Warning: Permanently added '10.128.0.254' (ECDSA) to the list of known hosts. 2022/11/24 17:15:48 fuzzer started 2022/11/24 17:15:48 dialing manager at 10.128.0.169:38293 [ 72.435889][ T3633] cgroup: Unknown subsys name 'net' [ 72.541936][ T3633] cgroup: Unknown subsys name 'rlimit' 2022/11/24 17:15:49 syscalls: 3439 2022/11/24 17:15:49 code coverage: enabled 2022/11/24 17:15:49 comparison tracing: enabled 2022/11/24 17:15:49 extra coverage: enabled 2022/11/24 17:15:49 delay kcov mmap: enabled 2022/11/24 17:15:49 setuid sandbox: enabled 2022/11/24 17:15:49 namespace sandbox: enabled 2022/11/24 17:15:49 Android sandbox: /sys/fs/selinux/policy does not exist 2022/11/24 17:15:49 fault injection: enabled 2022/11/24 17:15:49 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2022/11/24 17:15:49 net packet injection: enabled 2022/11/24 17:15:49 net device setup: enabled 2022/11/24 17:15:49 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/11/24 17:15:49 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/11/24 17:15:49 NIC VF setup: PCI device 0000:00:11.0 is not available 2022/11/24 17:15:49 USB emulation: enabled 2022/11/24 17:15:49 hci packet injection: enabled 2022/11/24 17:15:49 wifi device emulation: enabled 2022/11/24 17:15:49 802.15.4 emulation: enabled 2022/11/24 17:15:49 fetching corpus: 0, signal 0/2000 (executing program) 2022/11/24 17:15:49 fetching corpus: 50, signal 36484/40171 (executing program) 2022/11/24 17:15:49 fetching corpus: 100, signal 58632/63884 (executing program) 2022/11/24 17:15:50 fetching corpus: 148, signal 76843/83554 (executing program) 2022/11/24 17:15:50 fetching corpus: 197, signal 86698/94923 (executing program) 2022/11/24 17:15:50 fetching corpus: 247, signal 96071/105747 (executing program) 2022/11/24 17:15:51 fetching corpus: 296, signal 102914/113982 (executing program) 2022/11/24 17:15:51 fetching corpus: 345, signal 109175/121625 (executing program) 2022/11/24 17:15:51 fetching corpus: 394, signal 113022/126894 (executing program) 2022/11/24 17:15:51 fetching corpus: 444, signal 117815/133016 (executing program) 2022/11/24 17:15:52 fetching corpus: 493, signal 125302/141691 (executing program) 2022/11/24 17:15:52 fetching corpus: 541, signal 133334/150810 (executing program) 2022/11/24 17:15:52 fetching corpus: 590, signal 139861/158414 (executing program) 2022/11/24 17:15:52 fetching corpus: 640, signal 143960/163645 (executing program) [ 76.265931][ T1253] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.272485][ T1253] ieee802154 phy1 wpan1: encryption failed: -22 2022/11/24 17:15:53 fetching corpus: 690, signal 148542/169352 (executing program) 2022/11/24 17:15:53 fetching corpus: 739, signal 153524/175399 (executing program) 2022/11/24 17:15:53 fetching corpus: 789, signal 157284/180260 (executing program) 2022/11/24 17:15:53 fetching corpus: 838, signal 161225/185311 (executing program) 2022/11/24 17:15:53 fetching corpus: 887, signal 165611/190633 (executing program) 2022/11/24 17:15:54 fetching corpus: 936, signal 169409/195459 (executing program) 2022/11/24 17:15:54 fetching corpus: 986, signal 172852/199964 (executing program) 2022/11/24 17:15:54 fetching corpus: 1036, signal 175274/203444 (executing program) 2022/11/24 17:15:54 fetching corpus: 1086, signal 179070/208179 (executing program) 2022/11/24 17:15:55 fetching corpus: 1136, signal 181247/211388 (executing program) 2022/11/24 17:15:55 fetching corpus: 1184, signal 183653/214808 (executing program) 2022/11/24 17:15:55 fetching corpus: 1234, signal 186458/218573 (executing program) 2022/11/24 17:15:55 fetching corpus: 1283, signal 189472/222506 (executing program) 2022/11/24 17:15:56 fetching corpus: 1333, signal 192799/226680 (executing program) 2022/11/24 17:15:56 fetching corpus: 1383, signal 195864/230584 (executing program) 2022/11/24 17:15:56 fetching corpus: 1432, signal 198705/234237 (executing program) 2022/11/24 17:15:56 fetching corpus: 1482, signal 202545/238783 (executing program) 2022/11/24 17:15:56 fetching corpus: 1532, signal 206834/243683 (executing program) 2022/11/24 17:15:57 fetching corpus: 1581, signal 209773/247347 (executing program) 2022/11/24 17:15:57 fetching corpus: 1631, signal 212242/250571 (executing program) 2022/11/24 17:15:57 fetching corpus: 1680, signal 215264/254296 (executing program) 2022/11/24 17:15:58 fetching corpus: 1726, signal 217415/257223 (executing program) 2022/11/24 17:15:58 fetching corpus: 1776, signal 219966/260502 (executing program) 2022/11/24 17:15:58 fetching corpus: 1826, signal 221596/263007 (executing program) 2022/11/24 17:15:58 fetching corpus: 1875, signal 223610/265794 (executing program) 2022/11/24 17:15:58 fetching corpus: 1925, signal 226138/268973 (executing program) 2022/11/24 17:15:59 fetching corpus: 1975, signal 228369/271938 (executing program) 2022/11/24 17:15:59 fetching corpus: 2024, signal 230403/274708 (executing program) 2022/11/24 17:15:59 fetching corpus: 2074, signal 232015/277075 (executing program) 2022/11/24 17:15:59 fetching corpus: 2124, signal 233709/279521 (executing program) 2022/11/24 17:16:00 fetching corpus: 2174, signal 235919/282394 (executing program) 2022/11/24 17:16:00 fetching corpus: 2224, signal 237537/284728 (executing program) 2022/11/24 17:16:00 fetching corpus: 2274, signal 240552/288182 (executing program) 2022/11/24 17:16:00 fetching corpus: 2323, signal 241817/290224 (executing program) 2022/11/24 17:16:00 fetching corpus: 2373, signal 243817/292829 (executing program) 2022/11/24 17:16:01 fetching corpus: 2422, signal 246197/295693 (executing program) 2022/11/24 17:16:01 fetching corpus: 2471, signal 247438/297619 (executing program) 2022/11/24 17:16:01 fetching corpus: 2521, signal 249103/299931 (executing program) 2022/11/24 17:16:01 fetching corpus: 2567, signal 250554/302057 (executing program) 2022/11/24 17:16:02 fetching corpus: 2617, signal 252172/304307 (executing program) 2022/11/24 17:16:02 fetching corpus: 2667, signal 253557/306324 (executing program) 2022/11/24 17:16:02 fetching corpus: 2717, signal 255865/309103 (executing program) 2022/11/24 17:16:02 fetching corpus: 2766, signal 257313/311159 (executing program) 2022/11/24 17:16:03 fetching corpus: 2816, signal 258508/313047 (executing program) [ 86.504986][ T14] cfg80211: failed to load regulatory.db 2022/11/24 17:16:03 fetching corpus: 2866, signal 259996/315091 (executing program) 2022/11/24 17:16:03 fetching corpus: 2915, signal 262455/317882 (executing program) 2022/11/24 17:16:04 fetching corpus: 2964, signal 263633/319702 (executing program) 2022/11/24 17:16:04 fetching corpus: 3014, signal 265433/322001 (executing program) 2022/11/24 17:16:04 fetching corpus: 3064, signal 267325/324290 (executing program) 2022/11/24 17:16:04 fetching corpus: 3113, signal 268449/326062 (executing program) 2022/11/24 17:16:04 fetching corpus: 3163, signal 269887/328060 (executing program) 2022/11/24 17:16:05 fetching corpus: 3213, signal 271395/330078 (executing program) 2022/11/24 17:16:05 fetching corpus: 3263, signal 272588/331847 (executing program) 2022/11/24 17:16:05 fetching corpus: 3310, signal 274018/333730 (executing program) 2022/11/24 17:16:05 fetching corpus: 3360, signal 275030/335341 (executing program) 2022/11/24 17:16:05 fetching corpus: 3410, signal 276049/336953 (executing program) 2022/11/24 17:16:06 fetching corpus: 3460, signal 277281/338704 (executing program) 2022/11/24 17:16:06 fetching corpus: 3510, signal 278844/340678 (executing program) 2022/11/24 17:16:06 fetching corpus: 3556, signal 280220/342517 (executing program) 2022/11/24 17:16:06 fetching corpus: 3605, signal 281562/344314 (executing program) 2022/11/24 17:16:07 fetching corpus: 3653, signal 282815/346034 (executing program) 2022/11/24 17:16:07 fetching corpus: 3703, signal 284431/347991 (executing program) 2022/11/24 17:16:07 fetching corpus: 3752, signal 286367/350172 (executing program) 2022/11/24 17:16:07 fetching corpus: 3800, signal 287529/351765 (executing program) 2022/11/24 17:16:08 fetching corpus: 3849, signal 289206/353672 (executing program) 2022/11/24 17:16:08 fetching corpus: 3899, signal 290949/355599 (executing program) 2022/11/24 17:16:08 fetching corpus: 3949, signal 292144/357208 (executing program) 2022/11/24 17:16:08 fetching corpus: 3999, signal 293716/359061 (executing program) 2022/11/24 17:16:09 fetching corpus: 4049, signal 294538/360397 (executing program) 2022/11/24 17:16:09 fetching corpus: 4099, signal 295641/361911 (executing program) 2022/11/24 17:16:09 fetching corpus: 4149, signal 297054/363626 (executing program) 2022/11/24 17:16:09 fetching corpus: 4199, signal 298236/365129 (executing program) 2022/11/24 17:16:09 fetching corpus: 4249, signal 299275/366575 (executing program) 2022/11/24 17:16:09 fetching corpus: 4298, signal 300456/368114 (executing program) 2022/11/24 17:16:10 fetching corpus: 4346, signal 301975/369852 (executing program) 2022/11/24 17:16:10 fetching corpus: 4396, signal 303021/371287 (executing program) 2022/11/24 17:16:10 fetching corpus: 4446, signal 303898/372631 (executing program) 2022/11/24 17:16:11 fetching corpus: 4496, signal 305332/374284 (executing program) 2022/11/24 17:16:11 fetching corpus: 4546, signal 306229/375593 (executing program) 2022/11/24 17:16:11 fetching corpus: 4596, signal 307699/377199 (executing program) 2022/11/24 17:16:11 fetching corpus: 4646, signal 308613/378532 (executing program) 2022/11/24 17:16:12 fetching corpus: 4695, signal 309676/379935 (executing program) 2022/11/24 17:16:12 fetching corpus: 4745, signal 310626/381235 (executing program) 2022/11/24 17:16:12 fetching corpus: 4795, signal 311389/382411 (executing program) 2022/11/24 17:16:12 fetching corpus: 4845, signal 312485/383817 (executing program) 2022/11/24 17:16:13 fetching corpus: 4894, signal 313324/385001 (executing program) 2022/11/24 17:16:13 fetching corpus: 4942, signal 314256/386272 (executing program) 2022/11/24 17:16:13 fetching corpus: 4991, signal 315157/387520 (executing program) 2022/11/24 17:16:13 fetching corpus: 5041, signal 316026/388757 (executing program) 2022/11/24 17:16:13 fetching corpus: 5090, signal 317364/390241 (executing program) 2022/11/24 17:16:14 fetching corpus: 5140, signal 318530/391558 (executing program) 2022/11/24 17:16:14 fetching corpus: 5190, signal 319435/392765 (executing program) 2022/11/24 17:16:14 fetching corpus: 5240, signal 320947/394295 (executing program) 2022/11/24 17:16:14 fetching corpus: 5290, signal 321781/395429 (executing program) 2022/11/24 17:16:14 fetching corpus: 5339, signal 322826/396676 (executing program) 2022/11/24 17:16:14 fetching corpus: 5389, signal 323362/397668 (executing program) 2022/11/24 17:16:15 fetching corpus: 5439, signal 324316/398905 (executing program) 2022/11/24 17:16:15 fetching corpus: 5489, signal 324944/399945 (executing program) 2022/11/24 17:16:15 fetching corpus: 5538, signal 325928/401174 (executing program) 2022/11/24 17:16:15 fetching corpus: 5588, signal 326667/402180 (executing program) 2022/11/24 17:16:16 fetching corpus: 5638, signal 327700/403425 (executing program) 2022/11/24 17:16:16 fetching corpus: 5688, signal 328499/404513 (executing program) 2022/11/24 17:16:16 fetching corpus: 5737, signal 329210/405546 (executing program) 2022/11/24 17:16:16 fetching corpus: 5787, signal 330120/406650 (executing program) 2022/11/24 17:16:17 fetching corpus: 5837, signal 331087/407827 (executing program) 2022/11/24 17:16:17 fetching corpus: 5886, signal 331834/408876 (executing program) 2022/11/24 17:16:17 fetching corpus: 5935, signal 332846/410052 (executing program) 2022/11/24 17:16:17 fetching corpus: 5985, signal 333869/411252 (executing program) 2022/11/24 17:16:17 fetching corpus: 6035, signal 334939/412412 (executing program) 2022/11/24 17:16:17 fetching corpus: 6084, signal 335934/413547 (executing program) 2022/11/24 17:16:18 fetching corpus: 6134, signal 337027/414713 (executing program) 2022/11/24 17:16:18 fetching corpus: 6184, signal 337843/415707 (executing program) 2022/11/24 17:16:18 fetching corpus: 6234, signal 338648/416709 (executing program) 2022/11/24 17:16:18 fetching corpus: 6284, signal 340025/417992 (executing program) 2022/11/24 17:16:18 fetching corpus: 6333, signal 341074/419075 (executing program) 2022/11/24 17:16:19 fetching corpus: 6381, signal 341913/420081 (executing program) 2022/11/24 17:16:19 fetching corpus: 6430, signal 342771/421092 (executing program) 2022/11/24 17:16:19 fetching corpus: 6480, signal 343629/422085 (executing program) 2022/11/24 17:16:20 fetching corpus: 6527, signal 344835/423235 (executing program) 2022/11/24 17:16:20 fetching corpus: 6577, signal 345341/424026 (executing program) 2022/11/24 17:16:20 fetching corpus: 6626, signal 346113/424952 (executing program) 2022/11/24 17:16:20 fetching corpus: 6676, signal 346823/425868 (executing program) 2022/11/24 17:16:20 fetching corpus: 6726, signal 347634/426808 (executing program) 2022/11/24 17:16:21 fetching corpus: 6776, signal 348614/427776 (executing program) 2022/11/24 17:16:21 fetching corpus: 6826, signal 349461/428678 (executing program) 2022/11/24 17:16:21 fetching corpus: 6875, signal 350499/429696 (executing program) 2022/11/24 17:16:21 fetching corpus: 6924, signal 351211/430602 (executing program) 2022/11/24 17:16:22 fetching corpus: 6972, signal 352095/431500 (executing program) 2022/11/24 17:16:22 fetching corpus: 7022, signal 352809/432374 (executing program) 2022/11/24 17:16:22 fetching corpus: 7072, signal 353547/433244 (executing program) 2022/11/24 17:16:22 fetching corpus: 7122, signal 354130/434071 (executing program) 2022/11/24 17:16:23 fetching corpus: 7171, signal 354729/434895 (executing program) 2022/11/24 17:16:23 fetching corpus: 7219, signal 355725/435829 (executing program) 2022/11/24 17:16:23 fetching corpus: 7268, signal 356729/436755 (executing program) 2022/11/24 17:16:23 fetching corpus: 7318, signal 357284/437520 (executing program) 2022/11/24 17:16:24 fetching corpus: 7368, signal 358279/438509 (executing program) 2022/11/24 17:16:24 fetching corpus: 7418, signal 359206/439373 (executing program) 2022/11/24 17:16:24 fetching corpus: 7468, signal 359973/440204 (executing program) 2022/11/24 17:16:24 fetching corpus: 7517, signal 360649/441044 (executing program) 2022/11/24 17:16:24 fetching corpus: 7567, signal 361641/441958 (executing program) 2022/11/24 17:16:25 fetching corpus: 7616, signal 362332/442687 (executing program) 2022/11/24 17:16:25 fetching corpus: 7664, signal 362849/443353 (executing program) 2022/11/24 17:16:25 fetching corpus: 7714, signal 363623/444160 (executing program) 2022/11/24 17:16:25 fetching corpus: 7764, signal 364388/444964 (executing program) 2022/11/24 17:16:25 fetching corpus: 7813, signal 365139/445701 (executing program) 2022/11/24 17:16:26 fetching corpus: 7863, signal 365750/446425 (executing program) 2022/11/24 17:16:26 fetching corpus: 7911, signal 366551/447205 (executing program) 2022/11/24 17:16:26 fetching corpus: 7960, signal 367380/448015 (executing program) 2022/11/24 17:16:26 fetching corpus: 8010, signal 368076/448798 (executing program) 2022/11/24 17:16:27 fetching corpus: 8059, signal 368849/449553 (executing program) 2022/11/24 17:16:27 fetching corpus: 8106, signal 369610/450292 (executing program) 2022/11/24 17:16:27 fetching corpus: 8155, signal 370328/451008 (executing program) 2022/11/24 17:16:27 fetching corpus: 8205, signal 371119/451751 (executing program) 2022/11/24 17:16:27 fetching corpus: 8254, signal 371772/452451 (executing program) 2022/11/24 17:16:28 fetching corpus: 8304, signal 372299/453125 (executing program) 2022/11/24 17:16:28 fetching corpus: 8354, signal 372683/453745 (executing program) 2022/11/24 17:16:28 fetching corpus: 8404, signal 373193/454371 (executing program) 2022/11/24 17:16:28 fetching corpus: 8454, signal 373872/455024 (executing program) 2022/11/24 17:16:28 fetching corpus: 8503, signal 374647/455723 (executing program) 2022/11/24 17:16:28 fetching corpus: 8553, signal 375277/456381 (executing program) 2022/11/24 17:16:29 fetching corpus: 8602, signal 375872/457074 (executing program) 2022/11/24 17:16:29 fetching corpus: 8651, signal 376323/457660 (executing program) 2022/11/24 17:16:29 fetching corpus: 8700, signal 377248/458394 (executing program) 2022/11/24 17:16:29 fetching corpus: 8748, signal 377851/458993 (executing program) 2022/11/24 17:16:29 fetching corpus: 8796, signal 378512/459669 (executing program) 2022/11/24 17:16:30 fetching corpus: 8843, signal 379300/460348 (executing program) 2022/11/24 17:16:30 fetching corpus: 8893, signal 380164/461057 (executing program) 2022/11/24 17:16:30 fetching corpus: 8943, signal 380614/461612 (executing program) 2022/11/24 17:16:30 fetching corpus: 8993, signal 381225/462197 (executing program) 2022/11/24 17:16:30 fetching corpus: 9042, signal 381914/462812 (executing program) 2022/11/24 17:16:31 fetching corpus: 9092, signal 382701/463440 (executing program) 2022/11/24 17:16:31 fetching corpus: 9142, signal 383259/464039 (executing program) 2022/11/24 17:16:31 fetching corpus: 9192, signal 383975/464650 (executing program) 2022/11/24 17:16:31 fetching corpus: 9242, signal 384880/465358 (executing program) 2022/11/24 17:16:31 fetching corpus: 9291, signal 385520/465913 (executing program) 2022/11/24 17:16:32 fetching corpus: 9340, signal 386082/466421 (executing program) 2022/11/24 17:16:32 fetching corpus: 9389, signal 386937/467042 (executing program) 2022/11/24 17:16:32 fetching corpus: 9439, signal 387450/467578 (executing program) 2022/11/24 17:16:32 fetching corpus: 9489, signal 388217/468141 (executing program) 2022/11/24 17:16:32 fetching corpus: 9539, signal 388687/468638 (executing program) 2022/11/24 17:16:33 fetching corpus: 9589, signal 389391/469224 (executing program) 2022/11/24 17:16:33 fetching corpus: 9638, signal 390241/469816 (executing program) 2022/11/24 17:16:33 fetching corpus: 9688, signal 390893/470341 (executing program) 2022/11/24 17:16:33 fetching corpus: 9738, signal 391910/470926 (executing program) 2022/11/24 17:16:34 fetching corpus: 9787, signal 392589/471447 (executing program) 2022/11/24 17:16:34 fetching corpus: 9835, signal 393265/471975 (executing program) 2022/11/24 17:16:34 fetching corpus: 9885, signal 393753/472446 (executing program) 2022/11/24 17:16:34 fetching corpus: 9934, signal 394455/472934 (executing program) 2022/11/24 17:16:34 fetching corpus: 9984, signal 395067/473430 (executing program) 2022/11/24 17:16:35 fetching corpus: 10034, signal 395640/473925 (executing program) 2022/11/24 17:16:35 fetching corpus: 10084, signal 396240/474407 (executing program) 2022/11/24 17:16:35 fetching corpus: 10134, signal 396709/474844 (executing program) 2022/11/24 17:16:35 fetching corpus: 10184, signal 397459/475342 (executing program) 2022/11/24 17:16:36 fetching corpus: 10233, signal 398110/475845 (executing program) 2022/11/24 17:16:36 fetching corpus: 10281, signal 399041/476363 (executing program) 2022/11/24 17:16:36 fetching corpus: 10331, signal 399615/476829 (executing program) 2022/11/24 17:16:36 fetching corpus: 10380, signal 400209/477274 (executing program) 2022/11/24 17:16:36 fetching corpus: 10430, signal 400803/477723 (executing program) 2022/11/24 17:16:36 fetching corpus: 10480, signal 401483/478226 (executing program) 2022/11/24 17:16:37 fetching corpus: 10530, signal 402182/478655 (executing program) 2022/11/24 17:16:37 fetching corpus: 10579, signal 402971/479120 (executing program) 2022/11/24 17:16:37 fetching corpus: 10628, signal 403471/479541 (executing program) 2022/11/24 17:16:37 fetching corpus: 10676, signal 404127/479965 (executing program) 2022/11/24 17:16:37 fetching corpus: 10725, signal 404679/480370 (executing program) 2022/11/24 17:16:38 fetching corpus: 10775, signal 405159/480787 (executing program) 2022/11/24 17:16:38 fetching corpus: 10824, signal 405805/481209 (executing program) 2022/11/24 17:16:38 fetching corpus: 10874, signal 406492/481603 (executing program) 2022/11/24 17:16:38 fetching corpus: 10924, signal 407026/482004 (executing program) 2022/11/24 17:16:38 fetching corpus: 10974, signal 407625/482385 (executing program) 2022/11/24 17:16:39 fetching corpus: 11024, signal 408083/482762 (executing program) 2022/11/24 17:16:39 fetching corpus: 11072, signal 408640/483158 (executing program) 2022/11/24 17:16:39 fetching corpus: 11122, signal 409284/483524 (executing program) 2022/11/24 17:16:40 fetching corpus: 11172, signal 409796/483889 (executing program) 2022/11/24 17:16:40 fetching corpus: 11222, signal 410370/484232 (executing program) 2022/11/24 17:16:40 fetching corpus: 11270, signal 410778/484594 (executing program) 2022/11/24 17:16:40 fetching corpus: 11320, signal 411457/484994 (executing program) 2022/11/24 17:16:41 fetching corpus: 11370, signal 412056/485324 (executing program) 2022/11/24 17:16:41 fetching corpus: 11419, signal 412606/485682 (executing program) 2022/11/24 17:16:41 fetching corpus: 11469, signal 413274/486048 (executing program) 2022/11/24 17:16:41 fetching corpus: 11519, signal 413742/486405 (executing program) 2022/11/24 17:16:42 fetching corpus: 11569, signal 414193/486730 (executing program) 2022/11/24 17:16:42 fetching corpus: 11619, signal 414812/487047 (executing program) 2022/11/24 17:16:42 fetching corpus: 11669, signal 415414/487359 (executing program) 2022/11/24 17:16:42 fetching corpus: 11718, signal 416016/487695 (executing program) 2022/11/24 17:16:42 fetching corpus: 11768, signal 416517/488007 (executing program) 2022/11/24 17:16:43 fetching corpus: 11818, signal 416873/488325 (executing program) 2022/11/24 17:16:43 fetching corpus: 11868, signal 417424/488625 (executing program) 2022/11/24 17:16:43 fetching corpus: 11917, signal 418298/488953 (executing program) 2022/11/24 17:16:43 fetching corpus: 11967, signal 418860/489240 (executing program) 2022/11/24 17:16:43 fetching corpus: 12016, signal 419294/489534 (executing program) 2022/11/24 17:16:43 fetching corpus: 12065, signal 419696/489793 (executing program) 2022/11/24 17:16:44 fetching corpus: 12115, signal 420187/489793 (executing program) 2022/11/24 17:16:44 fetching corpus: 12164, signal 420708/489796 (executing program) 2022/11/24 17:16:44 fetching corpus: 12214, signal 421111/489811 (executing program) 2022/11/24 17:16:44 fetching corpus: 12262, signal 421734/489811 (executing program) 2022/11/24 17:16:44 fetching corpus: 12312, signal 422259/489816 (executing program) 2022/11/24 17:16:45 fetching corpus: 12360, signal 422620/489831 (executing program) 2022/11/24 17:16:45 fetching corpus: 12410, signal 423098/489857 (executing program) 2022/11/24 17:16:45 fetching corpus: 12460, signal 423505/489857 (executing program) 2022/11/24 17:16:45 fetching corpus: 12509, signal 424127/489867 (executing program) 2022/11/24 17:16:45 fetching corpus: 12559, signal 424521/489867 (executing program) 2022/11/24 17:16:46 fetching corpus: 12608, signal 424948/489867 (executing program) 2022/11/24 17:16:46 fetching corpus: 12657, signal 425498/489867 (executing program) 2022/11/24 17:16:46 fetching corpus: 12707, signal 426005/489867 (executing program) 2022/11/24 17:16:46 fetching corpus: 12756, signal 426543/489867 (executing program) 2022/11/24 17:16:47 fetching corpus: 12806, signal 427075/489923 (executing program) 2022/11/24 17:16:47 fetching corpus: 12856, signal 427528/489938 (executing program) 2022/11/24 17:16:47 fetching corpus: 12906, signal 427954/489938 (executing program) 2022/11/24 17:16:47 fetching corpus: 12956, signal 428252/489938 (executing program) 2022/11/24 17:16:47 fetching corpus: 13006, signal 428844/489938 (executing program) 2022/11/24 17:16:48 fetching corpus: 13056, signal 429366/489943 (executing program) 2022/11/24 17:16:48 fetching corpus: 13106, signal 429888/489943 (executing program) 2022/11/24 17:16:48 fetching corpus: 13156, signal 430356/489943 (executing program) 2022/11/24 17:16:48 fetching corpus: 13206, signal 431159/489945 (executing program) 2022/11/24 17:16:48 fetching corpus: 13255, signal 431607/489948 (executing program) 2022/11/24 17:16:48 fetching corpus: 13305, signal 432066/489948 (executing program) 2022/11/24 17:16:49 fetching corpus: 13353, signal 432467/489948 (executing program) 2022/11/24 17:16:49 fetching corpus: 13403, signal 432879/489948 (executing program) 2022/11/24 17:16:49 fetching corpus: 13453, signal 433489/489950 (executing program) 2022/11/24 17:16:49 fetching corpus: 13502, signal 433840/489955 (executing program) 2022/11/24 17:16:50 fetching corpus: 13552, signal 434251/489974 (executing program) 2022/11/24 17:16:50 fetching corpus: 13602, signal 434624/489993 (executing program) 2022/11/24 17:16:50 fetching corpus: 13652, signal 435154/489993 (executing program) 2022/11/24 17:16:50 fetching corpus: 13702, signal 435701/489993 (executing program) 2022/11/24 17:16:50 fetching corpus: 13751, signal 436141/489993 (executing program) 2022/11/24 17:16:51 fetching corpus: 13799, signal 436554/489993 (executing program) 2022/11/24 17:16:51 fetching corpus: 13849, signal 436901/489993 (executing program) 2022/11/24 17:16:51 fetching corpus: 13899, signal 437604/490036 (executing program) 2022/11/24 17:16:51 fetching corpus: 13949, signal 437985/490038 (executing program) 2022/11/24 17:16:51 fetching corpus: 13999, signal 438342/490038 (executing program) 2022/11/24 17:16:52 fetching corpus: 14049, signal 438699/490040 (executing program) 2022/11/24 17:16:52 fetching corpus: 14099, signal 439188/490040 (executing program) 2022/11/24 17:16:52 fetching corpus: 14148, signal 439665/490040 (executing program) 2022/11/24 17:16:52 fetching corpus: 14198, signal 440092/490044 (executing program) 2022/11/24 17:16:52 fetching corpus: 14247, signal 440608/490044 (executing program) 2022/11/24 17:16:53 fetching corpus: 14297, signal 441108/490052 (executing program) 2022/11/24 17:16:53 fetching corpus: 14346, signal 441471/490056 (executing program) 2022/11/24 17:16:53 fetching corpus: 14396, signal 441885/490056 (executing program) 2022/11/24 17:16:54 fetching corpus: 14446, signal 442295/490056 (executing program) 2022/11/24 17:16:54 fetching corpus: 14496, signal 442645/490056 (executing program) 2022/11/24 17:16:54 fetching corpus: 14543, signal 443080/490056 (executing program) [ 137.715293][ T1253] ieee802154 phy0 wpan0: encryption failed: -22 [ 137.721664][ T1253] ieee802154 phy1 wpan1: encryption failed: -22 2022/11/24 17:16:54 fetching corpus: 14592, signal 443413/490071 (executing program) 2022/11/24 17:16:54 fetching corpus: 14641, signal 443854/490075 (executing program) 2022/11/24 17:16:55 fetching corpus: 14691, signal 444309/490075 (executing program) 2022/11/24 17:16:55 fetching corpus: 14738, signal 444912/490085 (executing program) 2022/11/24 17:16:55 fetching corpus: 14784, signal 445250/490085 (executing program) 2022/11/24 17:16:55 fetching corpus: 14832, signal 445714/490097 (executing program) 2022/11/24 17:16:56 fetching corpus: 14881, signal 446307/490117 (executing program) 2022/11/24 17:16:56 fetching corpus: 14930, signal 446780/490144 (executing program) 2022/11/24 17:16:56 fetching corpus: 14980, signal 447247/490144 (executing program) 2022/11/24 17:16:56 fetching corpus: 15029, signal 447760/490144 (executing program) 2022/11/24 17:16:57 fetching corpus: 15079, signal 448068/490157 (executing program) 2022/11/24 17:16:57 fetching corpus: 15129, signal 448632/490157 (executing program) 2022/11/24 17:16:57 fetching corpus: 15178, signal 449056/490188 (executing program) 2022/11/24 17:16:57 fetching corpus: 15228, signal 449512/490188 (executing program) 2022/11/24 17:16:58 fetching corpus: 15278, signal 449984/490188 (executing program) 2022/11/24 17:16:58 fetching corpus: 15328, signal 450300/490188 (executing program) 2022/11/24 17:16:58 fetching corpus: 15376, signal 450759/490204 (executing program) 2022/11/24 17:16:58 fetching corpus: 15426, signal 451122/490204 (executing program) 2022/11/24 17:16:58 fetching corpus: 15476, signal 451480/490204 (executing program) 2022/11/24 17:16:59 fetching corpus: 15525, signal 451933/490213 (executing program) 2022/11/24 17:16:59 fetching corpus: 15575, signal 452316/490213 (executing program) 2022/11/24 17:16:59 fetching corpus: 15625, signal 452664/490213 (executing program) 2022/11/24 17:16:59 fetching corpus: 15674, signal 452968/490214 (executing program) 2022/11/24 17:17:00 fetching corpus: 15724, signal 453285/490214 (executing program) 2022/11/24 17:17:00 fetching corpus: 15774, signal 453681/490223 (executing program) 2022/11/24 17:17:00 fetching corpus: 15824, signal 454138/490281 (executing program) 2022/11/24 17:17:01 fetching corpus: 15874, signal 454449/490281 (executing program) 2022/11/24 17:17:01 fetching corpus: 15924, signal 454873/490282 (executing program) 2022/11/24 17:17:01 fetching corpus: 15974, signal 455370/490282 (executing program) 2022/11/24 17:17:01 fetching corpus: 16024, signal 455761/490282 (executing program) 2022/11/24 17:17:01 fetching corpus: 16074, signal 456253/490282 (executing program) 2022/11/24 17:17:02 fetching corpus: 16124, signal 456686/490300 (executing program) 2022/11/24 17:17:02 fetching corpus: 16174, signal 456904/490312 (executing program) 2022/11/24 17:17:02 fetching corpus: 16224, signal 457204/490312 (executing program) 2022/11/24 17:17:02 fetching corpus: 16274, signal 457564/490312 (executing program) 2022/11/24 17:17:02 fetching corpus: 16324, signal 458037/490312 (executing program) 2022/11/24 17:17:02 fetching corpus: 16374, signal 458347/490312 (executing program) 2022/11/24 17:17:03 fetching corpus: 16424, signal 458751/490312 (executing program) 2022/11/24 17:17:03 fetching corpus: 16474, signal 459205/490312 (executing program) 2022/11/24 17:17:03 fetching corpus: 16523, signal 459658/490315 (executing program) 2022/11/24 17:17:03 fetching corpus: 16572, signal 460046/490327 (executing program) 2022/11/24 17:17:04 fetching corpus: 16618, signal 460406/490331 (executing program) 2022/11/24 17:17:04 fetching corpus: 16668, signal 460675/490331 (executing program) 2022/11/24 17:17:04 fetching corpus: 16718, signal 461122/490331 (executing program) 2022/11/24 17:17:04 fetching corpus: 16766, signal 461604/490334 (executing program) 2022/11/24 17:17:05 fetching corpus: 16815, signal 461951/490338 (executing program) 2022/11/24 17:17:05 fetching corpus: 16865, signal 462476/490364 (executing program) 2022/11/24 17:17:05 fetching corpus: 16914, signal 462915/490375 (executing program) 2022/11/24 17:17:05 fetching corpus: 16964, signal 463271/490375 (executing program) 2022/11/24 17:17:05 fetching corpus: 17014, signal 463702/490377 (executing program) 2022/11/24 17:17:05 fetching corpus: 17063, signal 464067/490377 (executing program) 2022/11/24 17:17:06 fetching corpus: 17112, signal 464527/490383 (executing program) 2022/11/24 17:17:06 fetching corpus: 17162, signal 464874/490386 (executing program) 2022/11/24 17:17:06 fetching corpus: 17212, signal 465290/490401 (executing program) 2022/11/24 17:17:06 fetching corpus: 17262, signal 465871/490417 (executing program) 2022/11/24 17:17:06 fetching corpus: 17310, signal 466239/490418 (executing program) 2022/11/24 17:17:07 fetching corpus: 17360, signal 466556/490418 (executing program) 2022/11/24 17:17:07 fetching corpus: 17410, signal 466928/490418 (executing program) 2022/11/24 17:17:07 fetching corpus: 17460, signal 467287/490419 (executing program) 2022/11/24 17:17:07 fetching corpus: 17510, signal 467721/490419 (executing program) 2022/11/24 17:17:08 fetching corpus: 17558, signal 467993/490423 (executing program) 2022/11/24 17:17:08 fetching corpus: 17608, signal 468364/490430 (executing program) 2022/11/24 17:17:08 fetching corpus: 17657, signal 468715/490430 (executing program) 2022/11/24 17:17:08 fetching corpus: 17706, signal 468979/490430 (executing program) 2022/11/24 17:17:09 fetching corpus: 17756, signal 469373/490430 (executing program) 2022/11/24 17:17:09 fetching corpus: 17806, signal 469897/490430 (executing program) 2022/11/24 17:17:09 fetching corpus: 17855, signal 470335/490431 (executing program) 2022/11/24 17:17:09 fetching corpus: 17905, signal 470666/490454 (executing program) 2022/11/24 17:17:09 fetching corpus: 17954, signal 470999/490454 (executing program) 2022/11/24 17:17:10 fetching corpus: 18003, signal 471317/490456 (executing program) 2022/11/24 17:17:10 fetching corpus: 18051, signal 471739/490460 (executing program) 2022/11/24 17:17:10 fetching corpus: 18100, signal 472104/490460 (executing program) 2022/11/24 17:17:10 fetching corpus: 18150, signal 472457/490460 (executing program) 2022/11/24 17:17:10 fetching corpus: 18199, signal 472770/490464 (executing program) 2022/11/24 17:17:10 fetching corpus: 18248, signal 473112/490470 (executing program) 2022/11/24 17:17:11 fetching corpus: 18298, signal 473401/490470 (executing program) 2022/11/24 17:17:11 fetching corpus: 18347, signal 473713/490472 (executing program) 2022/11/24 17:17:11 fetching corpus: 18396, signal 474051/490472 (executing program) 2022/11/24 17:17:11 fetching corpus: 18446, signal 474417/490472 (executing program) 2022/11/24 17:17:12 fetching corpus: 18496, signal 474766/490484 (executing program) 2022/11/24 17:17:12 fetching corpus: 18546, signal 475042/490484 (executing program) 2022/11/24 17:17:12 fetching corpus: 18596, signal 475601/490507 (executing program) 2022/11/24 17:17:12 fetching corpus: 18646, signal 475928/490573 (executing program) 2022/11/24 17:17:12 fetching corpus: 18696, signal 476313/490573 (executing program) 2022/11/24 17:17:13 fetching corpus: 18745, signal 479504/490577 (executing program) 2022/11/24 17:17:13 fetching corpus: 18794, signal 479728/490586 (executing program) 2022/11/24 17:17:13 fetching corpus: 18844, signal 480175/490586 (executing program) 2022/11/24 17:17:13 fetching corpus: 18894, signal 480493/490587 (executing program) 2022/11/24 17:17:13 fetching corpus: 18944, signal 480956/490587 (executing program) 2022/11/24 17:17:14 fetching corpus: 18993, signal 481215/490606 (executing program) 2022/11/24 17:17:14 fetching corpus: 19042, signal 481633/490621 (executing program) 2022/11/24 17:17:14 fetching corpus: 19092, signal 482036/490621 (executing program) 2022/11/24 17:17:14 fetching corpus: 19142, signal 482367/490621 (executing program) 2022/11/24 17:17:14 fetching corpus: 19192, signal 482787/490621 (executing program) 2022/11/24 17:17:15 fetching corpus: 19242, signal 483203/490630 (executing program) 2022/11/24 17:17:15 fetching corpus: 19292, signal 483556/490630 (executing program) 2022/11/24 17:17:15 fetching corpus: 19342, signal 483903/490642 (executing program) 2022/11/24 17:17:15 fetching corpus: 19392, signal 484233/490712 (executing program) 2022/11/24 17:17:16 fetching corpus: 19442, signal 484635/490717 (executing program) 2022/11/24 17:17:16 fetching corpus: 19492, signal 484886/490718 (executing program) 2022/11/24 17:17:16 fetching corpus: 19495, signal 484912/490729 (executing program) 2022/11/24 17:17:16 fetching corpus: 19495, signal 484912/490729 (executing program) 2022/11/24 17:17:19 starting 6 fuzzer processes 17:17:19 executing program 0: r0 = io_uring_setup(0x4b4f, &(0x7f0000000540)) close(r0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) futex(&(0x7f0000000100), 0x0, 0x0, &(0x7f00000001c0)={0x0, r1+10000000}, 0x0, 0x0) 17:17:19 executing program 1: io_setup(0x5, &(0x7f0000000040)=0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/exe\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x80, 0x3f, 0x7e, 0x0, 0x0}) close(r1) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00c642d, &(0x7f0000000100)={r3}) io_submit(r0, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 17:17:19 executing program 2: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000300), 0x4) close(r2) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f0000000180)=0x4000) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x67) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r4, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x6, @remote, 0x2}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)}], 0x1, 0x0, 0x248}}], 0x1, 0x8000) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000001340)="e6", 0xfffffeff}], 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0xcbf, 0x80000001}, 0x14) splice(r0, 0x0, r3, 0x0, 0xfd5c, 0x0) 17:17:19 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0xffffffb7, 0x0, 0x0, 0x0, 0x0, 0x4e}, [@ldst={0x4, 0x3, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x1, 0xb579, &(0x7f000000cf3d)=""/195}, 0x32) 17:17:19 executing program 3: syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcb, 0xf7, 0x8e, 0x40, 0x1a86, 0xe092, 0xa940, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x7, 0xf2, 0xe7}}]}}]}}, 0x0) 17:17:19 executing program 5: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x149802, 0x0) fallocate(r0, 0x3, 0x0, 0x10000000000) [ 163.116454][ T3665] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 163.124970][ T3665] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 163.132718][ T3667] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 163.170617][ T3671] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 163.178650][ T3671] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 163.187266][ T3673] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 163.197248][ T3673] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 163.205720][ T3673] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 163.208314][ T3677] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 163.213827][ T3673] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 163.223438][ T3677] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 163.228504][ T3673] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 163.235405][ T3677] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 163.241441][ T3673] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 163.248813][ T3677] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 163.258457][ T3673] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 163.270243][ T3673] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 163.270976][ T3677] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 163.278103][ T3673] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 163.285876][ T3677] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 163.292583][ T3673] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 163.298960][ T3677] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 163.312835][ T3656] Bluetooth: hci0: HCI_REQ-0x0c1a [ 163.317898][ T48] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 163.319125][ T3677] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 163.325813][ T48] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 163.332844][ T3677] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 163.340516][ T48] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 163.347675][ T3678] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 163.354250][ T3659] Bluetooth: hci4: HCI_REQ-0x0c1a [ 163.367179][ T3657] Bluetooth: hci1: HCI_REQ-0x0c1a [ 163.369908][ T3677] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 163.383484][ T3673] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 163.391912][ T3673] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 163.401087][ T3660] Bluetooth: hci3: HCI_REQ-0x0c1a [ 163.406509][ T3673] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 163.415600][ T3673] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 163.423960][ T3673] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 163.431764][ T3668] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 163.437469][ T3673] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 163.450709][ T3661] Bluetooth: hci5: HCI_REQ-0x0c1a [ 163.458379][ T3658] Bluetooth: hci2: HCI_REQ-0x0c1a [ 163.929343][ T3679] chnl_net:caif_netlink_parms(): no params data found [ 164.079214][ T3682] chnl_net:caif_netlink_parms(): no params data found [ 164.221434][ T3681] chnl_net:caif_netlink_parms(): no params data found [ 164.260394][ T3683] chnl_net:caif_netlink_parms(): no params data found [ 164.283356][ T3685] chnl_net:caif_netlink_parms(): no params data found [ 164.321904][ T3684] chnl_net:caif_netlink_parms(): no params data found [ 164.411614][ T3682] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.419769][ T3682] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.428757][ T3682] device bridge_slave_0 entered promiscuous mode [ 164.447213][ T3679] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.454449][ T3679] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.462397][ T3679] device bridge_slave_0 entered promiscuous mode [ 164.489195][ T3682] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.497457][ T3682] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.507290][ T3682] device bridge_slave_1 entered promiscuous mode [ 164.519866][ T3679] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.527057][ T3679] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.536116][ T3679] device bridge_slave_1 entered promiscuous mode [ 164.633890][ T3682] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 164.673113][ T3681] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.680334][ T3681] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.688765][ T3681] device bridge_slave_0 entered promiscuous mode [ 164.709151][ T3682] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 164.720354][ T3679] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 164.740602][ T3685] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.747811][ T3685] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.756105][ T3685] device bridge_slave_0 entered promiscuous mode [ 164.765904][ T3685] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.773143][ T3685] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.781756][ T3685] device bridge_slave_1 entered promiscuous mode [ 164.789050][ T3681] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.796721][ T3681] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.805412][ T3681] device bridge_slave_1 entered promiscuous mode [ 164.834989][ T3679] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 164.844339][ T3683] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.851843][ T3683] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.861033][ T3683] device bridge_slave_0 entered promiscuous mode [ 164.891303][ T3684] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.898936][ T3684] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.908545][ T3684] device bridge_slave_0 entered promiscuous mode [ 164.936985][ T3683] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.950138][ T3683] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.958712][ T3683] device bridge_slave_1 entered promiscuous mode [ 164.980592][ T3685] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 165.000774][ T3684] bridge0: port 2(bridge_slave_1) entered blocking state [ 165.008037][ T3684] bridge0: port 2(bridge_slave_1) entered disabled state [ 165.017505][ T3684] device bridge_slave_1 entered promiscuous mode [ 165.027431][ T3682] team0: Port device team_slave_0 added [ 165.055010][ T3685] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 165.067249][ T3681] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 165.090253][ T3682] team0: Port device team_slave_1 added [ 165.099683][ T3679] team0: Port device team_slave_0 added [ 165.127320][ T3681] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 165.159952][ T3679] team0: Port device team_slave_1 added [ 165.168246][ T3683] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 165.200967][ T3684] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 165.238241][ T3683] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 165.254589][ T3685] team0: Port device team_slave_0 added [ 165.271957][ T3684] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 165.281948][ T3682] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 165.289190][ T3682] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 165.315734][ T3682] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 165.349948][ T3685] team0: Port device team_slave_1 added [ 165.358817][ T3681] team0: Port device team_slave_0 added [ 165.376213][ T3682] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 165.384255][ T3665] Bluetooth: hci1: command 0x0409 tx timeout [ 165.384839][ T3682] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 165.423229][ T3682] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 165.437024][ T3679] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 165.444074][ T3679] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 165.463350][ T3665] Bluetooth: hci3: command 0x0409 tx timeout [ 165.470688][ T3673] Bluetooth: hci5: command 0x0409 tx timeout [ 165.477592][ T3665] Bluetooth: hci4: command 0x0409 tx timeout [ 165.482536][ T3679] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 165.522174][ T3681] team0: Port device team_slave_1 added [ 165.542587][ T3679] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 165.543670][ T3675] Bluetooth: hci0: command 0x0409 tx timeout [ 165.549784][ T3679] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 165.556470][ T3665] Bluetooth: hci2: command 0x0409 tx timeout [ 165.582490][ T3679] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 165.614243][ T3683] team0: Port device team_slave_0 added [ 165.642058][ T3684] team0: Port device team_slave_0 added [ 165.651821][ T3684] team0: Port device team_slave_1 added [ 165.664779][ T3683] team0: Port device team_slave_1 added [ 165.671188][ T3685] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 165.678365][ T3685] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 165.704398][ T3685] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 165.757308][ T3684] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 165.765054][ T3684] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 165.791426][ T3684] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 165.813627][ T3685] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 165.820714][ T3685] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 165.847208][ T3685] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 165.864957][ T3681] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 165.871945][ T3681] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 165.898339][ T3681] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 165.931692][ T3684] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 165.939013][ T3684] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 165.966253][ T3684] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 165.992851][ T3681] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 165.999904][ T3681] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 166.026260][ T3681] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 166.042830][ T3682] device hsr_slave_0 entered promiscuous mode [ 166.049938][ T3682] device hsr_slave_1 entered promiscuous mode [ 166.086257][ T3683] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 166.093424][ T3683] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 166.119813][ T3683] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 166.162619][ T3679] device hsr_slave_0 entered promiscuous mode [ 166.169672][ T3679] device hsr_slave_1 entered promiscuous mode [ 166.178533][ T3679] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 166.186624][ T3679] Cannot create hsr debugfs directory [ 166.206537][ T3683] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 166.214031][ T3683] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 166.240526][ T3683] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 166.306208][ T3684] device hsr_slave_0 entered promiscuous mode [ 166.313116][ T3684] device hsr_slave_1 entered promiscuous mode [ 166.321611][ T3684] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 166.329367][ T3684] Cannot create hsr debugfs directory [ 166.339483][ T3685] device hsr_slave_0 entered promiscuous mode [ 166.349648][ T3685] device hsr_slave_1 entered promiscuous mode [ 166.357081][ T3685] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 166.364939][ T3685] Cannot create hsr debugfs directory [ 166.470390][ T3681] device hsr_slave_0 entered promiscuous mode [ 166.477835][ T3681] device hsr_slave_1 entered promiscuous mode [ 166.485470][ T3681] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 166.493289][ T3681] Cannot create hsr debugfs directory [ 166.508966][ T3683] device hsr_slave_0 entered promiscuous mode [ 166.516646][ T3683] device hsr_slave_1 entered promiscuous mode [ 166.524561][ T3683] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 166.532160][ T3683] Cannot create hsr debugfs directory [ 166.994973][ T3682] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 167.021664][ T3682] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 167.038733][ T3682] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 167.055321][ T3682] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 167.091612][ T3679] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 167.102485][ T3679] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 167.130014][ T3679] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 167.155929][ T3679] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 167.242677][ T3684] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 167.260645][ T3684] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 167.270478][ T3684] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 167.283099][ T3684] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 167.467601][ T3673] Bluetooth: hci1: command 0x041b tx timeout [ 167.467670][ T3679] 8021q: adding VLAN 0 to HW filter on device bond0 [ 167.501881][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 167.511968][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 167.526396][ T3679] 8021q: adding VLAN 0 to HW filter on device team0 [ 167.538658][ T3682] 8021q: adding VLAN 0 to HW filter on device bond0 [ 167.543499][ T3665] Bluetooth: hci5: command 0x041b tx timeout [ 167.551838][ T3665] Bluetooth: hci3: command 0x041b tx timeout [ 167.558722][ T3673] Bluetooth: hci4: command 0x041b tx timeout [ 167.563319][ T3683] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 167.576244][ T3683] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 167.615994][ T3683] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 167.623968][ T3675] Bluetooth: hci2: command 0x041b tx timeout [ 167.624063][ T3665] Bluetooth: hci0: command 0x041b tx timeout [ 167.641210][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 167.653100][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 167.662488][ T3721] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.669937][ T3721] bridge0: port 1(bridge_slave_0) entered forwarding state [ 167.678412][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 167.688243][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 167.696887][ T3721] bridge0: port 2(bridge_slave_1) entered blocking state [ 167.704914][ T3721] bridge0: port 2(bridge_slave_1) entered forwarding state [ 167.713135][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 167.721657][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 167.746788][ T3683] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 167.761236][ T3682] 8021q: adding VLAN 0 to HW filter on device team0 [ 167.785914][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 167.794716][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 167.804294][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 167.833842][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 167.843058][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 167.854187][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 167.864268][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 167.874543][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 167.882986][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 167.907694][ T3681] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 167.931927][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 167.940962][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 167.950523][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 167.959702][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.966901][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 167.975479][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 167.984814][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 167.996811][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 168.004009][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 168.012122][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 168.021274][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 168.031319][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 168.064896][ T3679] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 168.077653][ T3681] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 168.111478][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 168.130986][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 168.144682][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 168.157458][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 168.204410][ T3681] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 168.224093][ T3681] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 168.267551][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 168.280266][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 168.301359][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 168.320448][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 168.332456][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 168.353871][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 168.361456][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 168.382431][ T3682] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 168.400529][ T3682] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 168.414284][ T3684] 8021q: adding VLAN 0 to HW filter on device bond0 [ 168.438869][ T3679] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 168.469819][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 168.478766][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 168.509193][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 168.518481][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 168.557361][ T3684] 8021q: adding VLAN 0 to HW filter on device team0 [ 168.597605][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 168.605711][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 168.620632][ T3682] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 168.648075][ T3685] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 168.670766][ T3685] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 168.680808][ T3685] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 168.710827][ T3725] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 168.719837][ T3725] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 168.734334][ T3685] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 168.758172][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 168.768910][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 168.778232][ T3721] bridge0: port 1(bridge_slave_0) entered blocking state [ 168.785413][ T3721] bridge0: port 1(bridge_slave_0) entered forwarding state [ 168.814353][ T3683] 8021q: adding VLAN 0 to HW filter on device bond0 [ 168.835581][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 168.845340][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 168.854458][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 168.863142][ T3724] bridge0: port 2(bridge_slave_1) entered blocking state [ 168.870322][ T3724] bridge0: port 2(bridge_slave_1) entered forwarding state [ 168.878888][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 168.887896][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 168.897062][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 168.906752][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 168.942221][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 168.951836][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 168.962066][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 168.971368][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 168.980327][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 168.989866][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 169.017521][ T3679] device veth0_vlan entered promiscuous mode [ 169.041268][ T3682] device veth0_vlan entered promiscuous mode [ 169.048833][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 169.057825][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 169.067654][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 169.076529][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 169.085475][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 169.094802][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 169.102799][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 169.110959][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 169.119709][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 169.128988][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 169.137398][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 169.147865][ T3683] 8021q: adding VLAN 0 to HW filter on device team0 [ 169.170549][ T3679] device veth1_vlan entered promiscuous mode [ 169.189352][ T3682] device veth1_vlan entered promiscuous mode [ 169.231339][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 169.241842][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 169.251368][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 169.260054][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 169.268636][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 169.278032][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 169.286761][ T3724] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.293953][ T3724] bridge0: port 1(bridge_slave_0) entered forwarding state [ 169.301685][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 169.310927][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 169.319873][ T3724] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.327147][ T3724] bridge0: port 2(bridge_slave_1) entered forwarding state [ 169.340281][ T3684] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 169.352736][ T3684] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 169.387532][ T3681] 8021q: adding VLAN 0 to HW filter on device bond0 [ 169.398623][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 169.408364][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 169.417168][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 169.426227][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 169.484854][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 169.495443][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 169.504707][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 169.513757][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 169.521824][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 169.530549][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 169.538338][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 169.548386][ T3665] Bluetooth: hci1: command 0x040f tx timeout [ 169.583104][ T3679] device veth0_macvtap entered promiscuous mode [ 169.599864][ T3682] device veth0_macvtap entered promiscuous mode [ 169.614849][ T3681] 8021q: adding VLAN 0 to HW filter on device team0 [ 169.623985][ T3665] Bluetooth: hci3: command 0x040f tx timeout [ 169.630156][ T3665] Bluetooth: hci4: command 0x040f tx timeout [ 169.637723][ T3675] Bluetooth: hci5: command 0x040f tx timeout [ 169.647386][ T3684] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 169.657220][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 169.665966][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 169.675824][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 169.685647][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 169.694996][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 169.703848][ T3675] Bluetooth: hci0: command 0x040f tx timeout [ 169.710410][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 169.718766][ T3675] Bluetooth: hci2: command 0x040f tx timeout [ 169.726215][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 169.738522][ T3682] device veth1_macvtap entered promiscuous mode [ 169.749236][ T3679] device veth1_macvtap entered promiscuous mode [ 169.784642][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 169.793107][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 169.802198][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 169.811216][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 169.842506][ T3683] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 169.862907][ T3683] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 169.892251][ T3679] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 169.905389][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 169.915175][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 169.923888][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.931557][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 169.939755][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 169.948506][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 169.957516][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 169.966170][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 169.975028][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 169.983949][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 169.992680][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 170.002434][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 170.011089][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.018263][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 170.026889][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 170.035448][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 170.051110][ T3685] 8021q: adding VLAN 0 to HW filter on device bond0 [ 170.067295][ T3682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 170.079202][ T3682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.092879][ T3682] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 170.129166][ T3679] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 170.138787][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 170.148552][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 170.157660][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 170.166812][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 170.175945][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 170.185541][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 170.194774][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 170.214909][ T3685] 8021q: adding VLAN 0 to HW filter on device team0 [ 170.233547][ T3682] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 170.245874][ T3682] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 170.258244][ T3682] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 170.282069][ T3684] device veth0_vlan entered promiscuous mode [ 170.295624][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 170.304233][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 170.312362][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 170.321515][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 170.330679][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 170.339510][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 170.347445][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 170.356434][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 170.366067][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 170.393808][ T3682] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.402840][ T3682] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.411868][ T3682] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.422064][ T3682] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.437690][ T3683] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 170.455636][ T3684] device veth1_vlan entered promiscuous mode [ 170.462754][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 170.471599][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 170.480061][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 170.488881][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 170.498028][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 170.506976][ T3722] bridge0: port 1(bridge_slave_0) entered blocking state [ 170.514147][ T3722] bridge0: port 1(bridge_slave_0) entered forwarding state [ 170.522247][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 170.531437][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 170.541959][ T3722] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.549260][ T3722] bridge0: port 2(bridge_slave_1) entered forwarding state [ 170.583913][ T3679] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.592680][ T3679] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.603670][ T3679] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.612414][ T3679] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.652830][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 170.661125][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 170.670879][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 170.680243][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 170.690130][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 170.699215][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 170.708489][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 170.717776][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 170.726624][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 170.735520][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 170.744969][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 170.789512][ T3681] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 170.807256][ T3681] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 170.821746][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 170.832374][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 170.840953][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 170.850100][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 170.858763][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 170.868012][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 170.930571][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 170.945084][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 170.955167][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 170.965621][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 170.974468][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 170.982912][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 171.013772][ T3726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 171.022870][ T3726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 171.050477][ T3684] device veth0_macvtap entered promiscuous mode [ 171.062174][ T3685] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 171.079656][ T3717] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 171.088697][ T3717] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 171.097969][ T3717] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 171.126709][ T3684] device veth1_macvtap entered promiscuous mode [ 171.146108][ T3681] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 171.159698][ T3683] device veth0_vlan entered promiscuous mode [ 171.167882][ T3717] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 171.177315][ T3717] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 171.186087][ T3717] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 171.194827][ T3717] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 171.202313][ T3717] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 171.240462][ T3684] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.253618][ T3684] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.264055][ T3684] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.274778][ T3684] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.288614][ T3684] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 171.302372][ T3684] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 171.313881][ T3684] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.326155][ T3684] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 171.337235][ T3684] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.349423][ T3684] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 171.384832][ T3728] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 171.394596][ T3728] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 171.404282][ T3728] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 171.413096][ T3728] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 171.422356][ T3728] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 171.430541][ T3728] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 171.455680][ T3684] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.460295][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.473835][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.481252][ T3684] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.490518][ T3684] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.499370][ T3684] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.517343][ T3685] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 171.535336][ T3726] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 171.554153][ T3683] device veth1_vlan entered promiscuous mode [ 171.578660][ T3699] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.588234][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 171.597011][ T3699] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.600097][ T150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 171.624536][ T3675] Bluetooth: hci1: command 0x0419 tx timeout [ 171.685517][ T3728] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 171.703684][ T3665] Bluetooth: hci4: command 0x0419 tx timeout [ 171.703808][ T3675] Bluetooth: hci3: command 0x0419 tx timeout [ 171.709755][ T3665] Bluetooth: hci5: command 0x0419 tx timeout [ 171.775974][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 171.784915][ T3665] Bluetooth: hci2: command 0x0419 tx timeout [ 171.784964][ T3665] Bluetooth: hci0: command 0x0419 tx timeout [ 171.792234][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 171.807819][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 171.816642][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 171.833606][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.841826][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.864867][ T3681] device veth0_vlan entered promiscuous mode [ 171.866032][ T3699] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.884455][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 171.897933][ T3699] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.906301][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 171.914801][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 171.922771][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 171.932501][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 171.941708][ T3724] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 171.958123][ T3685] device veth0_vlan entered promiscuous mode [ 171.980732][ T3683] device veth0_macvtap entered promiscuous mode [ 172.006218][ T3681] device veth1_vlan entered promiscuous mode [ 172.016075][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 172.028767][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 172.037550][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 172.046438][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 172.062200][ T3683] device veth1_macvtap entered promiscuous mode [ 172.101762][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 172.115596][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 172.124173][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 172.140469][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 172.175794][ T3683] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 172.192106][ T3683] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.202671][ T3683] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 172.213338][ T3683] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.223397][ T3683] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 172.233982][ T3683] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.245973][ T3683] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 172.255705][ T3685] device veth1_vlan entered promiscuous mode [ 172.288662][ T3681] device veth0_macvtap entered promiscuous mode [ 172.315476][ T3699] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 172.331460][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready 17:17:29 executing program 5: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x149802, 0x0) fallocate(r0, 0x3, 0x0, 0x10000000000) [ 172.352068][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 172.383759][ T3699] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 17:17:29 executing program 5: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x149802, 0x0) fallocate(r0, 0x3, 0x0, 0x10000000000) [ 172.404238][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 172.423701][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 172.432641][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready 17:17:29 executing program 1: io_setup(0x5, &(0x7f0000000040)=0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/exe\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x80, 0x3f, 0x7e, 0x0, 0x0}) close(r1) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00c642d, &(0x7f0000000100)={r3}) io_submit(r0, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) [ 172.465147][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 172.490854][ T3683] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 17:17:29 executing program 5: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x149802, 0x0) fallocate(r0, 0x3, 0x0, 0x10000000000) [ 172.531891][ T3683] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.566218][ T3683] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 17:17:29 executing program 5: r0 = openat$damon_init_regions(0xffffffffffffff9c, &(0x7f0000000400), 0x121282, 0x0) write$damon_init_regions(r0, &(0x7f0000000440)={{' ', 0xffffffffffffffff}, {}, {' ', 0x800}}, 0x3f) [ 172.577787][ T3683] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.608338][ T3683] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 172.624309][ T3683] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.643951][ T3683] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 172.677824][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 172.691759][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 172.701782][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 172.714594][ T3723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 17:17:29 executing program 1: io_setup(0x5, &(0x7f0000000040)=0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/exe\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x80, 0x3f, 0x7e, 0x0, 0x0}) close(r1) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00c642d, &(0x7f0000000100)={r3}) io_submit(r0, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) [ 172.733653][ T3681] device veth1_macvtap entered promiscuous mode [ 172.752698][ T3683] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 172.784282][ T3683] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 172.793074][ T3683] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 172.802532][ T3683] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 172.834308][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 172.865088][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 172.875678][ T3681] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 172.886713][ T3681] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.897672][ T3681] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 172.909387][ T3681] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.919837][ T3681] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 172.930950][ T3681] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.940864][ T3681] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 172.951398][ T3681] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.962933][ T3681] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 172.975960][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 172.984846][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 172.998007][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 173.018249][ T3681] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.042415][ T3681] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.053509][ T3681] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.064572][ T3681] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.077109][ T3681] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.088391][ T3681] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.098848][ T3681] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.116164][ T3681] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.142168][ T3681] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 173.151653][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 173.161095][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 173.170291][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 173.179194][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 173.191134][ T3685] device veth0_macvtap entered promiscuous mode [ 173.206770][ T3681] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.247076][ T3681] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.256781][ T3681] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.265940][ T3681] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.296521][ T3685] device veth1_macvtap entered promiscuous mode [ 173.394836][ T3685] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.406801][ T3685] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.418849][ T3685] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.431269][ T3685] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.441381][ T3685] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.452136][ T3685] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.462045][ T3685] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.472718][ T3685] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.483010][ T3685] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.493680][ T3685] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.506899][ T3685] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 173.537190][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 173.548249][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 173.556868][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 173.566234][ T3722] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 173.581488][ T3685] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.593797][ T3685] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.604068][ T3685] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.615051][ T3685] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.626969][ T3685] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.638121][ T3685] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.648055][ T3685] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.659460][ T3685] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.669370][ T3685] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 173.680679][ T3685] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.695261][ T3685] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 173.716747][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 173.732013][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 173.745989][ T3685] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.755921][ T3685] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.765433][ T3685] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.774687][ T3685] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.855113][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 173.866706][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 173.882674][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 173.891364][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 173.904445][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 173.930805][ T153] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 173.974113][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 173.987231][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 174.033091][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 174.095217][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 174.123248][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 174.140880][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 174.173803][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 174.196243][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 174.204741][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 174.280609][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 174.307805][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 174.318606][ T3717] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 174.643528][ T3717] usb 4-1: new high-speed USB device number 2 using dummy_hcd 17:17:31 executing program 0: r0 = io_uring_setup(0x4b4f, &(0x7f0000000540)) close(r0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) futex(&(0x7f0000000100), 0x0, 0x0, &(0x7f00000001c0)={0x0, r1+10000000}, 0x0, 0x0) 17:17:31 executing program 5: r0 = openat$damon_init_regions(0xffffffffffffff9c, &(0x7f0000000400), 0x121282, 0x0) write$damon_init_regions(r0, &(0x7f0000000440)={{' ', 0xffffffffffffffff}, {}, {' ', 0x800}}, 0x3f) 17:17:31 executing program 1: io_setup(0x5, &(0x7f0000000040)=0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/exe\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x80, 0x3f, 0x7e, 0x0, 0x0}) close(r1) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00c642d, &(0x7f0000000100)={r3}) io_submit(r0, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 17:17:31 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0xffffffb7, 0x0, 0x0, 0x0, 0x0, 0x4e}, [@ldst={0x4, 0x3, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x1, 0xb579, &(0x7f000000cf3d)=""/195}, 0x32) [ 175.053682][ T3717] usb 4-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=a9.40 [ 175.063399][ T3717] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.081953][ T3717] usb 4-1: config 0 descriptor?? [ 175.129014][ T3717] ch9200: probe of 4-1:0.0 failed with error -22 [ 175.332792][ T7] usb 4-1: USB disconnect, device number 2 17:17:32 executing program 3: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000300), 0x4) close(r2) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f0000000180)=0x4000) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x67) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r4, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x6, @remote, 0x2}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)}], 0x1, 0x0, 0x248}}], 0x1, 0x8000) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000001340)="e6", 0xfffffeff}], 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0xcbf, 0x80000001}, 0x14) splice(r0, 0x0, r3, 0x0, 0xfd5c, 0x0) 17:17:32 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0xffffffb7, 0x0, 0x0, 0x0, 0x0, 0x4e}, [@ldst={0x4, 0x3, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x1, 0xb579, &(0x7f000000cf3d)=""/195}, 0x32) 17:17:32 executing program 2: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000300), 0x4) close(r2) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f0000000180)=0x4000) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x67) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r4, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x6, @remote, 0x2}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)}], 0x1, 0x0, 0x248}}], 0x1, 0x8000) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000001340)="e6", 0xfffffeff}], 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0xcbf, 0x80000001}, 0x14) splice(r0, 0x0, r3, 0x0, 0xfd5c, 0x0) 17:17:32 executing program 5: r0 = openat$damon_init_regions(0xffffffffffffff9c, &(0x7f0000000400), 0x121282, 0x0) write$damon_init_regions(r0, &(0x7f0000000440)={{' ', 0xffffffffffffffff}, {}, {' ', 0x800}}, 0x3f) 17:17:32 executing program 1: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000300), 0x4) close(r2) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f0000000180)=0x4000) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x67) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r4, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x6, @remote, 0x2}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)}], 0x1, 0x0, 0x248}}], 0x1, 0x8000) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000001340)="e6", 0xfffffeff}], 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0xcbf, 0x80000001}, 0x14) splice(r0, 0x0, r3, 0x0, 0xfd5c, 0x0) 17:17:32 executing program 0: r0 = io_uring_setup(0x4b4f, &(0x7f0000000540)) close(r0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) futex(&(0x7f0000000100), 0x0, 0x0, &(0x7f00000001c0)={0x0, r1+10000000}, 0x0, 0x0) 17:17:32 executing program 5: r0 = openat$damon_init_regions(0xffffffffffffff9c, &(0x7f0000000400), 0x121282, 0x0) write$damon_init_regions(r0, &(0x7f0000000440)={{' ', 0xffffffffffffffff}, {}, {' ', 0x800}}, 0x3f) 17:17:32 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0xffffffb7, 0x0, 0x0, 0x0, 0x0, 0x4e}, [@ldst={0x4, 0x3, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x1, 0xb579, &(0x7f000000cf3d)=""/195}, 0x32) 17:17:32 executing program 2: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000300), 0x4) close(r2) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f0000000180)=0x4000) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x67) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r4, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x6, @remote, 0x2}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)}], 0x1, 0x0, 0x248}}], 0x1, 0x8000) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000001340)="e6", 0xfffffeff}], 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0xcbf, 0x80000001}, 0x14) splice(r0, 0x0, r3, 0x0, 0xfd5c, 0x0) 17:17:32 executing program 1: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000300), 0x4) close(r2) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f0000000180)=0x4000) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x67) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r4, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x6, @remote, 0x2}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)}], 0x1, 0x0, 0x248}}], 0x1, 0x8000) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000001340)="e6", 0xfffffeff}], 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0xcbf, 0x80000001}, 0x14) splice(r0, 0x0, r3, 0x0, 0xfd5c, 0x0) 17:17:32 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in=@local, 0x0, 0x0, 0x4e22, 0x3, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x33}, 0x0, @in6=@private2}}, 0xe8) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0x0) 17:17:32 executing program 3: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000300), 0x4) close(r2) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f0000000180)=0x4000) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x67) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r4, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x6, @remote, 0x2}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)}], 0x1, 0x0, 0x248}}], 0x1, 0x8000) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000001340)="e6", 0xfffffeff}], 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0xcbf, 0x80000001}, 0x14) splice(r0, 0x0, r3, 0x0, 0xfd5c, 0x0) 17:17:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="e8000000", @ANYRES16=r3, @ANYBLOB="ddb22bbd7000fbdbdf254400000008000300", @ANYRES32=r1, @ANYBLOB="0f002400bd609b8c0ce90bb6c836c80054002380060002002a0000000800170006000000060010004000000005000f00ea00000008000b"], 0xe8}}, 0x0) 17:17:33 executing program 2: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000300), 0x4) close(r2) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f0000000180)=0x4000) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x67) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r4, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x6, @remote, 0x2}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)}], 0x1, 0x0, 0x248}}], 0x1, 0x8000) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000001340)="e6", 0xfffffeff}], 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0xcbf, 0x80000001}, 0x14) splice(r0, 0x0, r3, 0x0, 0xfd5c, 0x0) 17:17:33 executing program 1: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000300), 0x4) close(r2) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f0000000180)=0x4000) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x67) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r4, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x6, @remote, 0x2}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)}], 0x1, 0x0, 0x248}}], 0x1, 0x8000) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000001340)="e6", 0xfffffeff}], 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0xcbf, 0x80000001}, 0x14) splice(r0, 0x0, r3, 0x0, 0xfd5c, 0x0) [ 176.291095][ T3787] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.4'. [ 176.346555][ T3787] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 17:17:33 executing program 3: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000300), 0x4) close(r2) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f0000000180)=0x4000) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x67) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r4, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x6, @remote, 0x2}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)}], 0x1, 0x0, 0x248}}], 0x1, 0x8000) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000001340)="e6", 0xfffffeff}], 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100)={0x0, 0xcbf, 0x80000001}, 0x14) splice(r0, 0x0, r3, 0x0, 0xfd5c, 0x0) 17:17:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="e8000000", @ANYRES16=r3, @ANYBLOB="ddb22bbd7000fbdbdf254400000008000300", @ANYRES32=r1, @ANYBLOB="0f002400bd609b8c0ce90bb6c836c80054002380060002002a0000000800170006000000060010004000000005000f00ea00000008000b"], 0xe8}}, 0x0) [ 176.631505][ T3796] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.4'. 17:17:33 executing program 2: socketpair(0x18, 0x0, 0x1, &(0x7f0000000000)) 17:17:33 executing program 0: r0 = io_uring_setup(0x4b4f, &(0x7f0000000540)) close(r0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) futex(&(0x7f0000000100), 0x0, 0x0, &(0x7f00000001c0)={0x0, r1+10000000}, 0x0, 0x0) 17:17:33 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8914, &(0x7f0000000000)={'wlan1\x00'}) syz_80211_join_ibss(&(0x7f00000001c0)='wlan1\x00', &(0x7f0000000200)=@random='Q', 0x1, 0x0) 17:17:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001000"/20, @ANYRES32=0x0, @ANYBLOB="040002000000000008001b0000000000"], 0x28}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) renameat2(r1, &(0x7f00000001c0)='./file0\x00', r1, &(0x7f0000000200)='./bus\x00', 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000010400000400d700000000000000", @ANYRES32=r4, @ANYBLOB="00000000000000001c0012000b000100627269646765"], 0x3c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8e004}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_1\x00'}, @IFLA_MASTER={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) [ 176.687577][ T3796] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 17:17:33 executing program 2: socketpair(0x18, 0x0, 0x1, &(0x7f0000000000)) [ 176.745928][ T3800] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 17:17:33 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in=@local, 0x0, 0x0, 0x4e22, 0x3, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x33}, 0x0, @in6=@private2}}, 0xe8) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0x0) 17:17:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="e8000000", @ANYRES16=r3, @ANYBLOB="ddb22bbd7000fbdbdf254400000008000300", @ANYRES32=r1, @ANYBLOB="0f002400bd609b8c0ce90bb6c836c80054002380060002002a0000000800170006000000060010004000000005000f00ea00000008000b"], 0xe8}}, 0x0) 17:17:33 executing program 2: socketpair(0x18, 0x0, 0x1, &(0x7f0000000000)) [ 176.942413][ T3813] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.4'. 17:17:33 executing program 2: socketpair(0x18, 0x0, 0x1, &(0x7f0000000000)) [ 177.017833][ T3805] device bridge_slave_1 left promiscuous mode [ 177.033259][ T3805] bridge0: port 2(bridge_slave_1) entered disabled state 17:17:33 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x4008662c, 0x0) [ 177.152936][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.164245][ T3813] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 17:17:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001000"/20, @ANYRES32=0x0, @ANYBLOB="040002000000000008001b0000000000"], 0x28}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) renameat2(r1, &(0x7f00000001c0)='./file0\x00', r1, &(0x7f0000000200)='./bus\x00', 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000010400000400d700000000000000", @ANYRES32=r4, @ANYBLOB="00000000000000001c0012000b000100627269646765"], 0x3c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8e004}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_1\x00'}, @IFLA_MASTER={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) 17:17:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="e8000000", @ANYRES16=r3, @ANYBLOB="ddb22bbd7000fbdbdf254400000008000300", @ANYRES32=r1, @ANYBLOB="0f002400bd609b8c0ce90bb6c836c80054002380060002002a0000000800170006000000060010004000000005000f00ea00000008000b"], 0xe8}}, 0x0) [ 177.198091][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 177.251493][ T3721] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 17:17:34 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8914, &(0x7f0000000000)={'wlan1\x00'}) syz_80211_join_ibss(&(0x7f00000001c0)='wlan1\x00', &(0x7f0000000200)=@random='Q', 0x1, 0x0) [ 177.353895][ T3821] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 177.389621][ T3824] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.4'. [ 177.427892][ T3824] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 17:17:34 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80), 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r2, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x12, &(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x6d, &(0x7f0000000240)=""/109, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x0, 0x8000, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 17:17:34 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x4008662c, 0x0) 17:17:34 executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000011000100ffffffff0800000000000200", @ANYRES32=r3], 0x20}}, 0x0) 17:17:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001000"/20, @ANYRES32=0x0, @ANYBLOB="040002000000000008001b0000000000"], 0x28}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) renameat2(r1, &(0x7f00000001c0)='./file0\x00', r1, &(0x7f0000000200)='./bus\x00', 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000010400000400d700000000000000", @ANYRES32=r4, @ANYBLOB="00000000000000001c0012000b000100627269646765"], 0x3c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8e004}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_1\x00'}, @IFLA_MASTER={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) [ 177.562747][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.597100][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 177.616322][ T3834] batman_adv: batadv0: Interface deactivated: batadv_slave_0 17:17:34 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in=@local, 0x0, 0x0, 0x4e22, 0x3, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x33}, 0x0, @in6=@private2}}, 0xe8) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0x0) 17:17:34 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x4008662c, 0x0) 17:17:34 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8914, &(0x7f0000000000)={'wlan1\x00'}) syz_80211_join_ibss(&(0x7f00000001c0)='wlan1\x00', &(0x7f0000000200)=@random='Q', 0x1, 0x0) [ 177.657522][ T3834] batman_adv: batadv0: Removing interface: batadv_slave_0 17:17:34 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x4008662c, 0x0) [ 177.741982][ T3834] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 177.788534][ T3834] batman_adv: batadv0: Removing interface: batadv_slave_1 17:17:34 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000004b000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_GET_NESTED_STATE(r2, 0xc080aebe, &(0x7f0000000200)={{0x0, 0x0, 0x80}}) [ 177.979147][ T3851] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 178.016506][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 17:17:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001000"/20, @ANYRES32=0x0, @ANYBLOB="040002000000000008001b0000000000"], 0x28}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) renameat2(r1, &(0x7f00000001c0)='./file0\x00', r1, &(0x7f0000000200)='./bus\x00', 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000010400000400d700000000000000", @ANYRES32=r4, @ANYBLOB="00000000000000001c0012000b000100627269646765"], 0x3c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8e004}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_1\x00'}, @IFLA_MASTER={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) 17:17:34 executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000011000100ffffffff0800000000000200", @ANYRES32=r3], 0x20}}, 0x0) [ 178.231987][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 17:17:35 executing program 2: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000011000100ffffffff0800000000000200", @ANYRES32=r3], 0x20}}, 0x0) [ 178.307018][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 178.367659][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 178.426783][ T3860] batman_adv: batadv0: Interface deactivated: batadv_slave_0 17:17:35 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80), 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r2, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x12, &(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x6d, &(0x7f0000000240)=""/109, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x0, 0x8000, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 17:17:35 executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000011000100ffffffff0800000000000200", @ANYRES32=r3], 0x20}}, 0x0) 17:17:35 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in=@local, 0x0, 0x0, 0x4e22, 0x3, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x33}, 0x0, @in6=@private2}}, 0xe8) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0x0) 17:17:35 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x3b) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c06}, 0x0) 17:17:35 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8914, &(0x7f0000000000)={'wlan1\x00'}) syz_80211_join_ibss(&(0x7f00000001c0)='wlan1\x00', &(0x7f0000000200)=@random='Q', 0x1, 0x0) [ 178.493848][ T3860] batman_adv: batadv0: Removing interface: batadv_slave_0 17:17:35 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x3b) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c06}, 0x0) [ 178.554557][ T3860] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 178.573425][ T3860] batman_adv: batadv0: Removing interface: batadv_slave_1 17:17:35 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x3b) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c06}, 0x0) 17:17:35 executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000011000100ffffffff0800000000000200", @ANYRES32=r3], 0x20}}, 0x0) 17:17:35 executing program 2: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000011000100ffffffff0800000000000200", @ANYRES32=r3], 0x20}}, 0x0) [ 178.933635][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 178.959547][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 17:17:35 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x3b) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c06}, 0x0) [ 179.016210][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 17:17:35 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80), 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r2, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x12, &(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x6d, &(0x7f0000000240)=""/109, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x0, 0x8000, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 17:17:35 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80), 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r2, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x12, &(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x6d, &(0x7f0000000240)=""/109, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x0, 0x8000, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 17:17:36 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80), 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r2, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x12, &(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x6d, &(0x7f0000000240)=""/109, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x0, 0x8000, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 17:17:36 executing program 2: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000011000100ffffffff0800000000000200", @ANYRES32=r3], 0x20}}, 0x0) 17:17:36 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000200), 0x0, 0x0) ioctl$VIDIOC_G_PRIORITY(r0, 0x80045643, 0x20000000) 17:17:36 executing program 5: r0 = socket(0x11, 0x2, 0x0) sendmmsg$unix(r0, &(0x7f0000001340)=[{{&(0x7f0000000040)=@abs={0x0, 0x8, 0x4}, 0x6e, 0x0}}], 0x1, 0x0) 17:17:36 executing program 5: r0 = socket(0x11, 0x2, 0x0) sendmmsg$unix(r0, &(0x7f0000001340)=[{{&(0x7f0000000040)=@abs={0x0, 0x8, 0x4}, 0x6e, 0x0}}], 0x1, 0x0) 17:17:36 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000200), 0x0, 0x0) ioctl$VIDIOC_G_PRIORITY(r0, 0x80045643, 0x20000000) 17:17:36 executing program 2: r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x271a, 0x0, &(0x7f0000000000)) 17:17:36 executing program 5: r0 = socket(0x11, 0x2, 0x0) sendmmsg$unix(r0, &(0x7f0000001340)=[{{&(0x7f0000000040)=@abs={0x0, 0x8, 0x4}, 0x6e, 0x0}}], 0x1, 0x0) 17:17:36 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000200), 0x0, 0x0) ioctl$VIDIOC_G_PRIORITY(r0, 0x80045643, 0x20000000) 17:17:36 executing program 2: r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x271a, 0x0, &(0x7f0000000000)) 17:17:36 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80), 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r2, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x12, &(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x6d, &(0x7f0000000240)=""/109, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x0, 0x8000, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 17:17:36 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80), 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r2, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x12, &(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x6d, &(0x7f0000000240)=""/109, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x0, 0x8000, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 17:17:37 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80), 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r2, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x12, &(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x6d, &(0x7f0000000240)=""/109, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x0, 0x8000, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 17:17:37 executing program 5: r0 = socket(0x11, 0x2, 0x0) sendmmsg$unix(r0, &(0x7f0000001340)=[{{&(0x7f0000000040)=@abs={0x0, 0x8, 0x4}, 0x6e, 0x0}}], 0x1, 0x0) 17:17:37 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000200), 0x0, 0x0) ioctl$VIDIOC_G_PRIORITY(r0, 0x80045643, 0x20000000) 17:17:37 executing program 2: r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x271a, 0x0, &(0x7f0000000000)) 17:17:37 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x24, 0x38, 0x9, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x8, 0x0, 0x1, [@typed={0x7, 0x0, 0x0, 0x0, @str='(-\x00'}]}]}, 0x24}}, 0x0) 17:17:37 executing program 2: r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x271a, 0x0, &(0x7f0000000000)) 17:17:37 executing program 5: syz_open_dev$loop(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004c80)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r0, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x2, 0x0) [ 180.543577][ T3941] netlink: 'syz-executor.1': attribute type 8 has an invalid length. 17:17:37 executing program 2: madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r0 = gettid() process_vm_writev(r0, &(0x7f0000000000)=[{&(0x7f0000000300)=""/259, 0x103}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/218, 0xda}], 0x1, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_WRITEPROTECT(r2, 0xc018aa06, &(0x7f0000000140)={{&(0x7f000035b000/0x3000)=nil, 0x3000}, 0x1}) 17:17:37 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x24, 0x38, 0x9, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x8, 0x0, 0x1, [@typed={0x7, 0x0, 0x0, 0x0, @str='(-\x00'}]}]}, 0x24}}, 0x0) 17:17:37 executing program 5: syz_open_dev$loop(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004c80)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r0, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x2, 0x0) [ 180.766638][ T3949] netlink: 'syz-executor.1': attribute type 8 has an invalid length. 17:17:37 executing program 5: syz_open_dev$loop(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004c80)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r0, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x2, 0x0) 17:17:37 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80), 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r2, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x12, &(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x6d, &(0x7f0000000240)=""/109, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x0, 0x8000, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 17:17:37 executing program 5: syz_open_dev$loop(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004c80)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r0, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x2, 0x0) 17:17:37 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80), 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) preadv(r2, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x12, &(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x6d, &(0x7f0000000240)=""/109, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x0, 0x8000, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 17:17:37 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000040)='blkio.reset_stats\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f00000000c0), 0x12) 17:17:37 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x24, 0x38, 0x9, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x8, 0x0, 0x1, [@typed={0x7, 0x0, 0x0, 0x0, @str='(-\x00'}]}]}, 0x24}}, 0x0) 17:17:37 executing program 2: madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r0 = gettid() process_vm_writev(r0, &(0x7f0000000000)=[{&(0x7f0000000300)=""/259, 0x103}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/218, 0xda}], 0x1, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_WRITEPROTECT(r2, 0xc018aa06, &(0x7f0000000140)={{&(0x7f000035b000/0x3000)=nil, 0x3000}, 0x1}) [ 181.218065][ T3965] netlink: 'syz-executor.1': attribute type 8 has an invalid length. 17:17:38 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:17:38 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x24, 0x38, 0x9, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x8, 0x0, 0x1, [@typed={0x7, 0x0, 0x0, 0x0, @str='(-\x00'}]}]}, 0x24}}, 0x0) 17:17:38 executing program 2: madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r0 = gettid() process_vm_writev(r0, &(0x7f0000000000)=[{&(0x7f0000000300)=""/259, 0x103}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/218, 0xda}], 0x1, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_WRITEPROTECT(r2, 0xc018aa06, &(0x7f0000000140)={{&(0x7f000035b000/0x3000)=nil, 0x3000}, 0x1}) 17:17:38 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000040)='blkio.reset_stats\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f00000000c0), 0x12) [ 181.434487][ T3975] netlink: 'syz-executor.1': attribute type 8 has an invalid length. 17:17:38 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000040)='blkio.reset_stats\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f00000000c0), 0x12) 17:17:38 executing program 2: madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r0 = gettid() process_vm_writev(r0, &(0x7f0000000000)=[{&(0x7f0000000300)=""/259, 0x103}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/218, 0xda}], 0x1, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_WRITEPROTECT(r2, 0xc018aa06, &(0x7f0000000140)={{&(0x7f000035b000/0x3000)=nil, 0x3000}, 0x1}) 17:17:38 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'bridge0\x00', 0x0}) bind$packet(r1, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @dev}, 0x14) sendto$inet6(r1, &(0x7f0000000280)="4103092cbbf2480401020200c52cf7c25975e005b02f0800eb2b2ff0dac8897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305f80a88161b6fd8f24286a57c3feffff", 0xfc13, 0x800, 0x0, 0x2f) 17:17:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x12f0, 0x1148, 0x1d0, 0x0, 0x1220, 0x1d0, 0x1220, 0x2a0, 0x2a0, 0x1220, 0x2a0, 0x3, 0x0, {[{{@ipv6={@remote, @remote, [], [], 'batadv_slave_0\x00', 'lo\x00'}, 0x0, 0x1120, 0x1148, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'Q.931\x00'}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.cpu/syz1\x00'}}]}, @common=@unspec=@NFQUEUE3={0x28}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1350) syz_emit_ethernet(0x8a, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd600a3ff2005406", @ANYBLOB], 0x0) [ 181.995184][ T3989] xt_cgroup: xt_cgroup: no path or classid specified 17:17:38 executing program 3: r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000002300)={{0x12, 0x1, 0x0, 0xde, 0x75, 0x85, 0x0, 0x46d, 0xc291, 0x5de1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xce, 0xde, 0xbd}}]}}]}}, 0x0) syz_usb_connect$uac1(0x0, 0xfb, &(0x7f0000000c00)=ANY=[], 0x0) syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x0, 0x0, 0x0, {{}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}}}}]}}, 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[], 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000022c0)={0x2c, 0x0, &(0x7f00000021c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x88, &(0x7f00000001c0)=ANY=[@ANYBLOB="0466917de0f4d5a1d48a7a347fe2b84536a0e21b43d0e89c09fd5e51524fa3c5d890d0f2c083db833cb7994c15d429df553e653fcfd0b6aa5f86d563e61bc66a400d472162832448d91904029330e9ea233915286e6e55a8670cc0195b8ffa98b9a4df353f47472c2ba6279449a5220c9f", @ANYRES64=r1]) 17:17:38 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000040)='blkio.reset_stats\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f00000000c0), 0x12) 17:17:38 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'bridge0\x00', 0x0}) bind$packet(r1, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @dev}, 0x14) sendto$inet6(r1, &(0x7f0000000280)="4103092cbbf2480401020200c52cf7c25975e005b02f0800eb2b2ff0dac8897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305f80a88161b6fd8f24286a57c3feffff", 0xfc13, 0x800, 0x0, 0x2f) 17:17:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x12f0, 0x1148, 0x1d0, 0x0, 0x1220, 0x1d0, 0x1220, 0x2a0, 0x2a0, 0x1220, 0x2a0, 0x3, 0x0, {[{{@ipv6={@remote, @remote, [], [], 'batadv_slave_0\x00', 'lo\x00'}, 0x0, 0x1120, 0x1148, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'Q.931\x00'}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.cpu/syz1\x00'}}]}, @common=@unspec=@NFQUEUE3={0x28}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1350) syz_emit_ethernet(0x8a, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd600a3ff2005406", @ANYBLOB], 0x0) [ 182.253003][ T4001] xt_cgroup: xt_cgroup: no path or classid specified [ 182.453408][ T7] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 182.703271][ T7] usb 4-1: Using ep0 maxpacket: 16 [ 182.833413][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 182.849998][ T7] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 182.882495][ T7] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 182.892372][ T7] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 182.902172][ T7] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 182.993450][ T7] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 183.009555][ T7] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 183.024589][ T7] usb 4-1: Manufacturer: syz [ 183.040377][ T7] usb 4-1: config 0 descriptor?? [ 183.292666][ T3999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.315303][ T3999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 183.343591][ T3999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.372223][ T3999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 183.392341][ T3999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.434320][ T3999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 183.454246][ T3999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.476360][ T3999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 17:17:40 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:17:40 executing program 0: r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = openat$vhost_vsock(0xffffff9c, &(0x7f0000003c40), 0x2, 0x0) close(r2) 17:17:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x12f0, 0x1148, 0x1d0, 0x0, 0x1220, 0x1d0, 0x1220, 0x2a0, 0x2a0, 0x1220, 0x2a0, 0x3, 0x0, {[{{@ipv6={@remote, @remote, [], [], 'batadv_slave_0\x00', 'lo\x00'}, 0x0, 0x1120, 0x1148, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'Q.931\x00'}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.cpu/syz1\x00'}}]}, @common=@unspec=@NFQUEUE3={0x28}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1350) syz_emit_ethernet(0x8a, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd600a3ff2005406", @ANYBLOB], 0x0) 17:17:40 executing program 4: r0 = syz_io_uring_setup(0x550, &(0x7f0000000500), &(0x7f0000eeb000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000040)=0x0) r3 = socket(0x22, 0x2, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r3, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6019, 0x0, 0x0, 0x0, 0x0) 17:17:40 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'bridge0\x00', 0x0}) bind$packet(r1, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @dev}, 0x14) sendto$inet6(r1, &(0x7f0000000280)="4103092cbbf2480401020200c52cf7c25975e005b02f0800eb2b2ff0dac8897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305f80a88161b6fd8f24286a57c3feffff", 0xfc13, 0x800, 0x0, 0x2f) [ 183.733290][ T7] rc_core: IR keymap rc-hauppauge not found [ 183.739268][ T7] Registered IR keymap rc-empty [ 183.752626][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 183.805523][ T4010] xt_cgroup: xt_cgroup: no path or classid specified 17:17:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x12f0, 0x1148, 0x1d0, 0x0, 0x1220, 0x1d0, 0x1220, 0x2a0, 0x2a0, 0x1220, 0x2a0, 0x3, 0x0, {[{{@ipv6={@remote, @remote, [], [], 'batadv_slave_0\x00', 'lo\x00'}, 0x0, 0x1120, 0x1148, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'Q.931\x00'}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.cpu/syz1\x00'}}]}, @common=@unspec=@NFQUEUE3={0x28}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1350) syz_emit_ethernet(0x8a, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd600a3ff2005406", @ANYBLOB], 0x0) 17:17:40 executing program 4: r0 = syz_io_uring_setup(0x550, &(0x7f0000000500), &(0x7f0000eeb000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000040)=0x0) r3 = socket(0x22, 0x2, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r3, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6019, 0x0, 0x0, 0x0, 0x0) 17:17:40 executing program 0: r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = openat$vhost_vsock(0xffffff9c, &(0x7f0000003c40), 0x2, 0x0) close(r2) [ 183.863441][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 183.904629][ T7] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 183.984691][ T7] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input5 [ 183.999771][ T4019] xt_cgroup: xt_cgroup: no path or classid specified [ 184.097481][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 184.143469][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 184.145831][ T4020] hub 9-0:1.0: USB hub found [ 184.193496][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 184.222054][ T4020] hub 9-0:1.0: 8 ports detected [ 184.233406][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 184.273448][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 184.313387][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 184.353337][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 184.383975][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 184.425711][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 184.463285][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 184.504558][ T7] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 184.517227][ T7] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 184.559606][ T7] usb 4-1: USB disconnect, device number 3 17:17:41 executing program 0: r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = openat$vhost_vsock(0xffffff9c, &(0x7f0000003c40), 0x2, 0x0) close(r2) 17:17:41 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'bridge0\x00', 0x0}) bind$packet(r1, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @dev}, 0x14) sendto$inet6(r1, &(0x7f0000000280)="4103092cbbf2480401020200c52cf7c25975e005b02f0800eb2b2ff0dac8897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305f80a88161b6fd8f24286a57c3feffff", 0xfc13, 0x800, 0x0, 0x2f) 17:17:41 executing program 1: r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = openat$vhost_vsock(0xffffff9c, &(0x7f0000003c40), 0x2, 0x0) close(r2) 17:17:41 executing program 3: r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000002300)={{0x12, 0x1, 0x0, 0xde, 0x75, 0x85, 0x0, 0x46d, 0xc291, 0x5de1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xce, 0xde, 0xbd}}]}}]}}, 0x0) syz_usb_connect$uac1(0x0, 0xfb, &(0x7f0000000c00)=ANY=[], 0x0) syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x0, 0x0, 0x0, {{}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}}}}]}}, 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[], 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000022c0)={0x2c, 0x0, &(0x7f00000021c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x88, &(0x7f00000001c0)=ANY=[@ANYBLOB="0466917de0f4d5a1d48a7a347fe2b84536a0e21b43d0e89c09fd5e51524fa3c5d890d0f2c083db833cb7994c15d429df553e653fcfd0b6aa5f86d563e61bc66a400d472162832448d91904029330e9ea233915286e6e55a8670cc0195b8ffa98b9a4df353f47472c2ba6279449a5220c9f", @ANYRES64=r1]) [ 185.423291][ T26] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 185.716137][ T26] usb 4-1: Using ep0 maxpacket: 16 [ 185.853341][ T26] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 185.879773][ T26] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 185.918092][ T26] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 185.945773][ T26] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 17:17:42 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:17:42 executing program 4: r0 = syz_io_uring_setup(0x550, &(0x7f0000000500), &(0x7f0000eeb000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000040)=0x0) r3 = socket(0x22, 0x2, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r3, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6019, 0x0, 0x0, 0x0, 0x0) 17:17:42 executing program 0: r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = openat$vhost_vsock(0xffffff9c, &(0x7f0000003c40), 0x2, 0x0) close(r2) 17:17:42 executing program 2: r0 = syz_io_uring_setup(0x550, &(0x7f0000000500), &(0x7f0000eeb000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000040)=0x0) r3 = socket(0x22, 0x2, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r3, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6019, 0x0, 0x0, 0x0, 0x0) 17:17:42 executing program 1: r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = openat$vhost_vsock(0xffffff9c, &(0x7f0000003c40), 0x2, 0x0) close(r2) [ 185.966872][ T26] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 17:17:42 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:17:42 executing program 1: r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = openat$vhost_vsock(0xffffff9c, &(0x7f0000003c40), 0x2, 0x0) close(r2) [ 186.074240][ T26] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 186.091181][ T26] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 17:17:42 executing program 2: r0 = syz_io_uring_setup(0x550, &(0x7f0000000500), &(0x7f0000eeb000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000040)=0x0) r3 = socket(0x22, 0x2, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r3, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6019, 0x0, 0x0, 0x0, 0x0) [ 186.136977][ T26] usb 4-1: Manufacturer: syz [ 186.194558][ T26] usb 4-1: config 0 descriptor?? [ 186.419624][ T4058] hub 9-0:1.0: USB hub found [ 186.469476][ T4036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.534162][ T4036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 186.580682][ T4058] hub 9-0:1.0: 8 ports detected [ 186.603316][ T4036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.641373][ T4036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 186.700294][ T4036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.747852][ T4036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 186.781908][ T4036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.866377][ T4036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 187.208313][ T26] rc_core: IR keymap rc-hauppauge not found [ 187.215176][ T26] Registered IR keymap rc-empty [ 187.251775][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.313466][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.355854][ T26] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 187.394580][ T26] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input6 [ 187.437952][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.473303][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.503876][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.554037][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.603731][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.638699][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.673638][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.703348][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.753395][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.793897][ T26] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 187.854818][ T26] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 187.882964][ T26] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 187.939474][ T26] usb 4-1: USB disconnect, device number 4 17:17:45 executing program 4: r0 = syz_io_uring_setup(0x550, &(0x7f0000000500), &(0x7f0000eeb000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000040)=0x0) r3 = socket(0x22, 0x2, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r3, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6019, 0x0, 0x0, 0x0, 0x0) 17:17:45 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:17:45 executing program 2: r0 = syz_io_uring_setup(0x550, &(0x7f0000000500), &(0x7f0000eeb000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000040)=0x0) r3 = socket(0x22, 0x2, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r3, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x6019, 0x0, 0x0, 0x0, 0x0) 17:17:45 executing program 3: r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000002300)={{0x12, 0x1, 0x0, 0xde, 0x75, 0x85, 0x0, 0x46d, 0xc291, 0x5de1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xce, 0xde, 0xbd}}]}}]}}, 0x0) syz_usb_connect$uac1(0x0, 0xfb, &(0x7f0000000c00)=ANY=[], 0x0) syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x0, 0x0, 0x0, {{}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}}}}]}}, 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[], 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000022c0)={0x2c, 0x0, &(0x7f00000021c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x88, &(0x7f00000001c0)=ANY=[@ANYBLOB="0466917de0f4d5a1d48a7a347fe2b84536a0e21b43d0e89c09fd5e51524fa3c5d890d0f2c083db833cb7994c15d429df553e653fcfd0b6aa5f86d563e61bc66a400d472162832448d91904029330e9ea233915286e6e55a8670cc0195b8ffa98b9a4df353f47472c2ba6279449a5220c9f", @ANYRES64=r1]) [ 188.993317][ T14] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 189.243273][ T14] usb 4-1: Using ep0 maxpacket: 16 [ 189.363696][ T14] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 189.402044][ T14] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 189.464493][ T14] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 189.502273][ T14] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 189.534936][ T14] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 189.643511][ T14] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 189.673375][ T14] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 189.740076][ T14] usb 4-1: Manufacturer: syz [ 189.786427][ T14] usb 4-1: config 0 descriptor?? [ 190.051748][ T4082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 190.111289][ T4082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 190.132387][ T4082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 190.144206][ T4082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 190.164419][ T4082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 190.180139][ T4082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 190.202825][ T4082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 190.226553][ T4082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 190.523269][ T14] rc_core: IR keymap rc-hauppauge not found [ 190.536273][ T14] Registered IR keymap rc-empty [ 190.565234][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 190.603327][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 190.643990][ T14] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 190.691673][ T14] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input7 [ 190.784222][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 190.843452][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 190.883553][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 190.914461][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 190.973300][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.013276][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.053421][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.083357][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.124159][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.163319][ T14] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.214735][ T14] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 191.238791][ T14] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 191.279330][ T14] usb 4-1: USB disconnect, device number 5 17:17:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[], 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) sendmsg$nl_route(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newtfilter={0x90, 0x2c, 0xd37, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xa}}, [@filter_kind_options=@f_flow={{0x9}, {0x60, 0x2, [@TCA_FLOW_ACT={0x5c, 0x9, 0x0, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PTYPE={0x6}, @TCA_SKBEDIT_PARMS={0x18}, @TCA_SKBEDIT_MARK={0x8}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x90}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 17:17:49 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:17:49 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:17:49 executing program 3: r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000002300)={{0x12, 0x1, 0x0, 0xde, 0x75, 0x85, 0x0, 0x46d, 0xc291, 0x5de1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xce, 0xde, 0xbd}}]}}]}}, 0x0) syz_usb_connect$uac1(0x0, 0xfb, &(0x7f0000000c00)=ANY=[], 0x0) syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x0, 0x0, 0x0, {{}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}}}}]}}, 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[], 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000022c0)={0x2c, 0x0, &(0x7f00000021c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x88, &(0x7f00000001c0)=ANY=[@ANYBLOB="0466917de0f4d5a1d48a7a347fe2b84536a0e21b43d0e89c09fd5e51524fa3c5d890d0f2c083db833cb7994c15d429df553e653fcfd0b6aa5f86d563e61bc66a400d472162832448d91904029330e9ea233915286e6e55a8670cc0195b8ffa98b9a4df353f47472c2ba6279449a5220c9f", @ANYRES64=r1]) 17:17:49 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:17:49 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) [ 192.821965][ T4094] __nla_validate_parse: 2 callbacks suppressed [ 192.821994][ T4094] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 192.936263][ T4106] Zero length message leads to an empty skb 17:17:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[], 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) sendmsg$nl_route(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newtfilter={0x90, 0x2c, 0xd37, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xa}}, [@filter_kind_options=@f_flow={{0x9}, {0x60, 0x2, [@TCA_FLOW_ACT={0x5c, 0x9, 0x0, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PTYPE={0x6}, @TCA_SKBEDIT_PARMS={0x18}, @TCA_SKBEDIT_MARK={0x8}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x90}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) [ 193.037995][ T4114] hub 9-0:1.0: USB hub found [ 193.043473][ T3717] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 193.064888][ T4114] hub 9-0:1.0: 8 ports detected [ 193.244221][ T4117] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 193.323258][ T3717] usb 4-1: Using ep0 maxpacket: 16 17:17:50 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[], 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) sendmsg$nl_route(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newtfilter={0x90, 0x2c, 0xd37, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xa}}, [@filter_kind_options=@f_flow={{0x9}, {0x60, 0x2, [@TCA_FLOW_ACT={0x5c, 0x9, 0x0, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PTYPE={0x6}, @TCA_SKBEDIT_PARMS={0x18}, @TCA_SKBEDIT_MARK={0x8}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x90}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) [ 193.473608][ T3717] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 193.515751][ T3717] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 193.581096][ T3717] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 193.692749][ T3717] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 193.716643][ T4127] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 193.779647][ T3717] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 17:17:50 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[], 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) sendmsg$nl_route(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newtfilter={0x90, 0x2c, 0xd37, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xa}}, [@filter_kind_options=@f_flow={{0x9}, {0x60, 0x2, [@TCA_FLOW_ACT={0x5c, 0x9, 0x0, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PTYPE={0x6}, @TCA_SKBEDIT_PARMS={0x18}, @TCA_SKBEDIT_MARK={0x8}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x90}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) [ 193.933559][ T3717] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 193.978369][ T3717] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 194.052012][ T3717] usb 4-1: Manufacturer: syz [ 194.207274][ T3717] usb 4-1: config 0 descriptor?? [ 194.479752][ T4095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.513717][ T4095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 194.557625][ T4095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.598889][ T4095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 194.609266][ T4136] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 194.671523][ T4095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.746542][ T4095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 17:17:51 executing program 2: r0 = socket$igmp6(0xa, 0x3, 0x2) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1, 0x7}, 0x1c) [ 194.891524][ T4095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.957105][ T4095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 17:17:51 executing program 2: r0 = socket$igmp6(0xa, 0x3, 0x2) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1, 0x7}, 0x1c) 17:17:52 executing program 2: r0 = socket$igmp6(0xa, 0x3, 0x2) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1, 0x7}, 0x1c) [ 195.453589][ T3717] rc_core: IR keymap rc-hauppauge not found [ 195.459845][ T3717] Registered IR keymap rc-empty [ 195.490389][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 17:17:52 executing program 2: r0 = socket$igmp6(0xa, 0x3, 0x2) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1, 0x7}, 0x1c) [ 195.593327][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 195.664127][ T3717] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 195.726267][ T3717] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input8 [ 195.824189][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 195.893381][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 195.944709][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 196.003615][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 196.083280][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 196.143395][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 196.223317][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 196.304106][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 196.343547][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 196.433681][ T3717] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 196.545828][ T3717] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 196.584532][ T3717] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 196.678372][ T3717] usb 4-1: USB disconnect, device number 6 [ 199.145860][ T1253] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.152179][ T1253] ieee802154 phy1 wpan1: encryption failed: -22 17:17:59 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:17:59 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000080)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4fc, 0x3bc, 0x208, 0x0, 0x0, 0x0, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x6, 0x0, {[{{@ipv6={@private2, @dev, [], [], 'bond_slave_0\x00', 'dvmrp1\x00'}, 0x0, 0xa4, 0xe8}, @SNPT={0x44, 'SNPT\x00', 0x0, {@ipv6=@private0, @ipv6=@private0}}}, {{@uncond, 0x0, 0xa4, 0xd8}, @common=@inet=@SET3={0x34}}, {{@ipv6={@private0, @empty, [], [], 'veth0\x00', 'veth0\x00'}, 0x0, 0xa4, 0xc8}, @HL={0x24}}, {{@uncond, 0x0, 0xa4, 0xc8}, @HL={0x24}}, {{@uncond, 0x0, 0xa4, 0xe4}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "8c1038776afd6a23c994dfd225891ae7e3402983b4baf60c8f7366c90640"}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x558) 17:17:59 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:17:59 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000010001fff000000000100000000000000", @ANYRES32, @ANYBLOB="e3ffffff00000000140012800b000100626174616476"], 0x68}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x196e}, 0x0) 17:17:59 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:17:59 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x20, 0x0, 0x0, 0xfffff00c}, {0x6}]}, 0x10) sendmmsg(r0, &(0x7f0000001e00), 0x3fffffffffffe36, 0x0) 17:17:59 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000080)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4fc, 0x3bc, 0x208, 0x0, 0x0, 0x0, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x6, 0x0, {[{{@ipv6={@private2, @dev, [], [], 'bond_slave_0\x00', 'dvmrp1\x00'}, 0x0, 0xa4, 0xe8}, @SNPT={0x44, 'SNPT\x00', 0x0, {@ipv6=@private0, @ipv6=@private0}}}, {{@uncond, 0x0, 0xa4, 0xd8}, @common=@inet=@SET3={0x34}}, {{@ipv6={@private0, @empty, [], [], 'veth0\x00', 'veth0\x00'}, 0x0, 0xa4, 0xc8}, @HL={0x24}}, {{@uncond, 0x0, 0xa4, 0xc8}, @HL={0x24}}, {{@uncond, 0x0, 0xa4, 0xe4}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "8c1038776afd6a23c994dfd225891ae7e3402983b4baf60c8f7366c90640"}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x558) [ 202.728405][ T4164] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. 17:17:59 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000080)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4fc, 0x3bc, 0x208, 0x0, 0x0, 0x0, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x6, 0x0, {[{{@ipv6={@private2, @dev, [], [], 'bond_slave_0\x00', 'dvmrp1\x00'}, 0x0, 0xa4, 0xe8}, @SNPT={0x44, 'SNPT\x00', 0x0, {@ipv6=@private0, @ipv6=@private0}}}, {{@uncond, 0x0, 0xa4, 0xd8}, @common=@inet=@SET3={0x34}}, {{@ipv6={@private0, @empty, [], [], 'veth0\x00', 'veth0\x00'}, 0x0, 0xa4, 0xc8}, @HL={0x24}}, {{@uncond, 0x0, 0xa4, 0xc8}, @HL={0x24}}, {{@uncond, 0x0, 0xa4, 0xe4}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "8c1038776afd6a23c994dfd225891ae7e3402983b4baf60c8f7366c90640"}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x558) [ 202.824117][ T4164] device batadv0 entered promiscuous mode [ 202.937774][ T4164] 8021q: adding VLAN 0 to HW filter on device batadv0 17:17:59 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000010001fff000000000100000000000000", @ANYRES32, @ANYBLOB="e3ffffff00000000140012800b000100626174616476"], 0x68}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x196e}, 0x0) [ 203.028847][ T4176] hub 9-0:1.0: USB hub found 17:17:59 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000080)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4fc, 0x3bc, 0x208, 0x0, 0x0, 0x0, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x6, 0x0, {[{{@ipv6={@private2, @dev, [], [], 'bond_slave_0\x00', 'dvmrp1\x00'}, 0x0, 0xa4, 0xe8}, @SNPT={0x44, 'SNPT\x00', 0x0, {@ipv6=@private0, @ipv6=@private0}}}, {{@uncond, 0x0, 0xa4, 0xd8}, @common=@inet=@SET3={0x34}}, {{@ipv6={@private0, @empty, [], [], 'veth0\x00', 'veth0\x00'}, 0x0, 0xa4, 0xc8}, @HL={0x24}}, {{@uncond, 0x0, 0xa4, 0xc8}, @HL={0x24}}, {{@uncond, 0x0, 0xa4, 0xe4}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "8c1038776afd6a23c994dfd225891ae7e3402983b4baf60c8f7366c90640"}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x558) [ 203.060877][ T4176] hub 9-0:1.0: 8 ports detected 17:18:00 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) [ 203.318495][ T4186] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. 17:18:00 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x20, 0x0, 0x0, 0xfffff00c}, {0x6}]}, 0x10) sendmmsg(r0, &(0x7f0000001e00), 0x3fffffffffffe36, 0x0) 17:18:00 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000010001fff000000000100000000000000", @ANYRES32, @ANYBLOB="e3ffffff00000000140012800b000100626174616476"], 0x68}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x196e}, 0x0) [ 204.067656][ T4202] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. 17:18:06 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00'}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x4a108000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x77, 0x20a01) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect={0x0, 0x5517, 0x48000000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x208e24b) ioctl$USBDEVFS_IOCTL(r2, 0x8108551b, &(0x7f0000000380)) socket$inet(0x2, 0x0, 0x2) 17:18:06 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:06 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000010001fff000000000100000000000000", @ANYRES32, @ANYBLOB="e3ffffff00000000140012800b000100626174616476"], 0x68}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x196e}, 0x0) 17:18:06 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x20, 0x0, 0x0, 0xfffff00c}, {0x6}]}, 0x10) sendmmsg(r0, &(0x7f0000001e00), 0x3fffffffffffe36, 0x0) 17:18:06 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:06 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) [ 209.617980][ T4220] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 210.083502][ T4233] hub 9-0:1.0: USB hub found 17:18:07 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) [ 210.256554][ T4233] hub 9-0:1.0: 8 ports detected 17:18:07 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x20, 0x0, 0x0, 0xfffff00c}, {0x6}]}, 0x10) sendmmsg(r0, &(0x7f0000001e00), 0x3fffffffffffe36, 0x0) 17:18:07 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:08 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:08 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:08 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:10 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:10 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:10 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:10 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:10 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:10 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) [ 214.463566][ T4279] BUG: sleeping function called from invalid context at include/linux/percpu-rwsem.h:49 [ 214.473980][ T4279] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4279, name: syz-executor.2 [ 214.483464][ T4279] preempt_count: 1, expected: 0 [ 214.488585][ T4279] RCU nest depth: 0, expected: 0 [ 214.494354][ T4279] 3 locks held by syz-executor.2/4279: [ 214.499855][ T4279] #0: ffffffff8df504f0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 [ 214.508682][ T4279] #1: ffffffff8df505a8 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x50d/0x780 [ 214.517801][ T4279] #2: ffff88807b59e938 (k-clock-AF_INET){+++.}-{2:2}, at: l2tp_tunnel_register+0x126/0x1210 [ 214.528146][ T4279] Preemption disabled at: [ 214.528158][ T4279] [<0000000000000000>] 0x0 [ 214.537000][ T4279] CPU: 1 PID: 4279 Comm: syz-executor.2 Not tainted 6.1.0-rc6-syzkaller-00015-gc3eb11fbb826 #0 [ 214.547545][ T4279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 214.557620][ T4279] Call Trace: [ 214.561016][ T4279] [ 214.563985][ T4279] dump_stack_lvl+0xd1/0x138 [ 214.568610][ T4279] __might_resched.cold+0x222/0x26b [ 214.573856][ T4279] cpus_read_lock+0x1b/0x140 [ 214.578487][ T4279] static_key_slow_inc+0x12/0x20 [ 214.583468][ T4279] setup_udp_tunnel_sock+0x3e1/0x550 [ 214.588815][ T4279] l2tp_tunnel_register+0xc51/0x1210 [ 214.594168][ T4279] ? l2tp_tunnel_del_work+0x780/0x780 [ 214.599584][ T4279] ? debug_object_free+0x360/0x360 [ 214.604742][ T4279] ? l2tp_recv_common+0x3100/0x3100 [ 214.609982][ T4279] ? l2tp_tunnel_delete+0x50/0x50 [ 214.615060][ T4279] ? l2tp_tunnel_create+0x2bf/0x4b0 [ 214.620303][ T4279] ? l2tp_tunnel_create+0x3c6/0x4b0 [ 214.625553][ T4279] l2tp_nl_cmd_tunnel_create+0x3d6/0x8b0 [ 214.631224][ T4279] ? l2tp_tunnel_notify.constprop.0+0x160/0x160 [ 214.637512][ T4279] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1b7/0x290 [ 214.644937][ T4279] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xaf/0x290 [ 214.652266][ T4279] genl_family_rcv_msg_doit+0x228/0x320 [ 214.657852][ T4279] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x290/0x290 [ 214.665526][ T4279] ? ns_capable+0xdd/0x100 [ 214.669977][ T4279] genl_rcv_msg+0x445/0x780 [ 214.674524][ T4279] ? genl_start+0x670/0x670 [ 214.679047][ T4279] ? l2tp_tunnel_notify.constprop.0+0x160/0x160 [ 214.685324][ T4279] ? ref_tracker_free+0x374/0x6b0 [ 214.690371][ T4279] ? lock_release+0x810/0x810 [ 214.695089][ T4279] ? ref_tracker_dir_exit+0x3e0/0x3e0 [ 214.700509][ T4279] netlink_rcv_skb+0x157/0x430 [ 214.705312][ T4279] ? genl_start+0x670/0x670 [ 214.709931][ T4279] ? netlink_ack+0xd60/0xd60 [ 214.714567][ T4279] ? netlink_deliver_tap+0x1b1/0xc50 [ 214.719897][ T4279] genl_rcv+0x28/0x40 [ 214.723904][ T4279] netlink_unicast+0x547/0x7f0 [ 214.728715][ T4279] ? netlink_attachskb+0x890/0x890 [ 214.733870][ T4279] ? __virt_addr_valid+0x61/0x2e0 [ 214.738968][ T4279] ? __phys_addr_symbol+0x30/0x70 [ 214.744031][ T4279] ? __check_object_size+0x2e2/0x5a0 [ 214.749356][ T4279] netlink_sendmsg+0x91b/0xe10 [ 214.754188][ T4279] ? netlink_unicast+0x7f0/0x7f0 [ 214.759171][ T4279] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 214.764626][ T4279] ? netlink_unicast+0x7f0/0x7f0 [ 214.769671][ T4279] sock_sendmsg+0xd3/0x120 [ 214.774182][ T4279] ____sys_sendmsg+0x712/0x8c0 [ 214.779036][ T4279] ? copy_msghdr_from_user+0xfc/0x150 [ 214.784476][ T4279] ? kernel_sendmsg+0x50/0x50 [ 214.789210][ T4279] ? futex_unqueue+0xb7/0x120 [ 214.793933][ T4279] ___sys_sendmsg+0x110/0x1b0 [ 214.798651][ T4279] ? do_recvmmsg+0x6e0/0x6e0 [ 214.803280][ T4279] ? __fget_files+0x248/0x440 [ 214.808080][ T4279] ? lock_downgrade+0x6e0/0x6e0 [ 214.813000][ T4279] ? __fget_files+0x26a/0x440 [ 214.817717][ T4279] ? __fget_light+0xe5/0x270 [ 214.822342][ T4279] __sys_sendmsg+0xf7/0x1c0 [ 214.826874][ T4279] ? __sys_sendmsg_sock+0x40/0x40 [ 214.831942][ T4279] ? restore_fpregs_from_fpstate+0xc1/0x1c0 [ 214.837883][ T4279] ? syscall_enter_from_user_mode+0x26/0xb0 [ 214.843839][ T4279] ? lockdep_hardirqs_on+0x7d/0x100 [ 214.850378][ T4279] do_syscall_64+0x39/0xb0 [ 214.854829][ T4279] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 214.860762][ T4279] RIP: 0033:0x7fe44d68c0d9 [ 214.865201][ T4279] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 214.884915][ T4279] RSP: 002b:00007fe44e420168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 214.893524][ T4279] RAX: ffffffffffffffda RBX: 00007fe44d7ac120 RCX: 00007fe44d68c0d9 [ 214.901514][ T4279] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 000000000000000c [ 214.909591][ T4279] RBP: 00007fe44d6e7ae9 R08: 0000000000000000 R09: 0000000000000000 [ 214.917663][ T4279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 214.925739][ T4279] R13: 00007fe44d8cfb1f R14: 00007fe44e420300 R15: 0000000000022000 [ 214.933954][ T4279] 17:18:12 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:13 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:13 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:13 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:13 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:13 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:14 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:14 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:14 executing program 2: sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x0) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f00000002c0)) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') preadv(r4, &(0x7f0000000940)=[{0x0}, {&(0x7f00000008c0)=""/106, 0x6a}, {&(0x7f00000007c0)=""/242, 0xf2}, {&(0x7f0000001380)=""/239, 0xef}], 0x4, 0x0, 0x0) writev(r4, &(0x7f0000000500)=[{&(0x7f0000000480)="d55cd3683c0b39befda0447d42ce968c213a62d388e80cb92087414395e8a8f526246c84b4d085df9b4cac9f9632977d7e5fafb406bd908452a5cefa638e930094e578fdfef8336cf11ca30ae6ca0185ca6a9df7003218b279d07610fd777dd7c1d35a4b619fea69a6ff6848e8226044ac0934de120b5551670d53", 0x7b}, {&(0x7f0000000580)="993efbb096cfac9cfd1d8f1c1e6c8b93f25a11af71481bac837d7104996cd590f7d6d0654146a36bfd715f781895a874c449a4081757b993320287bc1b454f002a24a0820e66240fb409312e7f5692175f", 0x51}, {&(0x7f0000000100)="28e320cd48ed877610f75d43b37724cdfc21dc1080b32b54af1610b6ecc22cb56ff7c1ba76a4c02f15841ed8e5647871", 0x30}], 0x3) 17:18:14 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:14 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:15 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:15 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000040)={0x0, 0x0, 0x1e00, 0x0, 0x0, "010c83306eb970714aeb338c8c322c8b5dc87c"}) 17:18:15 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000040)={0x0, 0x0, 0x1e00, 0x0, 0x0, "010c83306eb970714aeb338c8c322c8b5dc87c"}) 17:18:16 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000040)={0x0, 0x0, 0x1e00, 0x0, 0x0, "010c83306eb970714aeb338c8c322c8b5dc87c"}) 17:18:16 executing program 4: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fspick(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xc) 17:18:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000040)={0x0, 0x0, 0x1e00, 0x0, 0x0, "010c83306eb970714aeb338c8c322c8b5dc87c"}) 17:18:16 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:16 executing program 4: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fspick(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xc) 17:18:16 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000592c0)={0x8, [], 0x20, "f84b8f4fb3901a"}) r2 = memfd_create(&(0x7f0000000000)='y\x105%\xfa,\x1f\x99\xa2\xc9\x8e\xcd\xfc\xfa\xf6\x12\x95^\xdfT\xe2=\x0e~F\xcds', 0x2) fcntl$addseals(0xffffffffffffffff, 0x409, 0x0) r3 = syz_io_uring_setup(0x182, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff3000/0xd000)=nil, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_NOP={0x0, 0x4}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, &(0x7f0000000140)=0x80c9, 0x0, 0x4) r6 = socket$inet(0x2, 0x6, 0x0) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000180)={0x9, 0x0, 0x3}) syz_open_dev$usbfs(&(0x7f0000000180), 0x76, 0x1) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x8108551b, &(0x7f0000000040)) syz_io_uring_submit(r4, 0x0, &(0x7f0000000480)=@IORING_OP_OPENAT={0x12, 0x40, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000440)='./file0\x00', 0x4, 0x219180, 0x12345}, 0x728) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x22, 0x0, @fd, 0xffffffff, 0x0, 0x4, 0x7, 0x0, {0x0, r7}}, 0x3f) syz_io_uring_submit(r4, r5, &(0x7f0000000280)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r6, 0x80, &(0x7f0000000200)=@in={0x2, 0x0, @private}}, 0x0) io_uring_enter(r3, 0x45f5, 0x0, 0x0, 0x0, 0x4) 17:18:16 executing program 4: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fspick(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xc) 17:18:17 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:17 executing program 4: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fspick(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xc) 17:18:17 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/exe\x00', 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x7788, &(0x7f0000000240), &(0x7f0000002000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_tables_matches\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000400)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x8, 0x0, &(0x7f0000000140)=""/30, 0x1e}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{&(0x7f0000001380)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd\x00') r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r6, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0xe000, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '\n'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0xa, '\n'}], 0x18, 0x500}}], 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x3c, r8, 0x923, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r9}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r8, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x32}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r5) getdents(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r2, 0x2ff, 0x0, 0x0, 0x0, 0x0) 17:18:17 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r0, 0x0, 0xc, 0x0, &(0x7f0000000040)=0x2) 17:18:17 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r0, 0x0, 0xc, 0x0, &(0x7f0000000040)=0x2) 17:18:17 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000592c0)={0x8, [], 0x20, "f84b8f4fb3901a"}) r2 = memfd_create(&(0x7f0000000000)='y\x105%\xfa,\x1f\x99\xa2\xc9\x8e\xcd\xfc\xfa\xf6\x12\x95^\xdfT\xe2=\x0e~F\xcds', 0x2) fcntl$addseals(0xffffffffffffffff, 0x409, 0x0) r3 = syz_io_uring_setup(0x182, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff3000/0xd000)=nil, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_NOP={0x0, 0x4}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, &(0x7f0000000140)=0x80c9, 0x0, 0x4) r6 = socket$inet(0x2, 0x6, 0x0) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000180)={0x9, 0x0, 0x3}) syz_open_dev$usbfs(&(0x7f0000000180), 0x76, 0x1) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x8108551b, &(0x7f0000000040)) syz_io_uring_submit(r4, 0x0, &(0x7f0000000480)=@IORING_OP_OPENAT={0x12, 0x40, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000440)='./file0\x00', 0x4, 0x219180, 0x12345}, 0x728) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x22, 0x0, @fd, 0xffffffff, 0x0, 0x4, 0x7, 0x0, {0x0, r7}}, 0x3f) syz_io_uring_submit(r4, r5, &(0x7f0000000280)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r6, 0x80, &(0x7f0000000200)=@in={0x2, 0x0, @private}}, 0x0) io_uring_enter(r3, 0x45f5, 0x0, 0x0, 0x0, 0x4) 17:18:17 executing program 1: r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000020000082505a1a44b00010203010902e986ef4c89"], 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(r1) 17:18:18 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r0, 0x0, 0xc, 0x0, &(0x7f0000000040)=0x2) 17:18:18 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r0, 0x0, 0xc, 0x0, &(0x7f0000000040)=0x2) 17:18:18 executing program 3: syz_emit_vhci(&(0x7f0000000140)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x0, 0xa}}}}, 0x17) 17:18:18 executing program 3: syz_emit_vhci(&(0x7f0000000140)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x0, 0xa}}}}, 0x17) 17:18:18 executing program 4: r0 = memfd_create(&(0x7f00000005c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c\xfa\xb4q\xbb\x7fN\xd1\r%;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbf\x8c\x19\r\x81j\x88d\x9d%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\x12?\xc7zL\x01\r-~\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x85\xda\xa3\xe1\xc3\x84\xa0\xc9+\xad\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\x98[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;FA\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xd4\xb5\x1ae\xc1p0U\xb8\xb2\x9a\xcbA\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe6\xaf\t\x94\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc', 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x97052, r0, 0x0) syz_io_uring_setup(0x0, &(0x7f00000001c0), &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) [ 221.776331][ T7] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 222.043495][ T7] usb 2-1: Using ep0 maxpacket: 8 17:18:18 executing program 3: syz_emit_vhci(&(0x7f0000000140)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x0, 0xa}}}}, 0x17) 17:18:18 executing program 4: r0 = memfd_create(&(0x7f00000005c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c\xfa\xb4q\xbb\x7fN\xd1\r%;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbf\x8c\x19\r\x81j\x88d\x9d%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\x12?\xc7zL\x01\r-~\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x85\xda\xa3\xe1\xc3\x84\xa0\xc9+\xad\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\x98[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;FA\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xd4\xb5\x1ae\xc1p0U\xb8\xb2\x9a\xcbA\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe6\xaf\t\x94\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc', 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x97052, r0, 0x0) syz_io_uring_setup(0x0, &(0x7f00000001c0), &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) [ 222.163397][ T7] usb 2-1: config index 0 descriptor too short (expected 34537, got 92) [ 222.204659][ T7] usb 2-1: config 76 has too many interfaces: 239, using maximum allowed: 32 17:18:19 executing program 0: r0 = memfd_create(&(0x7f00000005c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c\xfa\xb4q\xbb\x7fN\xd1\r%;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbf\x8c\x19\r\x81j\x88d\x9d%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\x12?\xc7zL\x01\r-~\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x85\xda\xa3\xe1\xc3\x84\xa0\xc9+\xad\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\x98[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;FA\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xd4\xb5\x1ae\xc1p0U\xb8\xb2\x9a\xcbA\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe6\xaf\t\x94\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc', 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x97052, r0, 0x0) syz_io_uring_setup(0x0, &(0x7f00000001c0), &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 17:18:19 executing program 3: syz_emit_vhci(&(0x7f0000000140)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x0, 0xa}}}}, 0x17) [ 222.289294][ T7] usb 2-1: config 76 has an invalid descriptor of length 0, skipping remainder of the config 17:18:19 executing program 5: r0 = memfd_create(&(0x7f00000005c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c\xfa\xb4q\xbb\x7fN\xd1\r%;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbf\x8c\x19\r\x81j\x88d\x9d%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\x12?\xc7zL\x01\r-~\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x85\xda\xa3\xe1\xc3\x84\xa0\xc9+\xad\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\x98[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;FA\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xd4\xb5\x1ae\xc1p0U\xb8\xb2\x9a\xcbA\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe6\xaf\t\x94\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc', 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x97052, r0, 0x0) syz_io_uring_setup(0x0, &(0x7f00000001c0), &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) [ 222.368717][ T7] usb 2-1: config 76 has 0 interfaces, different from the descriptor's value: 239 [ 222.573700][ T7] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.4b [ 222.590617][ T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.609015][ T7] usb 2-1: Product: syz [ 222.622954][ T7] usb 2-1: Manufacturer: syz [ 222.637602][ T7] usb 2-1: SerialNumber: syz 17:18:19 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000592c0)={0x8, [], 0x20, "f84b8f4fb3901a"}) r2 = memfd_create(&(0x7f0000000000)='y\x105%\xfa,\x1f\x99\xa2\xc9\x8e\xcd\xfc\xfa\xf6\x12\x95^\xdfT\xe2=\x0e~F\xcds', 0x2) fcntl$addseals(0xffffffffffffffff, 0x409, 0x0) r3 = syz_io_uring_setup(0x182, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff3000/0xd000)=nil, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_NOP={0x0, 0x4}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, &(0x7f0000000140)=0x80c9, 0x0, 0x4) r6 = socket$inet(0x2, 0x6, 0x0) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000180)={0x9, 0x0, 0x3}) syz_open_dev$usbfs(&(0x7f0000000180), 0x76, 0x1) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x8108551b, &(0x7f0000000040)) syz_io_uring_submit(r4, 0x0, &(0x7f0000000480)=@IORING_OP_OPENAT={0x12, 0x40, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000440)='./file0\x00', 0x4, 0x219180, 0x12345}, 0x728) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x22, 0x0, @fd, 0xffffffff, 0x0, 0x4, 0x7, 0x0, {0x0, r7}}, 0x3f) syz_io_uring_submit(r4, r5, &(0x7f0000000280)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r6, 0x80, &(0x7f0000000200)=@in={0x2, 0x0, @private}}, 0x0) io_uring_enter(r3, 0x45f5, 0x0, 0x0, 0x0, 0x4) [ 223.132748][ T7] usb 2-1: USB disconnect, device number 2 17:18:20 executing program 1: r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000020000082505a1a44b00010203010902e986ef4c89"], 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(r1) 17:18:20 executing program 0: r0 = memfd_create(&(0x7f00000005c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c\xfa\xb4q\xbb\x7fN\xd1\r%;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbf\x8c\x19\r\x81j\x88d\x9d%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\x12?\xc7zL\x01\r-~\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x85\xda\xa3\xe1\xc3\x84\xa0\xc9+\xad\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\x98[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;FA\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xd4\xb5\x1ae\xc1p0U\xb8\xb2\x9a\xcbA\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe6\xaf\t\x94\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc', 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x97052, r0, 0x0) syz_io_uring_setup(0x0, &(0x7f00000001c0), &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 17:18:20 executing program 5: r0 = memfd_create(&(0x7f00000005c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c\xfa\xb4q\xbb\x7fN\xd1\r%;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbf\x8c\x19\r\x81j\x88d\x9d%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\x12?\xc7zL\x01\r-~\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x85\xda\xa3\xe1\xc3\x84\xa0\xc9+\xad\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\x98[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;FA\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xd4\xb5\x1ae\xc1p0U\xb8\xb2\x9a\xcbA\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe6\xaf\t\x94\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc', 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x97052, r0, 0x0) syz_io_uring_setup(0x0, &(0x7f00000001c0), &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 17:18:20 executing program 4: r0 = memfd_create(&(0x7f00000005c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c\xfa\xb4q\xbb\x7fN\xd1\r%;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbf\x8c\x19\r\x81j\x88d\x9d%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\x12?\xc7zL\x01\r-~\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x85\xda\xa3\xe1\xc3\x84\xa0\xc9+\xad\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\x98[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;FA\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xd4\xb5\x1ae\xc1p0U\xb8\xb2\x9a\xcbA\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe6\xaf\t\x94\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc', 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x97052, r0, 0x0) syz_io_uring_setup(0x0, &(0x7f00000001c0), &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 17:18:20 executing program 3: r0 = openat$damon_mk_contexts(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) write$damon_contexts(r0, &(0x7f0000000280)=[{' ', './file1'}, {' ', './file0'}, {' ', './file1'}, {' ', './file1/file0'}, {' ', './file0'}, {' ', './file1'}, {' ', './file1'}, {' ', './file0'}, {' ', './file1'}], 0x7ffff) 17:18:20 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000592c0)={0x8, [], 0x20, "f84b8f4fb3901a"}) r2 = memfd_create(&(0x7f0000000000)='y\x105%\xfa,\x1f\x99\xa2\xc9\x8e\xcd\xfc\xfa\xf6\x12\x95^\xdfT\xe2=\x0e~F\xcds', 0x2) fcntl$addseals(0xffffffffffffffff, 0x409, 0x0) r3 = syz_io_uring_setup(0x182, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff3000/0xd000)=nil, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_NOP={0x0, 0x4}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, &(0x7f0000000140)=0x80c9, 0x0, 0x4) r6 = socket$inet(0x2, 0x6, 0x0) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000180)={0x9, 0x0, 0x3}) syz_open_dev$usbfs(&(0x7f0000000180), 0x76, 0x1) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x8108551b, &(0x7f0000000040)) syz_io_uring_submit(r4, 0x0, &(0x7f0000000480)=@IORING_OP_OPENAT={0x12, 0x40, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000440)='./file0\x00', 0x4, 0x219180, 0x12345}, 0x728) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x22, 0x0, @fd, 0xffffffff, 0x0, 0x4, 0x7, 0x0, {0x0, r7}}, 0x3f) syz_io_uring_submit(r4, r5, &(0x7f0000000280)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r6, 0x80, &(0x7f0000000200)=@in={0x2, 0x0, @private}}, 0x0) io_uring_enter(r3, 0x45f5, 0x0, 0x0, 0x0, 0x4) 17:18:20 executing program 5: r0 = memfd_create(&(0x7f00000005c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c\xfa\xb4q\xbb\x7fN\xd1\r%;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbf\x8c\x19\r\x81j\x88d\x9d%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\x12?\xc7zL\x01\r-~\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x85\xda\xa3\xe1\xc3\x84\xa0\xc9+\xad\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\x98[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;FA\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xd4\xb5\x1ae\xc1p0U\xb8\xb2\x9a\xcbA\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe6\xaf\t\x94\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc', 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x97052, r0, 0x0) syz_io_uring_setup(0x0, &(0x7f00000001c0), &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 17:18:20 executing program 3: r0 = openat$damon_mk_contexts(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) write$damon_contexts(r0, &(0x7f0000000280)=[{' ', './file1'}, {' ', './file0'}, {' ', './file1'}, {' ', './file1/file0'}, {' ', './file0'}, {' ', './file1'}, {' ', './file1'}, {' ', './file0'}, {' ', './file1'}], 0x7ffff) 17:18:20 executing program 0: r0 = memfd_create(&(0x7f00000005c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c\xfa\xb4q\xbb\x7fN\xd1\r%;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbf\x8c\x19\r\x81j\x88d\x9d%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\x12?\xc7zL\x01\r-~\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x85\xda\xa3\xe1\xc3\x84\xa0\xc9+\xad\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\x98[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;FA\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xd4\xb5\x1ae\xc1p0U\xb8\xb2\x9a\xcbA\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe6\xaf\t\x94\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc', 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x97052, r0, 0x0) syz_io_uring_setup(0x0, &(0x7f00000001c0), &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 17:18:20 executing program 4: r0 = memfd_create(&(0x7f00000005c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c\xfa\xb4q\xbb\x7fN\xd1\r%;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbf\x8c\x19\r\x81j\x88d\x9d%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\x12?\xc7zL\x01\r-~\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x85\xda\xa3\xe1\xc3\x84\xa0\xc9+\xad\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\x98[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;FA\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xd4\xb5\x1ae\xc1p0U\xb8\xb2\x9a\xcbA\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe6\xaf\t\x94\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc', 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x97052, r0, 0x0) syz_io_uring_setup(0x0, &(0x7f00000001c0), &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 17:18:20 executing program 3: r0 = openat$damon_mk_contexts(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) write$damon_contexts(r0, &(0x7f0000000280)=[{' ', './file1'}, {' ', './file0'}, {' ', './file1'}, {' ', './file1/file0'}, {' ', './file0'}, {' ', './file1'}, {' ', './file1'}, {' ', './file0'}, {' ', './file1'}], 0x7ffff) 17:18:20 executing program 5: r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000020000082505a1a44b00010203010902e986ef4c89"], 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(r1) [ 224.413502][ T3721] usb 2-1: new high-speed USB device number 3 using dummy_hcd