftover after parsing attributes in process `syz.4.635'. [ 144.895514][ T5953] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 144.964358][ T5957] netlink: 'syz.0.637': attribute type 10 has an invalid length. [ 145.035943][ T5957] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 145.785545][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 145.940554][ T6009] netlink: 'syz.1.658': attribute type 10 has an invalid length. [ 145.942715][ T6009] netlink: 40 bytes leftover after parsing attributes in process `syz.1.658'. [ 145.946175][ T4069] hid-generic 0005:04F3:06E6.0003: item fetching failed at offset 0/1 [ 145.949453][ T4069] hid-generic: probe of 0005:04F3:06E6.0003 failed with error -22 [ 146.029926][ T6009] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 146.040740][ T6009] team0: Failed to send options change via netlink (err -105) [ 146.042714][ T6009] team0: Port device geneve0 added [ 146.525981][ T6038] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 146.825320][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 147.019293][ T6072] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 147.844282][ T6078] tipc: Can't bind to reserved service type 2 [ 147.865311][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 147.870917][ T6080] device bridge0 entered promiscuous mode [ 147.873174][ T6079] device bridge0 left promiscuous mode [ 148.905321][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 149.113438][ T6109] loop4: detected capacity change from 0 to 512 [ 149.208362][ T6113] netlink: 4 bytes leftover after parsing attributes in process `syz.2.703'. [ 149.251899][ T6109] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 149.264330][ T6109] EXT4-fs (loop4): 1 truncate cleaned up [ 149.272222][ T6109] EXT4-fs (loop4): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 149.494688][ T6120] netlink: 28 bytes leftover after parsing attributes in process `syz.0.704'. [ 149.945198][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 150.985292][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 151.326687][ T6152] loop1: detected capacity change from 0 to 512 [ 151.410657][ T6165] netlink: 18132 bytes leftover after parsing attributes in process `syz.2.724'. [ 151.467674][ T6167] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 151.469643][ T6167] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 151.484475][ T6152] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 151.571303][ T6167] netlink: 12 bytes leftover after parsing attributes in process `syz.2.725'. [ 151.585897][ T6152] EXT4-fs (loop1): 1 truncate cleaned up [ 151.587489][ T6152] EXT4-fs (loop1): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 152.335952][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 153.203759][ T6187] device syzkaller1 entered promiscuous mode [ 153.385648][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 154.256687][ T6199] netlink: 8 bytes leftover after parsing attributes in process `syz.2.733'. [ 154.325824][ T6205] netlink: 'syz.2.733': attribute type 1 has an invalid length. [ 154.341014][ T6204] device vlan2 entered promiscuous mode [ 154.355395][ T6204] device wlan1 entered promiscuous mode [ 154.379839][ T6207] netlink: 8 bytes leftover after parsing attributes in process `syz.4.736'. [ 154.425288][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 155.465367][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 156.505376][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 156.590869][ T6240] netlink: 8 bytes leftover after parsing attributes in process `syz.2.748'. [ 157.545406][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 157.970316][ T6279] netlink: 'syz.0.761': attribute type 10 has an invalid length. [ 158.025747][ T6279] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 158.037905][ T6286] ieee802154 phy0 wpan0: encryption failed: -22 [ 158.232091][ T6296] netlink: 8 bytes leftover after parsing attributes in process `syz.2.769'. [ 158.585312][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 159.625355][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 159.843363][ T6340] netlink: 'syz.1.783': attribute type 1 has an invalid length. [ 159.874181][ T6340] 8021q: adding VLAN 0 to HW filter on device bond1 [ 159.954260][ T6340] bond1: (slave ip6gretap1): making interface the new active one [ 159.959766][ T6340] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 159.965535][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 159.973093][ T6344] netlink: 8 bytes leftover after parsing attributes in process `syz.2.784'. [ 160.014540][ T6340] device vlan3 entered promiscuous mode [ 160.016354][ T6340] device bond1 entered promiscuous mode [ 160.018046][ T6340] device ip6gretap1 entered promiscuous mode [ 160.275395][ T5033] Bluetooth: hci4: command 0x0405 tx timeout [ 160.665289][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 161.174848][ T6361] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 161.187533][ T6361] netlink: 16 bytes leftover after parsing attributes in process `syz.2.788'. [ 161.216402][ T6361] netlink: 12 bytes leftover after parsing attributes in process `syz.2.788'. [ 161.705253][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 161.887884][ T6378] ax25_connect(): syz.2.798 uses autobind, please contact jreuter@yaina.de [ 162.146303][ T6384] netlink: 44 bytes leftover after parsing attributes in process `syz.2.799'. [ 162.474438][ T6393] netlink: 'syz.2.801': attribute type 3 has an invalid length. [ 162.495516][ T6395] loop4: detected capacity change from 0 to 512 [ 162.577491][ T6395] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 162.623535][ T6395] EXT4-fs (loop4): 1 truncate cleaned up [ 162.625021][ T6395] EXT4-fs (loop4): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 162.745234][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 163.775690][ T6433] netlink: 8 bytes leftover after parsing attributes in process `syz.2.818'. [ 163.785256][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 163.788567][ T6431] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 163.871624][ T4316] Bluetooth: hci1: command 0x0406 tx timeout [ 163.873258][ T4316] Bluetooth: hci2: command 0x0406 tx timeout [ 163.882468][ T4316] Bluetooth: hci3: command 0x0406 tx timeout [ 163.968823][ T6436] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 163.972331][ T6439] loop1: detected capacity change from 0 to 512 [ 163.996809][ T6439] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 164.011239][ T6439] EXT4-fs (loop1): 1 truncate cleaned up [ 164.012763][ T6439] EXT4-fs (loop1): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 164.036475][ T6436] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 164.124820][ T6436] bond0 (unregistering): Released all slaves [ 164.825242][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 165.022178][ T6440] netlink: 'syz.3.821': attribute type 1 has an invalid length. [ 165.246800][ T6462] loop2: detected capacity change from 0 to 512 [ 165.273636][ T6464] netlink: 12 bytes leftover after parsing attributes in process `syz.1.825'. [ 165.289137][ T6462] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 165.306178][ T6464] netlink: 12 bytes leftover after parsing attributes in process `syz.1.825'. [ 165.310318][ T6462] EXT4-fs (loop2): 1 truncate cleaned up [ 165.311956][ T6462] EXT4-fs (loop2): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 165.865255][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 167.275618][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 167.391242][ T6497] loop4: detected capacity change from 0 to 512 [ 167.427713][ T6497] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 167.531047][ T6497] EXT4-fs (loop4): 1 truncate cleaned up [ 167.532647][ T6497] EXT4-fs (loop4): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 167.587803][ T6501] loop1: detected capacity change from 0 to 512 [ 168.243403][ T6501] EXT4-fs (loop1): mounted filesystem without journal. Opts: quota,barrier=0x0000000000001000,grpjquota=,norecovery,dioread_lock,,errors=continue. Quota mode: writeback. [ 168.345422][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 168.870562][ T6540] loop4: detected capacity change from 0 to 512 [ 168.944255][ T6540] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 168.984736][ T6540] EXT4-fs (loop4): 1 truncate cleaned up [ 168.987363][ T6540] EXT4-fs (loop4): mounted filesystem without journal. Opts: i_version,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,auto_da_alloc,errors=remount-ro,quota,. Quota mode: writeback. [ 169.202290][ T6550] udc-core: couldn't find an available UDC or it's busy [ 169.204094][ T6550] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 169.212439][ T6550] udc-core: couldn't find an available UDC or it's busy [ 169.214395][ T6550] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 169.230800][ T6550] udc-core: couldn't find an available UDC or it's busy [ 169.232771][ T6550] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 169.565447][ T6550] udc-core: couldn't find an available UDC or it's busy [ 169.567378][ T6550] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 169.645510][ T5033] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 169.855541][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 169.865443][ T6556] udc-core: couldn't find an available UDC or it's busy [ 169.867406][ T6556] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 169.961614][ T6558] udc-core: couldn't find an available UDC or it's busy [ 169.967791][ T6558] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 170.015339][ T5033] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 170.018526][ T5033] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 170.021090][ T5033] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 170.024173][ T5033] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 170.027652][ T5033] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.039333][ T5033] usb 1-1: config 0 descriptor?? [ 170.073093][ T6556] udc-core: couldn't find an available UDC or it's busy [ 170.076463][ T6556] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 170.267366][ T6399] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 41 vs 39667 free clusters [ 170.490459][ T6552] udc-core: couldn't find an available UDC or it's busy [ 170.492340][ T6552] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 170.509564][ T5033] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 170.533369][ T5033] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 170.646425][ T6572] udc-core: couldn't find an available UDC or it's busy [ 170.648235][ T6572] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 170.765371][ T6576] udc-core: couldn't find an available UDC or it's busy [ 170.767298][ T6576] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 170.845660][ C0] plantronics 0003:047F:FFFF.0004: hid_field_extract() called with n (132) > 32! (syz.1.831) [ 170.905441][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 171.051631][ T6552] udc-core: couldn't find an available UDC or it's busy [ 171.054246][ T6572] udc-core: couldn't find an available UDC or it's busy [ 171.056450][ T6572] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 171.060440][ T6552] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 171.067993][ T7] usb 1-1: USB disconnect, device number 2 [ 171.286473][ T6572] udc-core: couldn't find an available UDC or it's busy [ 171.288436][ T6572] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 171.291119][ T6572] udc-core: couldn't find an available UDC or it's busy [ 171.293076][ T6572] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 171.310319][ T6572] udc-core: couldn't find an available UDC or it's busy [ 171.330122][ T6572] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 171.363044][ T6572] udc-core: couldn't find an available UDC or it's busy [ 171.374907][ T6572] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 171.943550][ T6605] udc-core: couldn't find an available UDC or it's busy [ 171.945711][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 171.961139][ T6605] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 172.135206][ T21] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 173.849219][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 174.005448][ T21] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 174.007931][ T21] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.010245][ T21] usb 1-1: Product: syz [ 174.011351][ T21] usb 1-1: Manufacturer: syz [ 174.012602][ T21] usb 1-1: SerialNumber: syz [ 174.042042][ T21] usb 1-1: config 0 descriptor?? [ 174.334180][ T6639] udc-core: couldn't find an available UDC or it's busy [ 174.336367][ T6639] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 174.531632][ T21] usb 1-1: atusb_control_msg: req 0x21 val 0x0 idx 0x1e, error -71 [ 174.534112][ T21] usb 1-1: Firmware version (0.0) predates our first public release. [ 174.537047][ T21] usb 1-1: Please update to version 0.2 or newer [ 174.555296][ T21] usb 1-1: atusb_probe: initialization failed, error = -71 [ 174.557488][ T21] atusb: probe of 1-1:0.0 failed with error -71 [ 174.574324][ T21] usb 1-1: USB disconnect, device number 3 [ 174.906163][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 175.945564][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 176.504003][ T6657] udc-core: couldn't find an available UDC or it's busy [ 176.517759][ T6657] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 176.995219][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 177.415346][ T4316] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 177.450782][ T6686] udc-core: couldn't find an available UDC or it's busy [ 177.452797][ T6686] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 177.545695][ T6689] udc-core: couldn't find an available UDC or it's busy [ 177.550485][ T6689] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 177.558163][ T6689] udc-core: couldn't find an available UDC or it's busy [ 177.560405][ T6689] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 177.564753][ T6689] udc-core: couldn't find an available UDC or it's busy [ 177.567414][ T6689] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 177.685378][ T4316] usb 1-1: Using ep0 maxpacket: 8 [ 177.909307][ T4316] usb 1-1: config 1 interface 0 altsetting 2 bulk endpoint 0x1 has invalid maxpacket 8 [ 177.911849][ T4316] usb 1-1: config 1 interface 0 has no altsetting 0 [ 178.035272][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 178.615498][ T4316] usb 1-1: string descriptor 0 read error: -22 [ 178.617529][ T4316] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 178.619870][ T4316] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.645628][ T6677] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 178.899432][ T2475] usb 1-1: USB disconnect, device number 4 [ 178.936449][ T26] audit: type=1326 audit(178.910:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6712 comm="syz.4.914" exe="/root/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff994dfa68 code=0x0 [ 179.075266][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 179.221921][ T7] hid-generic 0005:0458:0009.0005: hidraw0: BLUETOOTH HID v0.09 Device [syz0] on aa:aa:aa:aa:aa:aa [ 180.078292][ T6739] udc-core: couldn't find an available UDC or it's busy [ 180.094769][ T6739] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 180.105329][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 181.145261][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 182.204632][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 182.483905][ T6765] udc-core: couldn't find an available UDC or it's busy [ 182.489626][ T6765] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 183.235375][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 184.612870][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 185.625265][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 185.901115][ T6808] capability: warning: `syz.4.946' uses 32-bit capabilities (legacy support in use) [ 186.639523][ T6814] udc-core: couldn't find an available UDC or it's busy [ 186.641418][ T6814] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 186.665376][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 186.665961][ T6814] udc-core: couldn't find an available UDC or it's busy [ 186.678146][ T6814] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 186.717797][ T6814] udc-core: couldn't find an available UDC or it's busy [ 186.719897][ T6814] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 187.715263][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 187.908118][ T6836] udc-core: couldn't find an available UDC or it's busy [ 187.910270][ T6836] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 188.740478][ T26] audit: type=1326 audit(188.300:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6833 comm="syz.1.959" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 188.766795][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 188.770745][ T26] audit: type=1326 audit(188.310:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6833 comm="syz.1.959" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 188.785356][ T26] audit: type=1326 audit(188.410:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6833 comm="syz.1.959" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=280 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 188.791084][ T26] audit: type=1326 audit(188.410:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6833 comm="syz.1.959" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 188.809144][ T26] audit: type=1326 audit(188.410:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6833 comm="syz.1.959" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 188.826838][ T26] audit: type=1326 audit(188.410:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6833 comm="syz.1.959" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=280 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 188.847567][ T26] audit: type=1326 audit(188.410:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6833 comm="syz.1.959" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 188.865199][ T26] audit: type=1326 audit(188.410:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6833 comm="syz.1.959" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 188.870914][ T26] audit: type=1326 audit(188.430:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6833 comm="syz.1.959" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=179 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 188.878023][ T26] audit: type=1326 audit(188.430:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6833 comm="syz.1.959" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff81991a68 code=0x7ffc0000 [ 189.023253][ T6845] netlink: 'syz.1.962': attribute type 4 has an invalid length. [ 189.785326][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 190.781552][ T6873] 9p: Unknown Cache mode fscacde [ 190.835263][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 191.166187][ T6882] netlink: 148 bytes leftover after parsing attributes in process `syz.2.974'. [ 191.916140][ T6884] xt_CT: You must specify a L4 protocol and not use inversions on it [ 192.379705][ T6785] Set syz1 is full, maxelem 65536 reached [ 192.475691][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 192.561075][ T2055] ieee802154 phy0 wpan0: encryption failed: -22 [ 192.743550][ T6901] netlink: 'syz.4.984': attribute type 1 has an invalid length. [ 192.746048][ T6901] netlink: 'syz.4.984': attribute type 2 has an invalid length. [ 192.752803][ T6902] udc-core: couldn't find an available UDC or it's busy [ 192.754596][ T6902] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 192.993509][ T6902] udc-core: couldn't find an available UDC or it's busy [ 192.995474][ T6902] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 193.545412][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 194.585211][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 195.175509][ T6963] udc-core: couldn't find an available UDC or it's busy [ 195.177778][ T6963] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 195.332242][ T6971] netlink: 'syz.0.1009': attribute type 1 has an invalid length. [ 195.409484][ T6971] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 195.492116][ T6971] 8021q: adding VLAN 0 to HW filter on device bond1 [ 195.510277][ T4114] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 195.527851][ T4114] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 195.615793][ T6971] device veth3 entered promiscuous mode [ 195.625694][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 195.637190][ T4231] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 196.916712][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 197.354637][ T6993] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1013'. [ 197.945474][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 198.173128][ T7009] netlink: 'syz.0.1020': attribute type 3 has an invalid length. [ 198.985382][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 199.257393][ T7019] udc-core: couldn't find an available UDC or it's busy [ 199.275290][ T7019] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 199.399011][ T7024] udc-core: couldn't find an available UDC or it's busy [ 199.401078][ T7024] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 199.597774][ T7027] x_tables: ip_tables: bpf.1 match: invalid size 528 (kernel) != (user) 536 [ 200.035277][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 200.719274][ T7044] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 200.824486][ T7047] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1035'. [ 201.043462][ T7057] process 'syz.3.1041' launched './file1' with NULL argv: empty string added [ 201.065268][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 201.126332][ T7061] x_tables: ip_tables: bpf.1 match: invalid size 528 (kernel) != (user) 536 [ 202.038111][ T7075] udc-core: couldn't find an available UDC or it's busy [ 202.049082][ T7075] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 202.105489][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 202.164777][ T7079] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1048'. [ 203.145212][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 203.649221][ T7097] netlink: 'syz.2.1055': attribute type 1 has an invalid length. [ 203.902317][ T7097] bond0: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 203.909350][ T7102] x_tables: ip_tables: bpf.1 match: invalid size 528 (kernel) != (user) 536 [ 203.954333][ T4443] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 203.959137][ T7097] 8021q: adding VLAN 0 to HW filter on device bond0 [ 203.961675][ T4106] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 203.981342][ T7097] device veth3 entered promiscuous mode [ 204.195293][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 204.267663][ T4106] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 204.312572][ T7113] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1059'. [ 205.167684][ T5033] Bluetooth: hci4: command 0x0407 tx timeout [ 205.225218][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 206.046642][ T7131] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1065'. [ 206.075383][ T7131] 8021q: adding VLAN 0 to HW filter on device bond2 [ 206.143232][ T7131] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 206.176606][ T4158] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 206.275285][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 206.296436][ T7141] bond2: (slave macvlan2): Error -95 calling set_mac_address [ 207.305246][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 207.758461][ T7156] netlink: 'syz.3.1073': attribute type 1 has an invalid length. [ 207.760531][ T7156] netlink: 'syz.3.1073': attribute type 2 has an invalid length. [ 208.146161][ T7167] mmap: syz.0.1074 (7167) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 208.345301][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 209.331989][ T7183] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1080'. [ 209.335595][ T7183] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1080'. [ 209.385230][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 209.548976][ T7190] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1083'. [ 209.619165][ T7192] x_tables: ip_tables: bpf.1 match: invalid size 528 (kernel) != (user) 536 [ 210.083899][ T7204] udc-core: couldn't find an available UDC or it's busy [ 210.105362][ T7204] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 210.131346][ T7204] udc-core: couldn't find an available UDC or it's busy [ 210.143803][ T7204] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 211.547957][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 212.065649][ T4065] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 212.137604][ T7225] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1096'. [ 212.234019][ T7230] loop2: detected capacity change from 0 to 512 [ 212.585426][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 214.295364][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 214.825274][ T4065] usb 1-1: device descriptor read/all, error -71 [ 215.305236][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 215.611298][ T7230] EXT4-fs warning (device loop2): ext4_multi_mount_protect:403: Unable to create kmmpd thread for loop2. [ 216.911165][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 217.955212][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 218.790901][ T7284] tmpfs: Unknown parameter 'usrquota' [ 218.959438][ T7289] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1114'. [ 218.972787][ T7291] netlink: 'syz.2.1115': attribute type 1 has an invalid length. [ 218.985265][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 219.002981][ T7291] 8021q: adding VLAN 0 to HW filter on device bond1 [ 220.610232][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 221.625434][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 221.680228][ T7332] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1127'. [ 222.675340][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 222.713316][ T7352] udc-core: couldn't find an available UDC or it's busy [ 222.731616][ T7352] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 223.578906][ T5033] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 223.835426][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 224.339980][ T7363] tipc: Enabling of bearer rejected, failed to enable media [ 224.905278][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 225.420106][ T5033] usb 1-1: config index 0 descriptor too short (expected 350, got 257) [ 226.119220][ T5033] usb 1-1: config 0 has an invalid interface number: 19 but max is 0 [ 226.119504][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 226.123015][ T5033] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.128000][ T5033] usb 1-1: config 0 has no interface number 0 [ 226.130772][ T5033] usb 1-1: New USB device found, idVendor=0c50, idProduct=2102, bcdDevice=7b.6e [ 226.134287][ T5033] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.173980][ T5033] usb 1-1: config 0 descriptor?? [ 226.195502][ T5033] usb 1-1: can't set config #0, error -71 [ 226.200471][ T5033] usb 1-1: USB disconnect, device number 7 [ 227.386091][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 227.603747][ T7400] netlink: 296 bytes leftover after parsing attributes in process `syz.1.1150'. [ 228.436881][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 229.475310][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 229.479787][ T2475] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 229.540853][ T7414] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1154'. [ 229.986314][ T2475] usb 1-1: config index 0 descriptor too short (expected 350, got 257) [ 229.988715][ T2475] usb 1-1: config 0 has an invalid interface number: 19 but max is 0 [ 229.990571][ T2475] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 229.993133][ T2475] usb 1-1: config 0 has no interface number 0 [ 230.010685][ T2475] usb 1-1: New USB device found, idVendor=0c50, idProduct=2102, bcdDevice=7b.6e [ 230.013067][ T2475] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.051400][ T2475] usb 1-1: config 0 descriptor?? [ 230.505274][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 231.346077][ T7438] netlink: 'syz.3.1162': attribute type 3 has an invalid length. [ 231.545256][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 231.880319][ T4158] Bluetooth: Error in BCSP hdr checksum [ 232.138235][ T4443] Bluetooth: Error in BCSP hdr checksum [ 232.365243][ T2475] usb 1-1: string descriptor 0 read error: -71 [ 232.373749][ T2475] usb 1-1: USB disconnect, device number 8 [ 232.595243][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 233.454926][ T7468] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1173'. [ 233.625228][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 233.650351][ T7474] netlink: 'syz.4.1175': attribute type 1 has an invalid length. [ 233.664144][ T5033] Bluetooth: hci5: command 0x1003 tx timeout [ 233.665985][ T144] Bluetooth: hci5: sending frame failed (-49) [ 233.693637][ T7474] bond3: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 233.708002][ T7474] 8021q: adding VLAN 0 to HW filter on device bond3 [ 233.709618][ T4158] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 233.713003][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): bond3: link becomes ready [ 234.246878][ T9] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 234.356088][ T7484] netlink: 'syz.4.1176': attribute type 1 has an invalid length. [ 235.268357][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 235.706126][ T5033] Bluetooth: hci5: command 0x1001 tx timeout [ 235.708902][ T144] Bluetooth: hci5: sending frame failed (-49) [ 236.355282][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 236.396448][ T7514] netlink: 'syz.1.1186': attribute type 3 has an invalid length. [ 237.217888][ T7519] netlink: 'syz.4.1187': attribute type 1 has an invalid length. [ 237.237752][ T7519] 8021q: adding VLAN 0 to HW filter on device bond5 [ 237.385272][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 237.618811][ T7530] netlink: 'syz.4.1192': attribute type 1 has an invalid length. [ 237.852097][ T5033] Bluetooth: hci5: command 0x1009 tx timeout [ 237.860333][ T7541] udc-core: couldn't find an available UDC or it's busy [ 237.862089][ T7541] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 238.435198][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 238.987673][ T7558] xt_TPROXY: Can be used only with -p tcp or -p udp [ 239.469522][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 240.515312][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 241.733638][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 242.755253][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 243.795287][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 244.205007][ T7626] netlink: 'syz.0.1219': attribute type 1 has an invalid length. [ 244.835245][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 246.448016][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 247.475247][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 247.688838][ T7670] netlink: 'syz.2.1234': attribute type 1 has an invalid length. [ 248.515292][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 249.555199][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 250.585401][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 250.830514][ T7692] device veth1_vlan left promiscuous mode [ 250.947462][ T7698] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1243'. [ 251.083115][ T7718] udc-core: couldn't find an available UDC or it's busy [ 251.086549][ T7718] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 251.799769][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 251.868705][ T7] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 252.014246][ T7735] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1256'. [ 252.825262][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 252.835375][ T7] usb 1-1: Using ep0 maxpacket: 32 [ 252.955294][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 252.958306][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 252.960722][ T7] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 252.970692][ T7] usb 1-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 252.973121][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 253.875357][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 253.976163][ T2055] ieee802154 phy0 wpan0: encryption failed: -22 [ 254.030506][ T7] usb 1-1: config 0 descriptor?? [ 254.060138][ T7] usb 1-1: can't set config #0, error -71 [ 254.062745][ T7] usb 1-1: USB disconnect, device number 9 [ 254.271731][ T7755] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 254.905262][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 255.945234][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 257.019570][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 257.077122][ T7776] udc-core: couldn't find an available UDC or it's busy [ 257.079026][ T7776] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 258.225602][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 259.756334][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 260.258880][ T7812] netlink: 'syz.4.1279': attribute type 1 has an invalid length. [ 260.307572][ T7812] 8021q: adding VLAN 0 to HW filter on device bond7 [ 260.361057][ T7812] bond7: (slave ip6gretap2): making interface the new active one [ 260.363848][ T7812] bond7: (slave ip6gretap2): Enslaving as an active interface with an up link [ 260.435494][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): bond7: link becomes ready [ 260.481407][ T7812] device vlan2 entered promiscuous mode [ 260.482954][ T7812] device bond7 entered promiscuous mode [ 260.484233][ T7812] device ip6gretap2 entered promiscuous mode [ 260.826096][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 261.865372][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 262.905320][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 263.673739][ T7839] netlink: 'syz.3.1287': attribute type 1 has an invalid length. [ 263.675916][ T7839] netlink: 'syz.3.1287': attribute type 2 has an invalid length. [ 263.762541][ T7846] udc-core: couldn't find an available UDC or it's busy [ 263.764372][ T7846] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 263.955266][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 264.995219][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 266.035299][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 267.265575][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 267.616238][ T7888] netlink: 'syz.3.1300': attribute type 1 has an invalid length. [ 267.698049][ T7884] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1299'. [ 267.852177][ T7891] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 268.065073][ T7900] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1302'. [ 268.345408][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 268.906049][ T7897] device veth3 entered promiscuous mode [ 269.523547][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 270.595407][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 272.021639][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 273.065257][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 274.105212][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 274.687766][ T7944] netlink: 'syz.1.1317': attribute type 1 has an invalid length. [ 275.015579][ T4065] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 275.155285][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 275.292958][ T4065] usb 1-1: device descriptor read/64, error -71 [ 275.690346][ T7944] bond2: (slave ip6gretap2): Enslaving as a backup interface with an up link [ 275.765317][ T4065] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 275.776571][ T7944] device veth3 entered promiscuous mode [ 276.185210][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 276.785091][ T4065] usb 1-1: device descriptor read/64, error -71 [ 276.961808][ T4065] usb usb1-port1: attempt power cycle [ 277.030223][ T7979] loop3: detected capacity change from 0 to 512 [ 277.192370][ T7980] xt_CT: You must specify a L4 protocol and not use inversions on it [ 277.225262][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 278.552944][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 278.825641][ T7979] EXT4-fs warning (device loop3): ext4_multi_mount_protect:403: Unable to create kmmpd thread for loop3. [ 279.676249][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 280.755315][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 280.987057][ T8011] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1337'. [ 281.785284][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 282.166802][ T8026] netlink: 'syz.2.1344': attribute type 1 has an invalid length. [ 283.249642][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 284.275311][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 284.296818][ T8055] netlink: 'syz.2.1350': attribute type 1 has an invalid length. [ 284.361724][ T8055] device veth5 entered promiscuous mode [ 284.583916][ T8068] netlink: 'syz.1.1357': attribute type 1 has an invalid length. [ 285.305469][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 286.157325][ T8086] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1363'. [ 286.345353][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 287.050166][ T8095] netlink: 'syz.1.1366': attribute type 1 has an invalid length. [ 287.154324][ T8095] 8021q: adding VLAN 0 to HW filter on device bond4 [ 287.196377][ T8095] device veth5 entered promiscuous mode [ 287.224351][ T8103] netlink: 'syz.0.1369': attribute type 1 has an invalid length. [ 287.395201][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 288.435253][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 289.465208][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 289.645289][ T8130] netlink: 'syz.0.1377': attribute type 8 has an invalid length. [ 290.515250][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 291.027276][ T8142] netlink: 'syz.4.1382': attribute type 1 has an invalid length. [ 291.702838][ T8146] 8021q: adding VLAN 0 to HW filter on device bond8 [ 291.769095][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 291.830745][ T8142] device veth3 entered promiscuous mode [ 291.832584][ T8149] netlink: 'syz.0.1383': attribute type 1 has an invalid length. [ 291.851794][ T8149] 8021q: adding VLAN 0 to HW filter on device bond5 [ 292.206711][ T8162] netlink: 'syz.2.1385': attribute type 3 has an invalid length. [ 292.530349][ T8152] chnl_net:caif_netlink_parms(): no params data found [ 292.835296][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 292.927708][ T8152] bridge0: port 1(bridge_slave_0) entered blocking state [ 292.935696][ T8152] bridge0: port 1(bridge_slave_0) entered disabled state [ 292.958204][ T8152] device bridge_slave_0 entered promiscuous mode [ 292.993608][ T8152] bridge0: port 2(bridge_slave_1) entered blocking state [ 293.009045][ T8152] bridge0: port 2(bridge_slave_1) entered disabled state [ 293.032457][ T8152] device bridge_slave_1 entered promiscuous mode [ 293.139493][ T8152] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 293.144027][ T8152] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 293.165321][ T4316] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 293.264319][ T8188] netlink: 'syz.4.1393': attribute type 1 has an invalid length. [ 293.330677][ T8188] 8021q: adding VLAN 0 to HW filter on device bond9 [ 293.336661][ T8152] team0: Port device team_slave_0 added [ 293.346564][ T8152] team0: Port device team_slave_1 added [ 293.390316][ T8152] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 293.394294][ T8152] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 293.416031][ T8152] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 293.420368][ T8152] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 293.422177][ T8152] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 293.556354][ T8152] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 293.575322][ T4316] usb 1-1: unable to get BOS descriptor or descriptor too short [ 293.645963][ T4316] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 293.648112][ T4316] usb 1-1: can't read configurations, error -71 [ 293.657711][ T8152] device hsr_slave_0 entered promiscuous mode [ 293.875240][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 293.945931][ T1534] Bluetooth: hci5: command 0x0409 tx timeout [ 294.435502][ T8152] device hsr_slave_1 entered promiscuous mode [ 294.476533][ T8152] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 294.479709][ T8152] Cannot create hsr debugfs directory [ 294.506478][ T8200] netlink: 'syz.4.1396': attribute type 1 has an invalid length. [ 294.569268][ T8204] 8021q: adding VLAN 0 to HW filter on device bond10 [ 294.572244][ T8207] netlink: 'syz.2.1397': attribute type 3 has an invalid length. [ 294.612314][ T8200] device veth5 entered promiscuous mode [ 294.916634][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 295.741105][ T8152] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 295.788522][ T8152] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 295.945278][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 295.974338][ T8224] netlink: 'syz.0.1403': attribute type 1 has an invalid length. [ 295.989135][ T8224] 8021q: adding VLAN 0 to HW filter on device bond6 [ 295.992665][ T8152] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 296.027014][ T8152] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 296.219991][ T8236] netlink: 'syz.0.1408': attribute type 3 has an invalid length. [ 296.254463][ T8152] 8021q: adding VLAN 0 to HW filter on device bond0 [ 296.266787][ T8152] 8021q: adding VLAN 0 to HW filter on device team0 [ 296.271952][ T7517] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 296.281669][ T7517] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 296.427824][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 296.431849][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 296.434549][ T1628] bridge0: port 1(bridge_slave_0) entered blocking state [ 296.436561][ T1628] bridge0: port 1(bridge_slave_0) entered forwarding state [ 296.459321][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 296.468938][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 296.483904][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 296.492778][ T1628] bridge0: port 2(bridge_slave_1) entered blocking state [ 296.494910][ T1628] bridge0: port 2(bridge_slave_1) entered forwarding state [ 296.505391][ T4069] Bluetooth: hci5: command 0x041b tx timeout [ 296.513244][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 296.523368][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 296.551205][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 296.559572][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 296.571375][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 296.586902][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 296.597235][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 296.607420][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 296.761394][ T8152] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 296.772332][ T8152] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 296.801066][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 296.804058][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 296.809890][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 296.995309][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 298.430992][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 298.586411][ T4098] Bluetooth: hci5: command 0x040f tx timeout [ 299.297664][ T8264] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1416'. [ 299.449705][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 299.452068][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 299.465530][ T8152] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 299.510195][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 299.565630][ T8275] netlink: 'syz.0.1418': attribute type 3 has an invalid length. [ 299.742791][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 299.753294][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 299.813908][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 299.817438][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 299.820773][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 299.825729][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 299.830229][ T8152] device veth0_vlan entered promiscuous mode [ 299.838941][ T8152] device veth1_vlan entered promiscuous mode [ 299.872993][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 299.876983][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 299.879739][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 299.883106][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 299.888344][ T8152] device veth0_macvtap entered promiscuous mode [ 299.893904][ T8152] device veth1_macvtap entered promiscuous mode [ 299.905076][ T8152] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 299.909455][ T8152] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 299.912160][ T8152] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 299.915000][ T8152] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 299.918634][ T8152] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 299.921570][ T8152] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 299.924169][ T8152] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 299.932087][ T8152] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 299.936480][ T8152] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 299.939758][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 299.942443][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 299.946707][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 299.951659][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 299.962237][ T8152] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 299.965082][ T8152] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 299.969871][ T8152] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 299.974835][ T8152] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 299.980342][ T8152] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 299.983211][ T8152] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 299.992753][ T8152] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 299.998676][ T8152] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.003912][ T8152] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 300.011957][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 300.014916][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 300.023830][ T8152] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.035770][ T8152] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.040719][ T8152] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.043134][ T8152] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.129285][ T1628] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 300.132709][ T1628] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 300.138915][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 300.183741][ T7992] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 300.280602][ T7992] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 300.308269][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 300.333966][ T8295] netlink: 'syz.4.1424': attribute type 1 has an invalid length. [ 300.585203][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 300.592064][ T8298] 8021q: adding VLAN 0 to HW filter on device bond11 [ 300.668449][ T4098] Bluetooth: hci5: command 0x0419 tx timeout [ 301.506351][ T8311] tipc: Started in network mode [ 301.507730][ T8311] tipc: Node identity 2a804116a374, cluster identity 4711 [ 301.509415][ T8311] tipc: Enabled bearer , priority 0 [ 301.547074][ T8311] +: renamed from syzkaller0 [ 301.625292][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 301.736117][ T8311] tipc: Disabling bearer [ 301.751837][ T8320] netlink: 'syz.2.1431': attribute type 3 has an invalid length. [ 302.675218][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 302.861975][ T8337] netlink: 'syz.5.1436': attribute type 1 has an invalid length. [ 302.932810][ T8342] device veth3 entered promiscuous mode [ 303.705266][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 304.090075][ T8364] netlink: 'syz.5.1444': attribute type 3 has an invalid length. [ 304.108618][ T8365] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1446'. [ 305.211763][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 305.421872][ T8377] netlink: 'syz.2.1450': attribute type 1 has an invalid length. [ 305.534935][ T8377] device veth7 entered promiscuous mode [ 305.553874][ T8382] 8021q: adding VLAN 0 to HW filter on device bond5 [ 306.265310][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 306.876314][ T8407] netlink: 'syz.5.1458': attribute type 3 has an invalid length. [ 307.633819][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 308.732802][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 309.364772][ T8444] udc-core: couldn't find an available UDC or it's busy [ 309.370238][ T8444] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 309.454781][ T8449] netlink: 'syz.0.1473': attribute type 3 has an invalid length. [ 309.525446][ T8455] netlink: 'syz.5.1476': attribute type 1 has an invalid length. [ 309.601776][ T8455] device veth5 entered promiscuous mode [ 309.795243][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 311.456507][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 311.461633][ T8461] bond0: (slave wlan1): Error: Device can not be enslaved while up [ 312.505228][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 313.170209][ T8481] udc-core: couldn't find an available UDC or it's busy [ 313.172104][ T8481] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 313.264605][ T8485] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1486'. [ 313.545272][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 314.668710][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 314.700184][ T8492] netlink: 'syz.0.1488': attribute type 3 has an invalid length. [ 314.830201][ T8502] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1491'. [ 314.878687][ T8507] netlink: 'syz.5.1494': attribute type 1 has an invalid length. [ 314.899040][ T8497] [U] w!tÁí— [ 315.601774][ T8516] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1497'. [ 315.656009][ T2055] ieee802154 phy0 wpan0: encryption failed: -22 [ 315.707083][ T8522] udc-core: couldn't find an available UDC or it's busy [ 315.712361][ T8522] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 315.715357][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 316.915481][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 317.072082][ T8535] netlink: 'syz.0.1503': attribute type 3 has an invalid length. [ 317.955333][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 318.661813][ T8553] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1511'. [ 318.985214][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 320.483408][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 320.551511][ T8576] netlink: 'syz.2.1516': attribute type 3 has an invalid length. [ 320.617732][ T8581] netlink: 'syz.2.1519': attribute type 1 has an invalid length. [ 320.644930][ T8586] udc-core: couldn't find an available UDC or it's busy [ 320.665272][ T8586] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 321.555358][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 321.876168][ T8611] netlink: 'syz.0.1530': attribute type 3 has an invalid length. [ 323.791572][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 323.818817][ T8613] udc-core: couldn't find an available UDC or it's busy [ 323.820651][ T8613] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 323.928759][ T8625] netlink: 'syz.1.1533': attribute type 1 has an invalid length. [ 324.650151][ T8641] udc-core: couldn't find an available UDC or it's busy [ 324.661619][ T8641] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 324.825243][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 325.957258][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 326.635685][ T8659] netlink: 'syz.4.1545': attribute type 3 has an invalid length. [ 326.985264][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 327.581171][ T8666] netlink: 'syz.2.1548': attribute type 1 has an invalid length. [ 328.035273][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 329.039269][ T8685] device veth9 entered promiscuous mode [ 329.075222][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 330.681600][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 331.705254][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 331.802979][ T8701] netlink: 'syz.4.1558': attribute type 3 has an invalid length. [ 333.540792][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 334.137151][ T8725] device veth7 entered promiscuous mode [ 334.229966][ T8735] netlink: 'syz.5.1569': attribute type 3 has an invalid length. [ 334.595316][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 336.128080][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 337.145361][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 337.415875][ T8773] netlink: 'syz.1.1580': attribute type 1 has an invalid length. [ 337.449404][ T8777] netlink: 'syz.2.1581': attribute type 3 has an invalid length. [ 337.583845][ T8781] udc-core: couldn't find an available UDC or it's busy [ 337.591564][ T8781] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 337.611520][ T8773] device veth9 entered promiscuous mode [ 338.854594][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 339.563398][ T8805] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 339.565374][ T8805] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 339.568720][ T8805] vhci_hcd vhci_hcd.0: Device attached [ 339.656204][ T8809] netlink: 'syz.1.1592': attribute type 3 has an invalid length. [ 339.765366][ T2475] vhci_hcd: vhci_device speed not set [ 339.835278][ T2475] usb 10-1: new full-speed USB device number 2 using vhci_hcd [ 339.875297][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 339.949055][ T8820] netlink: 'syz.5.1594': attribute type 1 has an invalid length. [ 340.013874][ T8820] device veth7 entered promiscuous mode [ 340.255314][ T8806] vhci_hcd: connection reset by peer [ 340.285628][ T4318] vhci_hcd: stop threads [ 340.287192][ T4318] vhci_hcd: release socket [ 340.289405][ T4318] vhci_hcd: disconnect device [ 340.397275][ T8810] chnl_net:caif_netlink_parms(): no params data found [ 340.905755][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 341.945215][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 342.537341][ T5033] Bluetooth: hci3: command 0x0409 tx timeout [ 342.567255][ T8810] bridge0: port 1(bridge_slave_0) entered blocking state [ 342.569271][ T8810] bridge0: port 1(bridge_slave_0) entered disabled state [ 342.571852][ T8810] device bridge_slave_0 entered promiscuous mode [ 342.586354][ T8810] bridge0: port 2(bridge_slave_1) entered blocking state [ 342.588198][ T8810] bridge0: port 2(bridge_slave_1) entered disabled state [ 342.636448][ T8810] device bridge_slave_1 entered promiscuous mode [ 342.701807][ T8852] netlink: 'syz.5.1602': attribute type 3 has an invalid length. [ 342.770903][ T8810] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 342.824315][ T8810] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 342.920738][ T8862] netlink: 'syz.4.1606': attribute type 1 has an invalid length. [ 342.985263][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 343.085011][ T8810] team0: Port device team_slave_0 added [ 343.165074][ T8810] team0: Port device team_slave_1 added [ 343.204133][ T8862] device veth7 entered promiscuous mode [ 343.347170][ T8810] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 343.351650][ T8810] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 343.409629][ T8810] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 343.421378][ T8810] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 343.433563][ T8810] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 343.450827][ T8810] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 343.667308][ T8810] device hsr_slave_0 entered promiscuous mode [ 343.731620][ T8810] device hsr_slave_1 entered promiscuous mode [ 343.767326][ T8810] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 343.769311][ T8810] Cannot create hsr debugfs directory [ 344.001294][ T8874] ieee802154 phy0 wpan0: encryption failed: -22 [ 344.036162][ C1] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 344.585454][ T5033] Bluetooth: hci3: command 0x041b tx timeout [ 345.102835][ T2475] vhci_hcd: vhci_device speed not set [ 346.359781][ T8810] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 346.414554][ T8810] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 346.597339][ T8810] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 346.639479][ T8763] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.668554][ T7] Bluetooth: hci3: command 0x040f tx timeout [ 346.673155][ T8810] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 346.804373][ T8810] 8021q: adding VLAN 0 to HW filter on device bond0 [ 346.821663][ T8810] 8021q: adding VLAN 0 to HW filter on device team0 [ 346.891004][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 346.894647][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 346.897421][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 346.945278][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 347.237059][ T8882] bridge0: port 1(bridge_slave_0) entered blocking state [ 347.238958][ T8882] bridge0: port 1(bridge_slave_0) entered forwarding state [ 347.626780][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 347.630567][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 347.632802][ T8882] bridge0: port 2(bridge_slave_1) entered blocking state [ 347.634414][ T8882] bridge0: port 2(bridge_slave_1) entered forwarding state [ 347.637109][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 347.639769][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 347.642409][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 347.645937][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 347.648795][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 347.651322][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 347.653638][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 347.657793][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 347.663065][ T8810] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 347.666626][ T8810] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 347.697948][ T8763] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.728056][ T8924] udc-core: couldn't find an available UDC or it's busy [ 347.729712][ T8924] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 347.886241][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 347.888772][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 347.892256][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 347.894827][ T8882] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 349.016139][ T4098] Bluetooth: hci3: command 0x0419 tx timeout [ 349.067751][ T8763] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.717248][ T8763] bond0: (slave netdevsim0): Releasing backup interface [ 350.759005][ T8763] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 351.037598][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 351.039977][ T1628] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 351.107208][ T8810] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 354.275648][ T8763] tipc: Disabling bearer [ 354.280601][ T8763] tipc: Left network mode [ 354.367100][ T8972] device veth9 entered promiscuous mode [ 354.396195][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 354.399075][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 354.473912][ T8980] udc-core: couldn't find an available UDC or it's busy [ 354.490013][ T8810] device veth0_vlan entered promiscuous mode [ 354.496472][ T8980] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 354.501581][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 354.504400][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 354.509537][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 354.517306][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 354.685353][ T8810] device veth1_vlan entered promiscuous mode [ 354.709269][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 356.035877][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 356.042345][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 356.066443][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 356.127612][ T8810] device veth0_macvtap entered promiscuous mode [ 356.131990][ T8810] device veth1_macvtap entered promiscuous mode [ 356.186356][ T8810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 356.189170][ T8810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 356.191653][ T8810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 356.225230][ T8810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 356.238029][ T8810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 356.240801][ T8810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 356.243216][ T8810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 356.345502][ T8810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 356.348387][ T8810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 356.355196][ T8810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 356.359212][ T8810] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 356.584193][ T8763] bond1: (slave ip6gretap1): Removing an active aggregator [ 356.587578][ T8882] bond1: Warning: Found an uninitialized port [ 356.605539][ T8763] bond1: (slave ip6gretap1): Releasing backup interface [ 357.391586][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 357.394456][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 357.428922][ T9000] udc-core: couldn't find an available UDC or it's busy [ 357.430844][ T9000] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 357.433509][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 357.467438][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 357.491333][ T8810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.494316][ T8810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.505264][ T8810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.508167][ T8810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.510750][ T8810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.513488][ T8810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.525159][ T8810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.527808][ T8810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.549464][ T9004] udc-core: couldn't find an available UDC or it's busy [ 357.551335][ T9004] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 357.555543][ T8810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.558201][ T8810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.561902][ T8810] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 357.589435][ T7480] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 357.592078][ T7480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 357.609239][ T8810] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.611520][ T8810] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.613790][ T8810] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.625645][ T8810] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.724415][ T4114] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.726926][ T4114] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.732577][ T4158] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 357.773604][ T4114] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.785450][ T4114] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.815258][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 358.932460][ T9025] device veth11 entered promiscuous mode [ 360.163533][ T9044] udc-core: couldn't find an available UDC or it's busy [ 360.178249][ T9044] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 361.786476][ T9063] hugetlbfs: syz.1.1652 (9063): Using mlock ulimits for SHM_HUGETLB is deprecated [ 362.726628][ T9074] tmpfs: Unknown parameter 'usrquota' [ 365.413560][ T9095] udc-core: couldn't find an available UDC or it's busy [ 365.429565][ T9095] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 365.478659][ T8763] device gretap0 left promiscuous mode [ 365.519245][ T8763] bond2: (slave gretap1): Releasing backup interface [ 365.576372][ T9101] device veth9 entered promiscuous mode [ 365.672288][ T9106] udc-core: couldn't find an available UDC or it's busy [ 365.712420][ T9106] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 367.349712][ T9126] xt_TPROXY: Can be used only with -p tcp or -p udp [ 368.543552][ T8763] bond0: (slave wlan1): Releasing backup interface [ 369.016697][ T8763] device hsr_slave_0 left promiscuous mode [ 369.055412][ T8763] device hsr_slave_1 left promiscuous mode [ 369.135809][ T8763] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 369.137866][ T8763] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 369.141072][ T8763] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 369.145787][ T8763] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 369.150645][ T8763] device bridge_slave_1 left promiscuous mode [ 369.156377][ T8763] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.209739][ T8763] device bridge_slave_0 left promiscuous mode [ 369.211774][ T8763] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.375771][ T8763] device veth1_macvtap left promiscuous mode [ 369.378012][ T8763] device veth0_macvtap left promiscuous mode [ 369.379714][ T8763] device veth1_vlan left promiscuous mode [ 369.381320][ T8763] device veth0_vlan left promiscuous mode [ 369.504433][ T9165] udc-core: couldn't find an available UDC or it's busy [ 369.510775][ T9165] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 370.732456][ T8763] bond6 (unregistering): Released all slaves [ 370.752066][ T8763] bond5 (unregistering): Released all slaves [ 370.771667][ T8763] bond4 (unregistering): Released all slaves [ 371.672952][ T8763] bond3 (unregistering): Released all slaves [ 371.704598][ T8763] bond2 (unregistering): Released all slaves [ 371.770421][ T8763] bond1 (unregistering): Released all slaves [ 372.351410][ T8763] team0 (unregistering): Port device team_slave_1 removed [ 372.413602][ T8763] team0 (unregistering): Port device team_slave_0 removed [ 372.433933][ T8763] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 372.582993][ T8763] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 373.261292][ T8763] bond0 (unregistering): Released all slaves [ 373.379380][ T9156] device veth11 entered promiscuous mode [ 374.634215][ T9223] udc-core: couldn't find an available UDC or it's busy [ 374.655294][ T9223] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 376.868606][ T9] Bluetooth: Error in BCSP hdr checksum [ 377.106894][ T2055] ieee802154 phy0 wpan0: encryption failed: -22 [ 377.125606][ T7480] Bluetooth: Error in BCSP hdr checksum [ 377.152194][ T9260] device veth13 entered promiscuous mode [ 377.292424][ T9275] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1702'. [ 378.675257][ T4115] Bluetooth: hci1: command 0x1003 tx timeout [ 378.686678][ T144] Bluetooth: hci1: sending frame failed (-49) [ 379.064946][ T9309] udc-core: couldn't find an available UDC or it's busy [ 379.073154][ T9309] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 379.179108][ T9311] device vlan2 entered promiscuous mode [ 379.180843][ T9311] device veth0_to_hsr entered promiscuous mode [ 381.142058][ T4115] Bluetooth: hci1: command 0x1001 tx timeout [ 381.144474][ T144] Bluetooth: hci1: sending frame failed (-49) [ 381.254581][ T9332] netlink: 'syz.6.1714': attribute type 1 has an invalid length. [ 381.398459][ T9341] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1715'. [ 382.650251][ T9380] udc-core: couldn't find an available UDC or it's busy [ 382.652435][ T9380] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 383.392533][ T4115] Bluetooth: hci6: command 0x1003 tx timeout [ 383.395422][ T9329] Bluetooth: hci6: sending frame failed (-49) [ 383.397514][ T4115] Bluetooth: hci1: command 0x1009 tx timeout [ 385.928483][ T21] Bluetooth: hci6: command 0x1001 tx timeout [ 385.930231][ T9329] Bluetooth: hci6: sending frame failed (-49) [ 385.967204][ T9403] tmpfs: Unknown parameter 'usrquota' [ 386.067593][ T9409] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1728'. [ 386.132794][ T9411] netlink: 'syz.4.1729': attribute type 1 has an invalid length. [ 386.239728][ T9412] 8021q: adding VLAN 0 to HW filter on device bond13 [ 388.003765][ T4115] Bluetooth: hci6: command 0x1009 tx timeout [ 395.436097][ T9519] udc-core: couldn't find an available UDC or it's busy [ 395.451601][ T9519] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 398.576481][ T9590] udc-core: couldn't find an available UDC or it's busy [ 398.578567][ T9590] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 398.582678][ T9590] udc-core: couldn't find an available UDC or it's busy [ 398.584443][ T9590] misc raw-gadget: fail, usb_gadget_probe_driver returned -19 [ 398.672886][ T9599] netlink: 256 bytes leftover after parsing attributes in process `syz.6.1771'. [ 398.679824][ T9599] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1771'. [ 398.744924][ T26] kauditd_printk_skb: 13 callbacks suppressed [ 398.744939][ T26] audit: type=1326 audit(398.709:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9579 comm="syz.4.1768" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff994dfa68 code=0x7ffc0000 [ 398.756658][ T26] audit: type=1326 audit(398.709:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9579 comm="syz.4.1768" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff994dfa68 code=0x7ffc0000 [ 398.771595][ T26] audit: type=1326 audit(398.709:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9579 comm="syz.4.1768" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=280 compat=0 ip=0xffff994dfa68 code=0x7ffc0000 [ 398.784171][ T26] audit: type=1326 audit(398.709:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9579 comm="syz.4.1768" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff994dfa68 code=0x7ffc0000 [ 398.796732][ T26] audit: type=1326 audit(398.709:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9579 comm="syz.4.1768" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff994dfa68 code=0x7ffc0000 [ 398.831992][ T26] audit: type=1326 audit(398.719:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9579 comm="syz.4.1768" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=280 compat=0 ip=0xffff994dfa68 code=0x7ffc0000 [ 398.853839][ T26] audit: type=1326 audit(398.719:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9579 comm="syz.4.1768" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff994dfa68 code=0x7ffc0000 [ 398.891278][ T26] audit: type=1326 audit(398.719:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9579 comm="syz.4.1768" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff994dfa68 code=0x7ffc0000 [ 398.908228][ T26] audit: type=1326 audit(398.719:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9579 comm="syz.4.1768" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=179 compat=0 ip=0xffff994dfa68 code=0x7ffc0000 [ 398.926120][ T26] audit: type=1326 audit(398.719:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9579 comm="syz.4.1768" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff994dfa68 code=0x7ffc0000 [ 398.974198][ T9605] ================================================================== [ 398.976786][ T9605] BUG: KASAN: use-after-free in ax25_dev_device_down+0x358/0x680 [ 398.978828][ T9605] Write of size 4 at addr ffff0000c79962b8 by task syz.6.1773/9605 [ 398.980899][ T9605] [ 398.981496][ T9605] CPU: 0 PID: 9605 Comm: syz.6.1773 Not tainted 5.15.178-syzkaller #0 [ 398.983706][ T9605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 398.986379][ T9605] Call trace: [ 398.987271][ T9605] dump_backtrace+0x0/0x530 [ 398.988440][ T9605] show_stack+0x2c/0x3c [ 398.989500][ T9605] dump_stack_lvl+0x108/0x170 [ 398.990791][ T9605] print_address_description+0x7c/0x3f0 [ 398.992215][ T9605] kasan_report+0x174/0x1e4 [ 398.993309][ T9605] kasan_check_range+0x274/0x2b4 [ 398.994404][ T9605] __kasan_check_write+0x44/0x54 [ 398.995542][ T9605] ax25_dev_device_down+0x358/0x680 [ 398.996759][ T9605] ax25_device_event+0x534/0x58c [ 398.998116][ T9605] raw_notifier_call_chain+0xd4/0x164 [ 398.999474][ T9605] __dev_notify_flags+0x2ac/0x534 [ 399.000710][ T9605] dev_change_flags+0xc8/0x154 [ 399.001978][ T9605] dev_ifsioc+0x140/0xfe4 [ 399.003025][ T9605] dev_ioctl+0x4e0/0xd3c [ 399.004224][ T9605] sock_do_ioctl+0x1dc/0x2dc [ 399.005431][ T9605] sock_ioctl+0x4f0/0x8ac [ 399.006614][ T9605] __arm64_sys_ioctl+0x14c/0x1c8 [ 399.007915][ T9605] invoke_syscall+0x98/0x2b8 [ 399.009185][ T9605] el0_svc_common+0x138/0x258 [ 399.010459][ T9605] do_el0_svc+0x58/0x14c [ 399.011598][ T9605] el0_svc+0x7c/0x1f0 [ 399.012690][ T9605] el0t_64_sync_handler+0x84/0xe4 [ 399.013956][ T9605] el0t_64_sync+0x1a0/0x1a4 [ 399.015169][ T9605] [ 399.015785][ T9605] Allocated by task 6431: [ 399.016872][ T9605] ____kasan_kmalloc+0xbc/0xfc [ 399.018170][ T9605] __kasan_kmalloc+0x10/0x1c [ 399.019394][ T9605] kmem_cache_alloc_trace+0x27c/0x47c [ 399.020835][ T9605] ax25_dev_device_up+0x5c/0x548 [ 399.022166][ T9605] ax25_device_event+0x500/0x58c [ 399.023451][ T9605] raw_notifier_call_chain+0xd4/0x164 [ 399.024812][ T9605] __dev_notify_flags+0x2ac/0x534 [ 399.026128][ T9605] dev_change_flags+0xc8/0x154 [ 399.027338][ T9605] dev_ifsioc+0x140/0xfe4 [ 399.028477][ T9605] dev_ioctl+0x4e0/0xd3c [ 399.029554][ T9605] sock_do_ioctl+0x1dc/0x2dc [ 399.030799][ T9605] sock_ioctl+0x4f0/0x8ac [ 399.031955][ T9605] __arm64_sys_ioctl+0x14c/0x1c8 [ 399.033277][ T9605] invoke_syscall+0x98/0x2b8 [ 399.034507][ T9605] el0_svc_common+0x138/0x258 [ 399.035745][ T9605] do_el0_svc+0x58/0x14c [ 399.036858][ T9605] el0_svc+0x7c/0x1f0 [ 399.037868][ T9605] el0t_64_sync_handler+0x84/0xe4 [ 399.039152][ T9605] el0t_64_sync+0x1a0/0x1a4 [ 399.040277][ T9605] [ 399.040871][ T9605] Freed by task 9605: [ 399.041883][ T9605] kasan_set_track+0x4c/0x84 [ 399.043074][ T9605] kasan_set_free_info+0x28/0x4c [ 399.044374][ T9605] ____kasan_slab_free+0x118/0x164 [ 399.045648][ T9605] __kasan_slab_free+0x18/0x28 [ 399.046875][ T9605] slab_free_freelist_hook+0x128/0x1ec [ 399.048300][ T9605] kfree+0x178/0x410 [ 399.049306][ T9605] ax25_dev_device_down+0x1b0/0x680 [ 399.050651][ T9605] ax25_device_event+0x534/0x58c [ 399.051887][ T9605] raw_notifier_call_chain+0xd4/0x164 [ 399.053240][ T9605] __dev_notify_flags+0x2ac/0x534 [ 399.054540][ T9605] dev_change_flags+0xc8/0x154 [ 399.055755][ T9605] dev_ifsioc+0x140/0xfe4 [ 399.056834][ T9605] dev_ioctl+0x4e0/0xd3c [ 399.057856][ T9605] sock_do_ioctl+0x1dc/0x2dc [ 399.058870][ T9605] sock_ioctl+0x4f0/0x8ac [ 399.059989][ T9605] __arm64_sys_ioctl+0x14c/0x1c8 [ 399.061334][ T9605] invoke_syscall+0x98/0x2b8 [ 399.062556][ T9605] el0_svc_common+0x138/0x258 [ 399.063743][ T9605] do_el0_svc+0x58/0x14c [ 399.064836][ T9605] el0_svc+0x7c/0x1f0 [ 399.065852][ T9605] el0t_64_sync_handler+0x84/0xe4 [ 399.067205][ T9605] el0t_64_sync+0x1a0/0x1a4 [ 399.068358][ T9605] [ 399.068992][ T9605] Last potentially related work creation: [ 399.070429][ T9605] kasan_save_stack+0x38/0x68 [ 399.071617][ T9605] kasan_record_aux_stack+0xd4/0x11c [ 399.073009][ T9605] insert_work+0x64/0x394 [ 399.074241][ T9605] __queue_work+0xb84/0x114c [ 399.075459][ T9605] rcu_work_rcufn+0x98/0xb4 [ 399.076577][ T9605] rcu_core+0x830/0x1b34 [ 399.077662][ T9605] rcu_core_si+0x10/0x1c [ 399.078784][ T9605] handle_softirqs+0x384/0xdbc [ 399.079990][ T9605] do_softirq+0xfc/0x1b0 [ 399.081087][ T9605] __local_bh_enable_ip+0x298/0x470 [ 399.082431][ T9605] _raw_spin_unlock_bh+0xf8/0x180 [ 399.083807][ T9605] batadv_nc_purge_paths+0x308/0x38c [ 399.085250][ T9605] batadv_nc_worker+0x2e4/0x580 [ 399.086530][ T9605] process_one_work+0x790/0x11b8 [ 399.087893][ T9605] worker_thread+0x910/0x1034 [ 399.089069][ T9605] kthread+0x37c/0x45c [ 399.090084][ T9605] ret_from_fork+0x10/0x20 [ 399.091307][ T9605] [ 399.091896][ T9605] Second to last potentially related work creation: [ 399.093605][ T9605] kasan_save_stack+0x38/0x68 [ 399.094862][ T9605] kasan_record_aux_stack+0xd4/0x11c [ 399.096273][ T9605] call_rcu+0x118/0xb40 [ 399.097346][ T9605] queue_rcu_work+0x88/0xdc [ 399.098584][ T9605] tcf_queue_work+0xd8/0xf0 [ 399.099798][ T9605] fw_change+0xd3c/0xfe0 [ 399.101024][ T9605] tc_new_tfilter+0xdb0/0x159c [ 399.102256][ T9605] rtnetlink_rcv_msg+0xae0/0xdac [ 399.103573][ T9605] netlink_rcv_skb+0x20c/0x3b8 [ 399.104780][ T9605] rtnetlink_rcv+0x28/0x38 [ 399.105870][ T9605] netlink_unicast+0x664/0x938 [ 399.107107][ T9605] netlink_sendmsg+0x844/0xb38 [ 399.108364][ T9605] ____sys_sendmsg+0x584/0x870 [ 399.109671][ T9605] ___sys_sendmsg+0x214/0x294 [ 399.110919][ T9605] __sys_sendmmsg+0x23c/0x648 [ 399.112163][ T9605] __arm64_sys_sendmmsg+0xa0/0xbc [ 399.113517][ T9605] invoke_syscall+0x98/0x2b8 [ 399.114705][ T9605] el0_svc_common+0x138/0x258 [ 399.116031][ T9605] do_el0_svc+0x58/0x14c [ 399.117113][ T9605] el0_svc+0x7c/0x1f0 [ 399.118199][ T9605] el0t_64_sync_handler+0x84/0xe4 [ 399.119550][ T9605] el0t_64_sync+0x1a0/0x1a4 [ 399.120780][ T9605] [ 399.121404][ T9605] The buggy address belongs to the object at ffff0000c7996200 [ 399.121404][ T9605] which belongs to the cache kmalloc-256 of size 256 [ 399.125024][ T9605] The buggy address is located 184 bytes inside of [ 399.125024][ T9605] 256-byte region [ffff0000c7996200, ffff0000c7996300) [ 399.128376][ T9605] The buggy address belongs to the page: [ 399.129652][ T9605] page:00000000e1e907f7 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107996 [ 399.132078][ T9605] head:00000000e1e907f7 order:1 compound_mapcount:0 [ 399.133549][ T9605] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 399.135416][ T9605] raw: 05ffc00000010200 fffffc00033d4f00 0000000c0000000c ffff0000c0002480 [ 399.137481][ T9605] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 399.139659][ T9605] page dumped because: kasan: bad access detected [ 399.141324][ T9605] [ 399.141916][ T9605] Memory state around the buggy address: [ 399.143353][ T9605] ffff0000c7996180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 399.145491][ T9605] ffff0000c7996200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 399.147608][ T9605] >ffff0000c7996280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 399.149712][ T9605] ^ [ 399.151194][ T9605] ffff0000c7996300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 399.153090][ T9605] ffff0000c7996380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 399.155138][ T9605] ================================================================== [ 399.157033][ T9605] Disabling lock debugging due to kernel taint [ 399.191152][ T9605] ------------[ cut here ]------------ [ 399.192681][ T9605] refcount_t: underflow; use-after-free. [ 399.194454][ T9605] WARNING: CPU: 0 PID: 9605 at lib/refcount.c:28 refcount_warn_saturate+0x1c8/0x20c [ 399.196861][ T9605] Modules linked in: [ 399.197997][ T9605] CPU: 0 PID: 9605 Comm: syz.6.1773 Tainted: G B 5.15.178-syzkaller #0 [ 399.200456][ T9605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 399.203046][ T9605] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 399.205167][ T9605] pc : refcount_warn_saturate+0x1c8/0x20c [ 399.206606][ T9605] lr : refcount_warn_saturate+0x1c8/0x20c [ 399.207902][ T9605] sp : ffff800020f77600 [ 399.208962][ T9605] x29: ffff800020f77600 x28: ffff800016df13c0 x27: 1fffe00018f32c42 [ 399.210959][ T9605] x26: ffff80001bc02000 x25: 1fffe0001a90e86d x24: dfff800000000000 [ 399.213060][ T9605] x23: 0000000000000001 x22: ffff0000c79962b8 x21: 0000000000000003 [ 399.215132][ T9605] x20: ffff0000c79962b8 x19: ffff800016fd0000 x18: 1fffe0003682eb8e [ 399.217294][ T9605] x17: 1fffe0003682eb8e x16: ffff800011b4e3fc x15: ffff800014c0fac0 [ 399.219242][ T9605] x14: ffff0001b4175c80 x13: ffff0001b4175c7c x12: 0000000000080000 [ 399.221239][ T9605] x11: 000000000005054b x10: ffff80002ceee000 x9 : 91f0ecf889022000 [ 399.223304][ T9605] x8 : 91f0ecf889022000 x7 : 0000000000000000 x6 : ffff80000826abe0 [ 399.225374][ T9605] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000085568c0 [ 399.227452][ T9605] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000026 [ 399.229487][ T9605] Call trace: [ 399.230308][ T9605] refcount_warn_saturate+0x1c8/0x20c [ 399.231727][ T9605] ax25_dev_device_down+0x52c/0x680 [ 399.233177][ T9605] ax25_device_event+0x534/0x58c [ 399.234556][ T9605] raw_notifier_call_chain+0xd4/0x164 [ 399.235903][ T9605] __dev_notify_flags+0x2ac/0x534 [ 399.237254][ T9605] dev_change_flags+0xc8/0x154 [ 399.238607][ T9605] dev_ifsioc+0x140/0xfe4 [ 399.239769][ T9605] dev_ioctl+0x4e0/0xd3c [ 399.240798][ T9605] sock_do_ioctl+0x1dc/0x2dc [ 399.241989][ T9605] sock_ioctl+0x4f0/0x8ac [ 399.243174][ T9605] __arm64_sys_ioctl+0x14c/0x1c8 [ 399.244335][ T9605] invoke_syscall+0x98/0x2b8 [ 399.245610][ T9605] el0_svc_common+0x138/0x258 [ 399.246786][ T9605] do_el0_svc+0x58/0x14c [ 399.247824][ T9605] el0_svc+0x7c/0x1f0 [ 399.248897][ T9605] el0t_64_sync_handler+0x84/0xe4 [ 399.250231][ T9605] el0t_64_sync+0x1a0/0x1a4 [ 399.251445][ T9605] irq event stamp: 1300 [ 399.252466][ T9605] hardirqs last enabled at (1299): [] kasan_quarantine_put+0xdc/0x204 [ 399.254895][ T9605] hardirqs last disabled at (1300): [] _raw_spin_lock_irqsave+0xfc/0x14c [ 399.257426][ T9605] softirqs last enabled at (1294): [] ax25_dev_device_down+0x168/0x680 [ 399.260081][ T9605] softirqs last disabled at (1292): [] ax25_dev_device_down+0x64/0x680 [ 399.262717][ T9605] ---[ end trace d54633122577c9ae ]---