last executing test programs: 8.037720777s ago: executing program 3 (id=26): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)=0x0) timer_settime(r3, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) readv(r1, &(0x7f0000000300)=[{&(0x7f0000000340)=""/113, 0x71}], 0x1) 7.899349364s ago: executing program 0 (id=27): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) socket(0x0, 0x800, 0x400) accept(0xffffffffffffffff, 0x0, 0x0) setpriority(0x2, 0xffffffffffffffff, 0x3) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(r1, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) 7.546246431s ago: executing program 0 (id=29): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(0xffffffffffffffff, 0x29, 0x37, 0x0, 0x8) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/asound/seq/clients\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000000280)={0x2020}, 0x2020) 7.112770468s ago: executing program 3 (id=30): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(r0, 0xc01c64ae, &(0x7f0000000a80)={0x0, 0x5, 0xffffffff, 0x200, 0x1, 0x2, 0x9}) 7.068156778s ago: executing program 2 (id=31): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) setxattr$trusted_overlay_upper(0x0, &(0x7f0000000540), &(0x7f0000001400)=ANY=[], 0xffd7, 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x19) 6.679046832s ago: executing program 3 (id=32): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) syz_usb_connect$uac1(0x0, 0xb1, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d010140010102030109029f0003010000000904000000010100000a24010000000201020d24060000030800000031ce21c798329740594c137d0000000c24020201010608000010000c2402000000030000000000092406000601000000092403000000000500092406050001", @ANYBLOB="a0"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000001000)=ANY=[], 0x0) syz_usb_control_io(r0, &(0x7f0000001380)={0x2c, 0x0, &(0x7f0000001180)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000440)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x83, 0x2, "d50f"}, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000cc0)={0x34, &(0x7f0000000b00)={0x40, 0x9, 0x2, "5ee4"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.588680947s ago: executing program 2 (id=33): syz_open_dev$usbmon(&(0x7f0000000280), 0x80000000000000, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe2(&(0x7f0000000000), 0x800) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x4, 0x0, 0x7fffffff}, 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CLEAR_HALT(r0, 0xc0105502, &(0x7f0000000300)={0x1, 0x1}) 5.608107791s ago: executing program 2 (id=34): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8f4dd086d0492082a6d0000000109021b0001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000280)={0x44, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000340)={0x1c, &(0x7f00000003c0)={0x20, 0xa, 0x1, '='}, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 4.298921s ago: executing program 1 (id=36): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x25dfdbfc, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x4, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x200000000000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@empty, 0x2, 0x2b}, 0xa, @in6=@local, 0x0, 0x4}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r1, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) 4.196031325s ago: executing program 1 (id=37): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'syz_tun\x00', 0x0}) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 4.038362933s ago: executing program 1 (id=38): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x3) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, 0x0, 0x0) write$P9_RSTATu(r3, &(0x7f0000001180)={0x23d, 0x7d, 0x0, {{0x500, 0xfc, 0x0, 0xfffffffa, {}, 0x1bac0000, 0x0, 0x0, 0x0, 0x25, '\x04no\xc8f\xc9}`\x99\x06\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x1d\xf6\xdb\x00\x00\x00\x00\x00\x00=\xd3\x00\x00\x00\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x17, '\xcf\xc2\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x0fX\x05\x02\xb6n\x00\xf3\x13\xf6\x00', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xd4\x89\xdad\x9a7\x00'}, 0x12c, 'odev-n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x05\x00\x00\x00\x00\x00\x00\x00\xc2g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x23d) 3.021307702s ago: executing program 1 (id=39): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000040)=@v2={0x2000000, [{0xfff, 0x200}, {0x8, 0x3d4}]}, 0x14, 0x1) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) 2.928041891s ago: executing program 0 (id=40): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x6, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0x3}]}}}}}}, 0x3a) 2.841605146s ago: executing program 1 (id=41): setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000280)=ANY=[@ANYBLOB="02000000010000000000000004000000000000001000ff000000000020"], 0x24, 0x0) 2.759741887s ago: executing program 0 (id=42): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendmmsg$sock(r0, &(0x7f0000000740)=[{{&(0x7f0000000080)=@phonet={0x23, 0x7, 0x0, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000840)=[@mark={{0x14, 0x1, 0x24, 0xff5}}], 0x18}}], 0x1, 0x0) 2.712092723s ago: executing program 1 (id=43): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000001f40)=ANY=[@ANYBLOB="120100004bec0220a20603008cb4010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000240)={0x20, 0x17, 0x1, "fe"}, 0x0, 0x0, 0x0, 0x0}) 2.683662043s ago: executing program 0 (id=44): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0xa0000) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r3, 0xc0145401, &(0x7f0000000040)={0x3, 0x1, 0x3, 0x0, 0xfffffff9}) 2.5710911s ago: executing program 3 (id=45): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$radio(&(0x7f0000000040), 0x3, 0x2) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f00000013c0)=0x80000000001, 0x4) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x40, 0x1d6844efefe48d79) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x84) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$FUSE_NOTIFY_STORE(r4, &(0x7f0000000240)=ANY=[@ANYBLOB='+\x00\x00\x00', @ANYRES32=r3], 0x2b) sendfile(r5, r3, 0x0, 0x4000000053d2) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x1413, 0x211}, 0x10}, 0x2}, 0x0) 1.940079513s ago: executing program 2 (id=46): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) readv(r0, &(0x7f00000002c0)=[{0x0}, {&(0x7f00000000c0)=""/32, 0x20}], 0x2) 1.880932903s ago: executing program 2 (id=47): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e2a, 0xffffffff, @mcast2, 0x9}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000200), 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x18, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_REPLY={0x4}]}, 0x18}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171, 0x0, 0x0, 0x3a}}], 0x400000000000172, 0x4001c00) 1.747404535s ago: executing program 0 (id=48): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket(0x10, 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVEDEF(r3, 0x0, 0x24048880) write(r2, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r2, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) 1.508083744s ago: executing program 3 (id=49): r0 = fsopen(&(0x7f0000000080)='rpc_pipefs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x8) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000040)='rpc_pipefs\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_dev$vim2m(0x0, 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000040)={0xa, 0x0, 0x3, 0x0, 0xfd}) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405668, &(0x7f00000000c0)={0x5, 0x3, 0x1, "0000087aba10fdfffffb05001400", 0x56555959}) socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000b00)=0x7) r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r3, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f00000013c0)={0x3, 0x2, 0x2, {0x5, @vbi={0xb5, 0x4, 0x3, 0x0, [0x0, 0x18000000], [0x8200, 0x1]}}, 0xe}) ioctl$VIDIOC_QBUF(r4, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x10, 0x0, {}, {0x0, 0x0, 0x0, 0x4, 0x0, 0x0, "001500"}, 0x0, 0x2, {}, 0x18603}) 943.658138ms ago: executing program 2 (id=50): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000280)="a0ece5c1b26d2776c71626fa95b6c04ccae878f25b7a3e5a2147ca7c2aa9d215fb7e3ed4199e246b2885086b6119593b3de57829c60be9dc0cce7b4db7060b175af4a888365d07feb3a681040fb0efe4fd4687568cdc731e9721ad8b1e42967938b5b476d9a2f7f12651a4dc5d93f42f4aa83d2e097d6ece891cb5ec0b16c873a7ef79eb6b501fc59d275eb38514f78ea48eefc0fa8770557434a04f880cacf62df3689f55", 0xa5}], 0x1}}], 0x1, 0x4040014) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4138ae84, &(0x7f0000000240)=@arm64={0x2, 0x21, 0xa2, '\x00', 0xd}) 0s ago: executing program 3 (id=51): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x22020600) sendmsg$inet(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvmsg$unix(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x12) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.17' (ED25519) to the list of known hosts. [ 69.437829][ T5820] cgroup: Unknown subsys name 'net' [ 69.568110][ T5820] cgroup: Unknown subsys name 'cpuset' [ 69.576902][ T5820] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 70.980247][ T5820] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.398829][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.406213][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 73.294889][ T5832] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 73.305086][ T5836] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 73.312984][ T5836] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 73.320972][ T5836] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 73.331142][ T5836] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 73.339608][ T5836] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 73.347370][ T5836] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 73.356488][ T5840] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 73.375297][ T5840] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 73.385280][ T5840] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 73.399553][ T5844] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 73.407738][ T5844] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 73.410394][ T5843] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 73.417281][ T5153] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 73.424098][ T5843] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 73.436637][ T5153] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 73.444814][ T5153] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 73.452432][ T5843] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 73.453524][ T5153] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 73.468170][ T5153] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 73.951863][ T5833] chnl_net:caif_netlink_parms(): no params data found [ 74.008205][ T5837] chnl_net:caif_netlink_parms(): no params data found [ 74.177489][ T5829] chnl_net:caif_netlink_parms(): no params data found [ 74.253720][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.261782][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.269268][ T5833] bridge_slave_0: entered allmulticast mode [ 74.277218][ T5833] bridge_slave_0: entered promiscuous mode [ 74.299957][ T5841] chnl_net:caif_netlink_parms(): no params data found [ 74.317301][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.324431][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.331957][ T5833] bridge_slave_1: entered allmulticast mode [ 74.339496][ T5833] bridge_slave_1: entered promiscuous mode [ 74.386348][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.393524][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.402383][ T5837] bridge_slave_0: entered allmulticast mode [ 74.409936][ T5837] bridge_slave_0: entered promiscuous mode [ 74.418367][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.425608][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.432882][ T5837] bridge_slave_1: entered allmulticast mode [ 74.440083][ T5837] bridge_slave_1: entered promiscuous mode [ 74.520358][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.543373][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.550896][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.558248][ T5829] bridge_slave_0: entered allmulticast mode [ 74.565709][ T5829] bridge_slave_0: entered promiscuous mode [ 74.581245][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.592429][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.604075][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.613510][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.620731][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.628264][ T5829] bridge_slave_1: entered allmulticast mode [ 74.635519][ T5829] bridge_slave_1: entered promiscuous mode [ 74.729245][ T5833] team0: Port device team_slave_0 added [ 74.749774][ T5837] team0: Port device team_slave_0 added [ 74.758354][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.771240][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.794788][ T5833] team0: Port device team_slave_1 added [ 74.800955][ T5841] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.808170][ T5841] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.815408][ T5841] bridge_slave_0: entered allmulticast mode [ 74.822981][ T5841] bridge_slave_0: entered promiscuous mode [ 74.832414][ T5837] team0: Port device team_slave_1 added [ 74.876734][ T5841] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.884203][ T5841] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.891452][ T5841] bridge_slave_1: entered allmulticast mode [ 74.899035][ T5841] bridge_slave_1: entered promiscuous mode [ 74.972394][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.979772][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.006678][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.019764][ T5829] team0: Port device team_slave_0 added [ 75.028158][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.035216][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.061260][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.074190][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.081944][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.108219][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.127823][ T5841] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.138517][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.145531][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.174672][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.194011][ T5829] team0: Port device team_slave_1 added [ 75.213615][ T5841] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.271400][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.278707][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.305374][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.318392][ T5841] team0: Port device team_slave_0 added [ 75.326242][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.333338][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.359822][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.396483][ T5841] team0: Port device team_slave_1 added [ 75.451245][ T5833] hsr_slave_0: entered promiscuous mode [ 75.458858][ T5833] hsr_slave_1: entered promiscuous mode [ 75.472419][ T5837] hsr_slave_0: entered promiscuous mode [ 75.478642][ T5153] Bluetooth: hci0: command tx timeout [ 75.486879][ T5837] hsr_slave_1: entered promiscuous mode [ 75.493094][ T5837] debugfs: 'hsr0' already exists in 'hsr' [ 75.498960][ T5837] Cannot create hsr debugfs directory [ 75.516281][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.523675][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.549633][ T5841] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.560238][ T5832] Bluetooth: hci2: command tx timeout [ 75.560269][ T5844] Bluetooth: hci3: command tx timeout [ 75.566006][ T5153] Bluetooth: hci1: command tx timeout [ 75.578082][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.585055][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.610993][ T5841] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.711589][ T5829] hsr_slave_0: entered promiscuous mode [ 75.718513][ T5829] hsr_slave_1: entered promiscuous mode [ 75.724681][ T5829] debugfs: 'hsr0' already exists in 'hsr' [ 75.730418][ T5829] Cannot create hsr debugfs directory [ 75.827783][ T5841] hsr_slave_0: entered promiscuous mode [ 75.834024][ T5841] hsr_slave_1: entered promiscuous mode [ 75.842217][ T5841] debugfs: 'hsr0' already exists in 'hsr' [ 75.848588][ T5841] Cannot create hsr debugfs directory [ 76.219037][ T5837] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 76.231280][ T5837] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 76.250567][ T5837] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 76.277899][ T5837] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 76.341132][ T5829] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 76.358550][ T5829] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 76.372766][ T5829] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 76.394859][ T5829] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 76.472028][ T5833] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 76.499617][ T5833] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 76.510708][ T5833] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 76.520710][ T5833] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 76.617541][ T5841] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 76.630075][ T5841] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 76.641417][ T5841] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 76.660810][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.673220][ T5841] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 76.717811][ T5837] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.746955][ T3507] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.754205][ T3507] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.777354][ T3507] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.784493][ T3507] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.840910][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.902085][ T5829] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.931218][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.938403][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.966583][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.973696][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.042908][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.058169][ T5841] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.127795][ T5833] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.157581][ T5841] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.181167][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.188382][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.226081][ T3507] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.233248][ T3507] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.253629][ T1093] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.260806][ T1093] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.310063][ T1093] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.317246][ T1093] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.437310][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.558544][ T5153] Bluetooth: hci0: command tx timeout [ 77.560128][ T5837] veth0_vlan: entered promiscuous mode [ 77.583068][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.635069][ T5153] Bluetooth: hci3: command tx timeout [ 77.635932][ T5844] Bluetooth: hci1: command tx timeout [ 77.640502][ T5153] Bluetooth: hci2: command tx timeout [ 77.660748][ T5837] veth1_vlan: entered promiscuous mode [ 77.710746][ T5829] veth0_vlan: entered promiscuous mode [ 77.759185][ T5829] veth1_vlan: entered promiscuous mode [ 77.826561][ T5837] veth0_macvtap: entered promiscuous mode [ 77.847688][ T5837] veth1_macvtap: entered promiscuous mode [ 77.880500][ T5829] veth0_macvtap: entered promiscuous mode [ 77.910778][ T5829] veth1_macvtap: entered promiscuous mode [ 77.942461][ T5841] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.958137][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.972330][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.985787][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.998273][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.017833][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.038686][ T36] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.048527][ T36] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.080588][ T3507] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.095895][ T3507] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.107824][ T3507] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.129946][ T3507] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.138741][ T3507] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.163812][ T3507] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.212087][ T5841] veth0_vlan: entered promiscuous mode [ 78.261678][ T5841] veth1_vlan: entered promiscuous mode [ 78.288547][ T5833] veth0_vlan: entered promiscuous mode [ 78.343659][ T5833] veth1_vlan: entered promiscuous mode [ 78.353257][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.367237][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.408709][ T1093] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.419286][ T1093] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.428793][ T5833] veth0_macvtap: entered promiscuous mode [ 78.452406][ T5841] veth0_macvtap: entered promiscuous mode [ 78.472549][ T5833] veth1_macvtap: entered promiscuous mode [ 78.490590][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.493476][ T5841] veth1_macvtap: entered promiscuous mode [ 78.505217][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.553271][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.567850][ T1093] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.578739][ T1093] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.603354][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.613762][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.633977][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.644223][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.670793][ T5837] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 78.671282][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.705711][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.721096][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.805157][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.813925][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.885021][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.969193][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.153081][ T1093] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.177275][ T1093] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.236547][ T979] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 79.241239][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.263040][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.329605][ T3507] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.341840][ T3507] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.412824][ T979] usb 4-1: config 8 has an invalid interface number: 223 but max is 0 [ 79.437950][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.440719][ T979] usb 4-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 79.446062][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.470166][ T979] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 79.513949][ T979] usb 4-1: config 8 has no interface number 0 [ 79.529376][ T979] usb 4-1: config 8 interface 223 altsetting 0 endpoint 0x7 has invalid maxpacket 15872, setting to 64 [ 79.571643][ T979] usb 4-1: config 8 interface 223 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 79.620567][ T979] usb 4-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 79.636160][ T5153] Bluetooth: hci0: command tx timeout [ 79.642378][ T979] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.666299][ T979] usb 4-1: Product: syz [ 79.676420][ T979] usb 4-1: Manufacturer: syz [ 79.683668][ T979] usb 4-1: SerialNumber: syz [ 79.692358][ T5933] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 79.715075][ T5153] Bluetooth: hci1: command tx timeout [ 79.721286][ T5832] Bluetooth: hci3: command tx timeout [ 79.725682][ T5844] Bluetooth: hci2: command tx timeout [ 79.977439][ T979] usb 4-1: USB disconnect, device number 2 [ 80.386214][ T5949] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 80.514495][ T5948] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 80.854712][ T5835] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 81.005214][ T5835] usb 4-1: Using ep0 maxpacket: 8 [ 81.017126][ T5835] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 81.025644][ T5835] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 81.052868][ T5835] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 81.095164][ T5835] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 81.116927][ T5835] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 81.144751][ T5835] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 81.172466][ T5835] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.738057][ T5844] Bluetooth: hci0: command tx timeout [ 81.795309][ T5832] Bluetooth: hci3: command tx timeout [ 81.800938][ T5153] Bluetooth: hci1: command tx timeout [ 81.807309][ T5844] Bluetooth: hci2: command tx timeout [ 82.025769][ T5835] usb 4-1: GET_CAPABILITIES returned 0 [ 82.031442][ T5835] usbtmc 4-1:16.0: can't read capabilities [ 82.061031][ T5835] usb 4-1: USB disconnect, device number 3 [ 82.267032][ T5962] capability: warning: `syz.2.16' uses deprecated v2 capabilities in a way that may be insecure [ 84.196678][ T0] NOHZ tick-stop error: local softirq work is pending, handler #208!!! [ 84.416769][ T5926] libceph: connect (1)[c::]:6789 error -101 [ 84.432756][ T5926] libceph: mon0 (1)[c::]:6789 connect error [ 84.460859][ T5993] ceph: No mds server is up or the cluster is laggy [ 84.940810][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 85.165021][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 85.295391][ T0] NOHZ tick-stop error: local softirq work is pending, handler #280!!! [ 85.554773][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 85.564234][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 85.700329][ T6013] usb usb8: usbfs: process 6013 (syz.2.33) did not claim interface 0 before use [ 85.774899][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 85.854930][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 85.964907][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 86.169293][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 86.194771][ T24] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 86.416877][ T24] usb 4-1: config 0 has no interfaces? [ 86.422614][ T24] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 86.434441][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.456984][ T24] usb 4-1: config 0 descriptor?? [ 86.676265][ T6010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 86.688677][ T6010] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.704221][ T5926] usb 4-1: USB disconnect, device number 4 [ 86.765337][ T2154] cfg80211: failed to load regulatory.db [ 86.795596][ T979] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 86.878843][ T5930] Set syz1 is full, maxelem 65536 reached [ 86.948204][ T979] usb 3-1: Using ep0 maxpacket: 8 [ 86.957902][ T979] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 86.969246][ T979] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 86.985738][ T979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.010161][ T979] usb 3-1: config 0 descriptor?? [ 87.025081][ T979] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 87.174948][ T2154] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 87.334687][ T2154] usb 4-1: Using ep0 maxpacket: 16 [ 87.341730][ T2154] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 87.352068][ T2154] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 87.365101][ T2154] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 1.40 [ 87.374204][ T2154] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.382352][ T2154] usb 4-1: Product: syz [ 87.387091][ T2154] usb 4-1: Manufacturer: syz [ 87.391717][ T2154] usb 4-1: SerialNumber: syz [ 87.814751][ T2154] usb 4-1: 0:2 : does not exist [ 88.343258][ T2154] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 88.370546][ T2154] usb 4-1: USB disconnect, device number 5 [ 89.089394][ T979] gspca_vc032x: reg_w err -110 [ 89.094269][ T979] vc032x 3-1:0.0: probe with driver vc032x failed with error -110 [ 89.190156][ T5845] udevd[5845]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 89.236018][ T6028] syz.0.40 uses obsolete (PF_INET,SOCK_PACKET) [ 89.273869][ T6030] evm: overlay not supported [ 89.963437][ T979] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 90.144737][ T979] usb 2-1: Using ep0 maxpacket: 32 [ 90.160924][ T5898] usb 3-1: USB disconnect, device number 2 [ 90.171741][ T979] usb 2-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 90.190625][ T979] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.216972][ T979] usb 2-1: Product: syz [ 90.221261][ T979] usb 2-1: Manufacturer: syz [ 90.229190][ T979] usb 2-1: SerialNumber: syz [ 90.239498][ T979] usb 2-1: config 0 descriptor?? [ 90.253204][ T979] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 91.825997][ T979] gspca_topro: Sensor cx0342 [ 92.145729][ T5837] [ 92.148089][ T5837] ============================================ [ 92.154222][ T5837] WARNING: possible recursive locking detected [ 92.160358][ T5837] 6.16.0-rc4-next-20250702-syzkaller #0 Not tainted [ 92.166916][ T5837] -------------------------------------------- [ 92.173040][ T5837] syz-executor/5837 is trying to acquire lock: [ 92.179170][ T5837] ffff88805f90c8c8 (&sb->s_type->i_mutex_key#21){+.+.}-{4:4}, at: rpc_close_pipes+0x10a/0x730 [ 92.189433][ T5837] [ 92.189433][ T5837] but task is already holding lock: [ 92.196774][ T5837] ffff88805f9091c8 (&sb->s_type->i_mutex_key#21){+.+.}-{4:4}, at: __simple_recursive_removal+0x190/0x510 [ 92.207976][ T5837] [ 92.207976][ T5837] other info that might help us debug this: [ 92.216020][ T5837] Possible unsafe locking scenario: [ 92.216020][ T5837] [ 92.223472][ T5837] CPU0 [ 92.226731][ T5837] ---- [ 92.229997][ T5837] lock(&sb->s_type->i_mutex_key#21); [ 92.235451][ T5837] lock(&sb->s_type->i_mutex_key#21); [ 92.240894][ T5837] [ 92.240894][ T5837] *** DEADLOCK *** [ 92.240894][ T5837] [ 92.249015][ T5837] May be due to missing lock nesting notation [ 92.249015][ T5837] [ 92.257313][ T5837] 4 locks held by syz-executor/5837: [ 92.262574][ T5837] #0: ffff88807a6140e0 (&type->s_umount_key#59){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 [ 92.272741][ T5837] #1: ffff8880335800a0 (&sn->pipefs_sb_lock){+.+.}-{4:4}, at: rpc_kill_sb+0x77/0x190 [ 92.282288][ T5837] #2: ffffffff8f8e2df0 ((rpc_pipefs_notifier_list).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90 [ 92.294358][ T5837] #3: ffff88805f9091c8 (&sb->s_type->i_mutex_key#21){+.+.}-{4:4}, at: __simple_recursive_removal+0x190/0x510 [ 92.305998][ T5837] [ 92.305998][ T5837] stack backtrace: [ 92.311884][ T5837] CPU: 0 UID: 0 PID: 5837 Comm: syz-executor Not tainted 6.16.0-rc4-next-20250702-syzkaller #0 PREEMPT(full) [ 92.311900][ T5837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 92.311914][ T5837] Call Trace: [ 92.311919][ T5837] [ 92.311925][ T5837] dump_stack_lvl+0x189/0x250 [ 92.311942][ T5837] ? __pfx_dump_stack_lvl+0x10/0x10 [ 92.311955][ T5837] ? __pfx__printk+0x10/0x10 [ 92.311968][ T5837] ? print_lock_name+0xde/0x100 [ 92.311982][ T5837] print_deadlock_bug+0x28b/0x2a0 [ 92.311996][ T5837] validate_chain+0x1a3f/0x2140 [ 92.312015][ T5837] __lock_acquire+0xab9/0xd20 [ 92.312033][ T5837] ? rpc_close_pipes+0x10a/0x730 [ 92.312045][ T5837] lock_acquire+0x120/0x360 [ 92.312060][ T5837] ? rpc_close_pipes+0x10a/0x730 [ 92.312075][ T5837] down_write+0x96/0x1f0 [ 92.312091][ T5837] ? rpc_close_pipes+0x10a/0x730 [ 92.312102][ T5837] ? __pfx_down_write+0x10/0x10 [ 92.312117][ T5837] ? __pfx_find_submount+0x10/0x10 [ 92.312128][ T5837] ? _raw_spin_unlock+0x28/0x50 [ 92.312140][ T5837] ? d_walk+0x6f4/0x780 [ 92.312157][ T5837] rpc_close_pipes+0x10a/0x730 [ 92.312168][ T5837] ? d_invalidate+0x204/0x260 [ 92.312179][ T5837] ? __pfx_rpc_close_pipes+0x10/0x10 [ 92.312196][ T5837] ? up_write+0x1c4/0x420 [ 92.312209][ T5837] ? __pfx_rpc_close_pipes+0x10/0x10 [ 92.312220][ T5837] __simple_recursive_removal+0x208/0x510 [ 92.312235][ T5837] ? __pfx_rpc_close_pipes+0x10/0x10 [ 92.312247][ T5837] rpc_unlink+0x56/0x80 [ 92.312258][ T5837] rpc_pipefs_event+0xc0/0x170 [ 92.312275][ T5837] notifier_call_chain+0x1b3/0x3e0 [ 92.312290][ T5837] blocking_notifier_call_chain+0x6a/0x90 [ 92.312303][ T5837] rpc_kill_sb+0xd0/0x190 [ 92.312316][ T5837] deactivate_locked_super+0xb9/0x130 [ 92.312329][ T5837] cleanup_mnt+0x425/0x4c0 [ 92.312341][ T5837] ? lockdep_hardirqs_on+0x9c/0x150 [ 92.312356][ T5837] task_work_run+0x1d1/0x260 [ 92.312371][ T5837] ? __pfx_task_work_run+0x10/0x10 [ 92.312385][ T5837] ? __x64_sys_umount+0x122/0x160 [ 92.312400][ T5837] ? exit_to_user_mode_loop+0x40/0x110 [ 92.312417][ T5837] exit_to_user_mode_loop+0xec/0x110 [ 92.312433][ T5837] do_syscall_64+0x2bd/0x3b0 [ 92.312449][ T5837] ? lockdep_hardirqs_on+0x9c/0x150 [ 92.312463][ T5837] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.312475][ T5837] ? clear_bhb_loop+0x60/0xb0 [ 92.312487][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.312499][ T5837] RIP: 0033:0x7fa60398fc57 [ 92.312514][ T5837] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 92.312524][ T5837] RSP: 002b:00007ffd670099d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 92.312538][ T5837] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fa60398fc57 [ 92.312545][ T5837] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd67009a90 [ 92.312553][ T5837] RBP: 00007ffd67009a90 R08: 0000000000000000 R09: 0000000000000000 [ 92.312560][ T5837] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd6700ab20 [ 92.312568][ T5837] R13: 00007fa603a10925 R14: 00000000000167c5 R15: 00007ffd6700ab60 [ 92.312581][ T5837] [ 92.630642][ T979] usb 2-1: USB disconnect, device number 2