last executing test programs: 10.672158121s ago: executing program 1 (id=48): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_HEADER(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000000c0601010000000000000000000000040500"], 0x28}, 0x1, 0x0, 0x0, 0x5}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) listen(0xffffffffffffffff, 0x5) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000480)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x8080, 0x7, 0xbb, 0xffffd45d, {{0x8, 0x4, 0x3, 0x0, 0x20, 0x65, 0x0, 0x0, 0x2f, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x25}, {[@timestamp_addr={0x44, 0xc, 0xd, 0x1, 0x5, [{@local, 0x4}]}]}}}}}) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x4, r2}, 0x38) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={0x0, 0x0, 0x34}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = socket(0x2d, 0x2, 0x0) connect$netlink(r4, &(0x7f00000001c0)=@unspec={0x2d}, 0xc) write$6lowpan_control(r3, &(0x7f0000000080)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r5) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) 9.218512187s ago: executing program 1 (id=54): r0 = openat$sequencer2(0xffffff9c, 0x0, 0x20940, 0x0) ioctl$SNDCTL_SEQ_RESET(r0, 0x5100) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f0000001900)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20020000}, 0xc, &(0x7f00000018c0)={0x0, 0xbb8}}, 0x8800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000100)={0x32, 0x0, '\x00', [@pad1, @pad1]}, 0x10) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0xffd8) 8.216947493s ago: executing program 3 (id=55): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000180)="94", 0xf000}, {0x0}], 0x2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x10, &(0x7f0000000400)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x85, &(0x7f0000000480)={0x0, @in={{0x2, 0x0, @empty}}, 0x7, 0x23}, 0x90) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f00000006c0)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x1, @remote}, 0xa, 0x0, 0x3}}, 0x26) sendmmsg$inet(r1, &(0x7f0000000700)=[{{0x0, 0x0, &(0x7f0000000740)}}], 0x1a000, 0x8040) 7.93208786s ago: executing program 1 (id=57): socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x6, 0x371, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_emit_vhci(&(0x7f0000001a40)=ANY=[@ANYBLOB], 0x6) mq_open(0x0, 0x800, 0x80, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r1, &(0x7f00000000c0)={0x1d, r2, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r1, &(0x7f0000000140)={0x1d, r2, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r1, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) 7.744234465s ago: executing program 3 (id=58): move_pages(0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0) ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x4) socket$inet6_sctp(0xa, 0x4, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000580), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000005c0), 0x2, 0x141102) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000640)="94", 0xf000}, {0x0}], 0x2) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000700)={0xaa, 0x358}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000740)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa04, &(0x7f0000000780)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 6.612536423s ago: executing program 0 (id=59): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{0x0}], 0x1) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_emit_vhci(&(0x7f0000001a40)=ANY=[@ANYBLOB], 0x6) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r1, &(0x7f00000000c0)={0x1d, r2, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r1, &(0x7f0000000140)={0x1d, r2, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r1, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) 6.603754703s ago: executing program 2 (id=60): setns(0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141142) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) userfaultfd(0x801) r2 = socket$can_raw(0x1d, 0x3, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}, 0x2, 0x1}}, 0x2e) setsockopt$CAN_RAW_LOOPBACK(r2, 0x65, 0x3, 0x0, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f0000000640)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce", 0xb3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x11}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000840)={r5, @in6={{0xa, 0x4e21, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x10, 0x2, 0xc0, 0x8, 0x4}, 0x9c) r6 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_GET_EVENT(r6, 0x80286f4e, &(0x7f0000000180)) ioctl$FE_GET_PROPERTY(r6, 0x80106f53, &(0x7f0000000600)={0x7, &(0x7f0000000440)=[{0x25, '\x00', @buffer={"382e5803ed92f7e3a82382b3f29b773f0d7a000000a8a725cd14ccf5807ab2b2", 0x20}, 0xfffffff4}, {0x0, '\x00', @buffer={"ca0e0de0e3bfde98906058e2a46554208d5237cf85e96d768a2fdaa93f9cfff4", 0x20}, 0x2f79}, {0x1d, '\x00', @buffer={"38a2058284dfb9fb24c7faa71014ff248caba650e88ca0c7a9a3a051dd85912b", 0x20}, 0x9}]}) ioctl$FE_SET_FRONTEND(r6, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @vsb={0x6}}) 5.348419555s ago: executing program 0 (id=61): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x0, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @sock_ops}, 0x94) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, 0x0, 0x1b0) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, 0x0, 0x0) r3 = syz_open_procfs(r0, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 5.254277748s ago: executing program 2 (id=62): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_HEADER(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000000c0601010000000000000000000000040500"], 0x28}, 0x1, 0x0, 0x0, 0x5}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) listen(0xffffffffffffffff, 0x5) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000480)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x8080, 0x7, 0xbb, 0xffffd45d, {{0x8, 0x4, 0x3, 0x0, 0x20, 0x65, 0x0, 0x0, 0x2f, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x25}, {[@timestamp_addr={0x44, 0xc, 0xd, 0x1, 0x5, [{@local, 0x4}]}]}}}}}) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x4, r2}, 0x38) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={0x0, 0x0, 0x34}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = socket(0x2d, 0x2, 0x0) connect$netlink(r4, &(0x7f00000001c0)=@unspec={0x2d}, 0xc) write$6lowpan_control(r3, &(0x7f0000000080)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r5) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) 3.589199079s ago: executing program 0 (id=63): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in=@rand_addr=0x64010100, @in=@local, 0x0, 0x0, 0x4e24, 0x0, 0xa, 0x0, 0x0, 0x5c, 0x0, 0xffffffffffffffff}, {0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x7}, {0x0, 0x2a00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0x0, 0x1, 0x0, 0x6}}, 0xb8}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r1, 0x0, 0x0, 0xffd8) 3.57979299s ago: executing program 2 (id=64): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_HEADER(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000000c0601010000000000000000000000040500"], 0x28}, 0x1, 0x0, 0x0, 0x5}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) listen(0xffffffffffffffff, 0x5) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000480)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x8080, 0x7, 0xbb, 0xffffd45d, {{0x8, 0x4, 0x3, 0x0, 0x20, 0x65, 0x0, 0x0, 0x2f, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x25}, {[@timestamp_addr={0x44, 0xc, 0xd, 0x1, 0x5, [{@local, 0x4}]}]}}}}}) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x4, r2}, 0x38) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={0x0, 0x0, 0x34}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = socket(0x2d, 0x2, 0x0) connect$netlink(r4, &(0x7f00000001c0)=@unspec={0x2d}, 0xc) write$6lowpan_control(r3, &(0x7f0000000080)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r5) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) 2.570382916s ago: executing program 2 (id=65): r0 = openat$sequencer2(0xffffff9c, 0x0, 0x20940, 0x0) ioctl$SNDCTL_SEQ_RESET(r0, 0x5100) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f0000001900)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20020000}, 0xc, &(0x7f00000018c0)={0x0, 0xbb8}}, 0x8800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000100)={0x32, 0x0, '\x00', [@pad1, @pad1]}, 0x10) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0xffd8) 2.557394226s ago: executing program 3 (id=66): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000ac0)={'wlan0\x00'}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x46b2d3ba8e12a610}, 0x4008840) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000005c0)={0x2c, r1, 0xa01, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x865}]}, 0x2c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x4000) ioctl$SIOCGETVIFCNT(0xffffffffffffffff, 0x89e0, &(0x7f00000002c0)={0xffffffffffffffff}) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYBLOB="34000000100001002abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="a22104000000000014000300776c616e30000000000000000000000060d0719d6b8c7598260d38e18e47c5e8950eb73d1c59dba1f5206e3557c154e1b892d5298702cee45ae898f041f75040293b547986a71e5b6ccc9fef78b7ed555e88d744c7f90dd9a6ffcee50611d59cf82af0db61fcf1a879706e6c83f7eba09097b7ce99635931cedba33f78ce7b243f5fc55b453567548ef138f62ee6c6ac123a8dabb17d729d883d8f0400cdfefa04192bcc1b9f"], 0x34}}, 0x0) 2.433105559s ago: executing program 0 (id=67): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0xf, 0x4, 0x4, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1e, 0x11, &(0x7f0000000680)=ANY=[@ANYBLOB], &(0x7f0000000740)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[r0], 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x9, 0x0, &(0x7f0000000840)="000000000000000002", 0x0}, 0x50) 2.39978859s ago: executing program 2 (id=68): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141102) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000180)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000200)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x10, &(0x7f0000000400)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000480)={0x0, @in={{0x2, 0x0, @empty}}, 0x7, 0x23}, 0x90) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYRES32=0x0], 0x28}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000600)={r2, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) 2.39951597s ago: executing program 1 (id=69): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{0x0}], 0x1) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_emit_vhci(&(0x7f0000001a40)=ANY=[@ANYBLOB], 0x6) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r1, &(0x7f00000000c0)={0x1d, r2, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r1, &(0x7f0000000140)={0x1d, r2, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r1, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) 2.073905558s ago: executing program 0 (id=70): move_pages(0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0) ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x4) socket$inet6_sctp(0xa, 0x4, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000580), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000005c0), 0x2, 0x141102) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000640)="94", 0xf000}, {0x0}], 0x2) io_uring_setup(0x1b7b, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000700)={0xaa, 0x358}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) syz_open_dev$sg(&(0x7f00000007c0), 0x0, 0x401) 2.014442479s ago: executing program 3 (id=71): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x0, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @sock_ops}, 0x94) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, 0x0, 0x1b0) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, 0x0, 0x0) r3 = syz_open_procfs(r0, &(0x7f0000000080)='smaps\x00') pread64(r3, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 1.312852257s ago: executing program 3 (id=72): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_HEADER(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000000c0601010000000000000000000000040500"], 0x28}, 0x1, 0x0, 0x0, 0x5}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) listen(0xffffffffffffffff, 0x5) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000480)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x8080, 0x7, 0xbb, 0xffffd45d, {{0x8, 0x4, 0x3, 0x0, 0x20, 0x65, 0x0, 0x0, 0x2f, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x25}, {[@timestamp_addr={0x44, 0xc, 0xd, 0x1, 0x5, [{@local, 0x4}]}]}}}}}) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x4, r2}, 0x38) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={0x0, 0x0, 0x34}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = socket(0x2d, 0x2, 0x0) connect$netlink(r4, &(0x7f00000001c0)=@unspec={0x2d}, 0xc) write$6lowpan_control(r3, &(0x7f0000000080)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r5) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) 1.245373519s ago: executing program 1 (id=73): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_HEADER(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000000c0601010000000000000000000000040500"], 0x28}, 0x1, 0x0, 0x0, 0x5}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) listen(0xffffffffffffffff, 0x5) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000480)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x8080, 0x7, 0xbb, 0xffffd45d, {{0x8, 0x4, 0x3, 0x0, 0x20, 0x65, 0x0, 0x0, 0x2f, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x25}, {[@timestamp_addr={0x44, 0xc, 0xd, 0x1, 0x5, [{@local, 0x4}]}]}}}}}) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x4, r2}, 0x38) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={0x0, 0x0, 0x34}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = socket(0x2d, 0x2, 0x0) connect$netlink(r4, &(0x7f00000001c0)=@unspec={0x2d}, 0xc) write$6lowpan_control(r3, &(0x7f0000000080)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r5) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) 1.026047574s ago: executing program 0 (id=74): setns(0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141142) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) userfaultfd(0x801) r2 = socket$can_raw(0x1d, 0x3, 0x1) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}, 0x2, 0x1}}, 0x2e) setsockopt$CAN_RAW_LOOPBACK(r2, 0x65, 0x3, 0x0, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f0000000640)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce", 0xb3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x11}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000840)={r4, @in6={{0xa, 0x4e21, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x10, 0x2, 0xc0, 0x8, 0x4}, 0x9c) r5 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_GET_EVENT(r5, 0x80286f4e, &(0x7f0000000180)) ioctl$FE_GET_PROPERTY(r5, 0x80106f53, &(0x7f0000000600)={0x7, &(0x7f0000000440)=[{0x25, '\x00', @buffer={"382e5803ed92f7e3a82382b3f29b773f0d7a000000a8a725cd14ccf5807ab2b2", 0x20}, 0xfffffff4}, {0x0, '\x00', @buffer={"ca0e0de0e3bfde98906058e2a46554208d5237cf85e96d768a2fdaa93f9cfff4", 0x20}, 0x2f79}, {0x1d, '\x00', @buffer={"38a2058284dfb9fb24c7faa71014ff248caba650e88ca0c7a9a3a051dd85912b", 0x20}, 0x9}]}) ioctl$FE_SET_FRONTEND(r5, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @vsb={0x6}}) 1.019444895s ago: executing program 2 (id=75): move_pages(0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0) ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x4) socket$inet6_sctp(0xa, 0x4, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000580), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000005c0), 0x2, 0x141102) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000640)="94", 0xf000}, {0x0}], 0x2) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000700)={0xaa, 0x358}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000740)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa04, &(0x7f0000000780)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 908.939178ms ago: executing program 3 (id=76): r0 = openat$sequencer2(0xffffff9c, 0x0, 0x20940, 0x0) ioctl$SNDCTL_SEQ_RESET(r0, 0x5100) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f0000001900)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20020000}, 0xc, &(0x7f00000018c0)={0x0, 0xbb8}}, 0x8800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000100)={0x32, 0x0, '\x00', [@pad1, @pad1]}, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0xffd8) 0s ago: executing program 1 (id=77): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in=@rand_addr=0x64010100, @in=@local, 0x0, 0x0, 0x4e24, 0x0, 0xa, 0x0, 0x0, 0x5c, 0x0, 0xffffffffffffffff}, {0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x7}, {0x0, 0x2a00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0x0, 0x1, 0x0, 0x6}}, 0xb8}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r1, 0x0, 0x0, 0xffd8) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.45' (ED25519) to the list of known hosts. [ 73.341178][ T5759] cgroup: Unknown subsys name 'net' [ 73.505571][ T5759] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.880756][ T5759] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.310064][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.318811][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.326505][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.334620][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.342536][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 76.349912][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.418846][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.427365][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.439054][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.447007][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.454873][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 76.468566][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.495741][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.504201][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.512882][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.521249][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.528978][ T51] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 76.537282][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.572229][ T5089] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.581519][ T5089] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.591557][ T5089] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.602283][ T5089] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.630887][ T5089] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 76.638657][ T5089] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.886697][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 76.913326][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 77.091677][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 77.103579][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.110868][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.120595][ T5774] bridge_slave_0: entered allmulticast mode [ 77.127390][ T5774] bridge_slave_0: entered promiscuous mode [ 77.136602][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.143919][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.151368][ T5774] bridge_slave_1: entered allmulticast mode [ 77.158098][ T5774] bridge_slave_1: entered promiscuous mode [ 77.165160][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.172566][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.180163][ T5771] bridge_slave_0: entered allmulticast mode [ 77.186862][ T5771] bridge_slave_0: entered promiscuous mode [ 77.238600][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.245806][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.253693][ T5771] bridge_slave_1: entered allmulticast mode [ 77.260620][ T5771] bridge_slave_1: entered promiscuous mode [ 77.279858][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.291533][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.345487][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.379553][ T5774] team0: Port device team_slave_0 added [ 77.387730][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.416995][ T5774] team0: Port device team_slave_1 added [ 77.433660][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.440998][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.448222][ T5776] bridge_slave_0: entered allmulticast mode [ 77.454910][ T5776] bridge_slave_0: entered promiscuous mode [ 77.467167][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.474465][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.481961][ T5776] bridge_slave_1: entered allmulticast mode [ 77.489171][ T5776] bridge_slave_1: entered promiscuous mode [ 77.552487][ T5771] team0: Port device team_slave_0 added [ 77.569017][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.575994][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.602513][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.616674][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.629272][ T5778] chnl_net:caif_netlink_parms(): no params data found [ 77.641398][ T5771] team0: Port device team_slave_1 added [ 77.647771][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.655130][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.681419][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.694087][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.762954][ T5776] team0: Port device team_slave_0 added [ 77.772439][ T5776] team0: Port device team_slave_1 added [ 77.823334][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.831811][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.858427][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.884370][ T5774] hsr_slave_0: entered promiscuous mode [ 77.891223][ T5774] hsr_slave_1: entered promiscuous mode [ 77.912985][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.920439][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.946540][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.958275][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.965249][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.991818][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.005032][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.012356][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.038724][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.117737][ T5778] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.127395][ T5778] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.134767][ T5778] bridge_slave_0: entered allmulticast mode [ 78.142571][ T5778] bridge_slave_0: entered promiscuous mode [ 78.150176][ T5778] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.157291][ T5778] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.164798][ T5778] bridge_slave_1: entered allmulticast mode [ 78.171713][ T5778] bridge_slave_1: entered promiscuous mode [ 78.248543][ T5771] hsr_slave_0: entered promiscuous mode [ 78.255113][ T5771] hsr_slave_1: entered promiscuous mode [ 78.262354][ T5771] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.270332][ T5771] Cannot create hsr debugfs directory [ 78.287109][ T5778] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.308442][ T5778] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.364925][ T5776] hsr_slave_0: entered promiscuous mode [ 78.372395][ T5776] hsr_slave_1: entered promiscuous mode [ 78.379218][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.386808][ T5776] Cannot create hsr debugfs directory [ 78.398969][ T5089] Bluetooth: hci0: command tx timeout [ 78.438267][ T5778] team0: Port device team_slave_0 added [ 78.473619][ T5778] team0: Port device team_slave_1 added [ 78.550961][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.557949][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.585336][ T5089] Bluetooth: hci2: command tx timeout [ 78.585358][ T5781] Bluetooth: hci1: command tx timeout [ 78.592769][ T5778] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.610498][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.617532][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.644454][ T5778] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.718351][ T5089] Bluetooth: hci3: command tx timeout [ 78.773792][ T5774] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.811884][ T5774] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.829532][ T5778] hsr_slave_0: entered promiscuous mode [ 78.836047][ T5778] hsr_slave_1: entered promiscuous mode [ 78.843246][ T5778] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.850898][ T5778] Cannot create hsr debugfs directory [ 78.856470][ T5774] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.868503][ T5774] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.959863][ T5771] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.970947][ T5771] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 78.986346][ T5771] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 78.997152][ T5771] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 79.149434][ T5776] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 79.172031][ T5776] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 79.183315][ T5776] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 79.197418][ T5776] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 79.344899][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.353082][ T5778] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 79.366527][ T5778] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 79.384589][ T5778] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 79.394874][ T5778] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 79.444496][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.455077][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.480090][ T2957] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.487318][ T2957] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.522344][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.536118][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.543338][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.581875][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.589051][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.602937][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.610098][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.623527][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.676060][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.704711][ T5771] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 79.718139][ T5771] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 79.745755][ T5778] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.772345][ T2957] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.779561][ T2957] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.800505][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.807733][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.863761][ T5778] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.917603][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.924826][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.952851][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.960044][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.130365][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.294081][ T5771] veth0_vlan: entered promiscuous mode [ 80.327709][ T5771] veth1_vlan: entered promiscuous mode [ 80.384935][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.437898][ T5771] veth0_macvtap: entered promiscuous mode [ 80.464741][ T5771] veth1_macvtap: entered promiscuous mode [ 80.479086][ T5089] Bluetooth: hci0: command tx timeout [ 80.539934][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.573573][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.602152][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.612133][ T5771] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.622077][ T5771] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.632495][ T5771] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.641394][ T5089] Bluetooth: hci2: command tx timeout [ 80.646844][ T5771] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.655640][ T5089] Bluetooth: hci1: command tx timeout [ 80.672533][ T5774] veth0_vlan: entered promiscuous mode [ 80.699339][ T5778] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.713083][ T5774] veth1_vlan: entered promiscuous mode [ 80.803350][ T5089] Bluetooth: hci3: command tx timeout [ 80.820197][ T5774] veth0_macvtap: entered promiscuous mode [ 80.831053][ T5774] veth1_macvtap: entered promiscuous mode [ 80.853769][ T5778] veth0_vlan: entered promiscuous mode [ 80.890964][ T5776] veth0_vlan: entered promiscuous mode [ 80.923953][ T5778] veth1_vlan: entered promiscuous mode [ 80.936497][ T2969] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.943476][ T5776] veth1_vlan: entered promiscuous mode [ 80.955782][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.961068][ T2969] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.970077][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.985550][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.047948][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.061551][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.073101][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.086971][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.090956][ T5778] veth0_macvtap: entered promiscuous mode [ 81.100873][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.132225][ T5778] veth1_macvtap: entered promiscuous mode [ 81.143178][ T5774] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.152551][ T5774] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.162981][ T5774] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.175478][ T5774] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.209302][ T5776] veth0_macvtap: entered promiscuous mode [ 81.267679][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.280236][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.292143][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.302861][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.315991][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.336670][ T5776] veth1_macvtap: entered promiscuous mode [ 81.369780][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.381134][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.396223][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.406936][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.419686][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.470701][ T5778] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.486298][ T5778] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.495798][ T5778] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.505744][ T5778] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.590600][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.603071][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.613196][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.626318][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.636659][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.648216][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.662205][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.677459][ T2957] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.714191][ T2957] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.770828][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.784731][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.795110][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.806165][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.816752][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.829127][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.854594][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.984303][ T5776] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.000474][ T5776] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.010011][ T5776] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.019083][ T5776] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.042601][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.052219][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.262404][ T2957] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.288333][ T2957] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.559839][ T5089] Bluetooth: hci0: command tx timeout [ 82.560626][ T2969] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.587462][ T2969] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.647287][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.691895][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.719104][ T5089] Bluetooth: hci1: command tx timeout [ 82.720364][ T5781] Bluetooth: hci2: command tx timeout [ 82.770802][ T76] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.801003][ T76] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.881042][ T5781] Bluetooth: hci3: command tx timeout [ 84.638100][ T5781] Bluetooth: hci0: command tx timeout [ 84.809781][ T5781] Bluetooth: hci2: command tx timeout [ 84.815521][ T5781] Bluetooth: hci1: command tx timeout [ 84.961093][ T5089] Bluetooth: hci3: command tx timeout [ 85.873361][ T5869] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 89.668142][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 92.522471][ T42] cfg80211: failed to load regulatory.db [ 95.185510][ T5965] syz.0.31[5965]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 95.200955][ T5965] loop0: detected capacity change from 0 to 512 [ 95.219106][ T5965] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 95.295609][ T5965] EXT4-fs (loop0): 1 truncate cleaned up [ 95.310000][ T5965] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 96.130760][ T27] audit: type=1800 audit(1791854233.897:2): pid=5975 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.31" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 96.462359][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 101.754338][ T6028] loop3: detected capacity change from 0 to 512 [ 101.772525][ T6028] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 101.837490][ T6028] EXT4-fs (loop3): 1 truncate cleaned up [ 101.861125][ T6028] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 102.659721][ T27] audit: type=1800 audit(1791854240.537:3): pid=6035 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.45" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 103.862252][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 107.765331][ T6073] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 109.102445][ T6088] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 112.109901][ T6112] Zero length message leads to an empty skb [ 112.183816][ T6112] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 112.458512][ T6112] syz.3.66 (6112) used greatest stack depth: 19976 bytes left [ 114.651481][ T6153] ================================================================== [ 114.659930][ T6153] BUG: KASAN: slab-use-after-free in dvb_device_open+0xc9/0x360 [ 114.667616][ T6153] Read of size 8 at addr ffff888027e0de18 by task syz.0.74/6153 [ 114.675387][ T6153] [ 114.677747][ T6153] CPU: 1 PID: 6153 Comm: syz.0.74 Not tainted syzkaller #0 [ 114.684983][ T6153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 114.695160][ T6153] Call Trace: [ 114.698461][ T6153] [ 114.701412][ T6153] dump_stack_lvl+0x18c/0x250 [ 114.706103][ T6153] ? read_lock_is_recursive+0x20/0x20 [ 114.711502][ T6153] ? show_regs_print_info+0x20/0x20 [ 114.716717][ T6153] ? load_image+0x420/0x420 [ 114.721267][ T6153] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 114.726746][ T6153] ? __virt_addr_valid+0x10c/0x380 [ 114.731878][ T6153] ? __virt_addr_valid+0x10c/0x380 [ 114.737010][ T6153] ? __virt_addr_valid+0x10c/0x380 [ 114.742142][ T6153] print_report+0xa8/0x210 [ 114.746582][ T6153] ? dvb_device_open+0xc9/0x360 [ 114.751455][ T6153] kasan_report+0x117/0x150 [ 114.755982][ T6153] ? chrdev_open+0x385/0x600 [ 114.760595][ T6153] ? dvb_device_open+0xc9/0x360 [ 114.765478][ T6153] dvb_device_open+0xc9/0x360 [ 114.770182][ T6153] chrdev_open+0x58c/0x600 [ 114.774617][ T6153] ? cd_forget+0x160/0x160 [ 114.779052][ T6153] ? fsnotify_perm+0x3ed/0x5e0 [ 114.783844][ T6153] do_dentry_open+0x880/0x14b0 [ 114.788640][ T6153] ? cd_forget+0x160/0x160 [ 114.793045][ T6153] path_openat+0x284f/0x3270 [ 114.797635][ T6153] ? do_sys_openat2+0xda/0x1d0 [ 114.802407][ T6153] ? __x64_sys_openat+0x139/0x160 [ 114.807421][ T6153] ? verify_lock_unused+0x140/0x140 [ 114.812783][ T6153] ? do_filp_open+0x430/0x430 [ 114.817450][ T6153] do_filp_open+0x1f2/0x430 [ 114.821944][ T6153] ? vfs_tmpfile+0x620/0x620 [ 114.826528][ T6153] ? _raw_spin_unlock+0x28/0x40 [ 114.831370][ T6153] ? alloc_fd+0x590/0x640 [ 114.835686][ T6153] do_sys_openat2+0x134/0x1d0 [ 114.840351][ T6153] ? do_sys_open+0xe0/0xe0 [ 114.844753][ T6153] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 114.850720][ T6153] ? lock_chain_count+0x20/0x20 [ 114.855573][ T6153] __x64_sys_openat+0x139/0x160 [ 114.860419][ T6153] do_syscall_64+0x55/0xb0 [ 114.864820][ T6153] ? clear_bhb_loop+0x40/0x90 [ 114.869506][ T6153] ? clear_bhb_loop+0x40/0x90 [ 114.874169][ T6153] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 114.880070][ T6153] RIP: 0033:0x7ff5d795ea0e [ 114.884481][ T6153] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 114.904100][ T6153] RSP: 002b:00007ff5d884fb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 114.912527][ T6153] RAX: ffffffffffffffda RBX: 00007ff5d88506c0 RCX: 00007ff5d795ea0e [ 114.920496][ T6153] RDX: 0000000000040002 RSI: 00007ff5d884fc00 RDI: ffffffffffffff9c [ 114.928483][ T6153] RBP: 00007ff5d884fc00 R08: 0000000000000000 R09: 0000000000000000 [ 114.936448][ T6153] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 114.944418][ T6153] R13: 00007ff5d7c26128 R14: 00007ff5d7c26090 R15: 00007ffd84a14308 [ 114.952432][ T6153] [ 114.955436][ T6153] [ 114.957740][ T6153] Allocated by task 1: [ 114.961795][ T6153] kasan_set_track+0x4e/0x70 [ 114.966400][ T6153] __kasan_kmalloc+0x8f/0xa0 [ 114.970987][ T6153] dvb_register_device+0x309/0x1df0 [ 114.976174][ T6153] dvb_register_frontend+0x62d/0x900 [ 114.981446][ T6153] vidtv_bridge_probe+0x9d6/0xf60 [ 114.986520][ T6153] platform_probe+0x13b/0x1c0 [ 114.991199][ T6153] really_probe+0x247/0xae0 [ 114.995689][ T6153] __driver_probe_device+0x1f5/0x390 [ 115.000964][ T6153] driver_probe_device+0x4f/0x420 [ 115.005969][ T6153] __driver_attach+0x444/0x6d0 [ 115.010714][ T6153] bus_for_each_dev+0x235/0x2b0 [ 115.015552][ T6153] bus_add_driver+0x340/0x630 [ 115.020228][ T6153] driver_register+0x23a/0x310 [ 115.024996][ T6153] vidtv_bridge_init+0x49/0x80 [ 115.029765][ T6153] do_one_initcall+0x242/0x790 [ 115.034518][ T6153] do_initcall_level+0x13d/0x1f0 [ 115.039462][ T6153] do_initcalls+0x69/0xd0 [ 115.043795][ T6153] kernel_init_freeable+0x3d9/0x560 [ 115.048976][ T6153] kernel_init+0x1d/0x1c0 [ 115.053288][ T6153] ret_from_fork+0x48/0x80 [ 115.057707][ T6153] ret_from_fork_asm+0x11/0x20 [ 115.062455][ T6153] [ 115.064762][ T6153] Freed by task 6088: [ 115.068783][ T6153] kasan_set_track+0x4e/0x70 [ 115.073378][ T6153] kasan_save_free_info+0x28/0x40 [ 115.078406][ T6153] ____kasan_slab_free+0x126/0x1f0 [ 115.083504][ T6153] slab_free_freelist_hook+0x130/0x1a0 [ 115.088944][ T6153] __kmem_cache_free+0xba/0x1f0 [ 115.093783][ T6153] dvb_device_open+0x2d9/0x360 [ 115.098550][ T6153] chrdev_open+0x58c/0x600 [ 115.102950][ T6153] do_dentry_open+0x880/0x14b0 [ 115.107700][ T6153] path_openat+0x284f/0x3270 [ 115.112287][ T6153] do_filp_open+0x1f2/0x430 [ 115.116771][ T6153] do_sys_openat2+0x134/0x1d0 [ 115.121435][ T6153] __x64_sys_openat+0x139/0x160 [ 115.126288][ T6153] do_syscall_64+0x55/0xb0 [ 115.130694][ T6153] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 115.136573][ T6153] [ 115.138884][ T6153] The buggy address belongs to the object at ffff888027e0de00 [ 115.138884][ T6153] which belongs to the cache kmalloc-256 of size 256 [ 115.153022][ T6153] The buggy address is located 24 bytes inside of [ 115.153022][ T6153] freed 256-byte region [ffff888027e0de00, ffff888027e0df00) [ 115.166742][ T6153] [ 115.169073][ T6153] The buggy address belongs to the physical page: [ 115.175479][ T6153] page:ffffea00009f8300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27e0c [ 115.185616][ T6153] head:ffffea00009f8300 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 115.194550][ T6153] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 115.202535][ T6153] page_type: 0xffffffff() [ 115.206865][ T6153] raw: 00fff00000000840 ffff888018841b40 dead000000000122 0000000000000000 [ 115.215438][ T6153] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 115.224004][ T6153] page dumped because: kasan: bad access detected [ 115.230411][ T6153] page_owner tracks the page as allocated [ 115.236102][ T6153] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16507828247, free_ts 0 [ 115.255800][ T6153] post_alloc_hook+0x1c1/0x200 [ 115.260584][ T6153] get_page_from_freelist+0x2181/0x22a0 [ 115.266122][ T6153] __alloc_pages+0x1f0/0x460 [ 115.270703][ T6153] alloc_page_interleave+0x24/0x1e0 [ 115.275888][ T6153] alloc_slab_page+0x5d/0x180 [ 115.280574][ T6153] new_slab+0x87/0x2d0 [ 115.284646][ T6153] ___slab_alloc+0xc5c/0x12f0 [ 115.289310][ T6153] __kmem_cache_alloc_node+0x11f/0x250 [ 115.294765][ T6153] kmalloc_trace+0x2a/0xe0 [ 115.299184][ T6153] bus_add_driver+0x162/0x630 [ 115.303850][ T6153] driver_register+0x23a/0x310 [ 115.308665][ T6153] usb_register_driver+0x1aa/0x360 [ 115.313772][ T6153] do_one_initcall+0x242/0x790 [ 115.318536][ T6153] do_initcall_level+0x13d/0x1f0 [ 115.323501][ T6153] do_initcalls+0x69/0xd0 [ 115.327847][ T6153] kernel_init_freeable+0x3d9/0x560 [ 115.333052][ T6153] page_owner free stack trace missing [ 115.338505][ T6153] [ 115.340849][ T6153] Memory state around the buggy address: [ 115.346460][ T6153] ffff888027e0dd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 115.354547][ T6153] ffff888027e0dd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 115.362598][ T6153] >ffff888027e0de00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.370657][ T6153] ^ [ 115.375592][ T6153] ffff888027e0de80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.383637][ T6153] ffff888027e0df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 115.391703][ T6153] ================================================================== [ 115.412778][ T6153] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 115.420009][ T6153] CPU: 1 PID: 6153 Comm: syz.0.74 Not tainted syzkaller #0 [ 115.427212][ T6153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 115.437279][ T6153] Call Trace: [ 115.440570][ T6153] [ 115.443510][ T6153] dump_stack_lvl+0x18c/0x250 [ 115.448204][ T6153] ? show_regs_print_info+0x20/0x20 [ 115.453419][ T6153] ? load_image+0x420/0x420 [ 115.457942][ T6153] panic+0x2ca/0x720 [ 115.461861][ T6153] ? bpf_jit_dump+0xd0/0xd0 [ 115.466381][ T6153] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 115.472035][ T6153] ? dvb_device_open+0xc9/0x360 [ 115.476912][ T6153] ? check_panic_on_warn+0x70/0xa0 [ 115.482052][ T6153] ? dvb_device_open+0xc9/0x360 [ 115.486931][ T6153] check_panic_on_warn+0x84/0xa0 [ 115.491889][ T6153] ? dvb_device_open+0xc9/0x360 [ 115.496762][ T6153] end_report+0x6f/0x130 [ 115.501033][ T6153] kasan_report+0x128/0x150 [ 115.505551][ T6153] ? chrdev_open+0x385/0x600 [ 115.510161][ T6153] ? dvb_device_open+0xc9/0x360 [ 115.515043][ T6153] dvb_device_open+0xc9/0x360 [ 115.519795][ T6153] chrdev_open+0x58c/0x600 [ 115.524231][ T6153] ? cd_forget+0x160/0x160 [ 115.528662][ T6153] ? fsnotify_perm+0x3ed/0x5e0 [ 115.533444][ T6153] do_dentry_open+0x880/0x14b0 [ 115.538227][ T6153] ? cd_forget+0x160/0x160 [ 115.542656][ T6153] path_openat+0x284f/0x3270 [ 115.547271][ T6153] ? do_sys_openat2+0xda/0x1d0 [ 115.552058][ T6153] ? __x64_sys_openat+0x139/0x160 [ 115.557206][ T6153] ? verify_lock_unused+0x140/0x140 [ 115.562434][ T6153] ? do_filp_open+0x430/0x430 [ 115.567130][ T6153] do_filp_open+0x1f2/0x430 [ 115.571639][ T6153] ? vfs_tmpfile+0x620/0x620 [ 115.576234][ T6153] ? _raw_spin_unlock+0x28/0x40 [ 115.581088][ T6153] ? alloc_fd+0x590/0x640 [ 115.585421][ T6153] do_sys_openat2+0x134/0x1d0 [ 115.590142][ T6153] ? do_sys_open+0xe0/0xe0 [ 115.594560][ T6153] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 115.600540][ T6153] ? lock_chain_count+0x20/0x20 [ 115.605389][ T6153] __x64_sys_openat+0x139/0x160 [ 115.610272][ T6153] do_syscall_64+0x55/0xb0 [ 115.614680][ T6153] ? clear_bhb_loop+0x40/0x90 [ 115.619368][ T6153] ? clear_bhb_loop+0x40/0x90 [ 115.624036][ T6153] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 115.629932][ T6153] RIP: 0033:0x7ff5d795ea0e [ 115.634349][ T6153] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 115.653957][ T6153] RSP: 002b:00007ff5d884fb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 115.662367][ T6153] RAX: ffffffffffffffda RBX: 00007ff5d88506c0 RCX: 00007ff5d795ea0e [ 115.670343][ T6153] RDX: 0000000000040002 RSI: 00007ff5d884fc00 RDI: ffffffffffffff9c [ 115.678315][ T6153] RBP: 00007ff5d884fc00 R08: 0000000000000000 R09: 0000000000000000 [ 115.686293][ T6153] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 115.694260][ T6153] R13: 00007ff5d7c26128 R14: 00007ff5d7c26090 R15: 00007ffd84a14308 [ 115.702243][ T6153] [ 115.705599][ T6153] Kernel Offset: disabled [ 115.709930][ T6153] Rebooting in 86400 seconds..